delegate according to or equal to 17 calendar months according to Requirement Requirement R2 within Requirement R2 within of the previous approval. (R2.2) R2 within 17 calendar 18 calendar months of 15 calendar months but months but less than or the previous approval. less than or equal to 16 equal to 18 calendar (R2.2) calendar months of the months of the previous previous approval. approval. (R2.2) (R2.2) Cyber Security Policy The — CIP-003-3 R1. N/A N/A N/A The Responsible Entity Responsible Entity shall has not documented or document and implement a cyber implemented a cyber security policy that represents security policy. and management’s commitment ability to secure its Critical Cyber Assets. The Responsible Entity shall, at minimum, ensure the following: The cyber security policy CIP-003-3 R1.1. N/A N/A N/A The Responsible addresses the requirements in Entity's cyber security Standards CIP-002-3 through policy does not address CIP-009-3, including provision all the requirements in for emergency situations. Standards CIP-002 through CIP-009, including provision for emergency situations. The cyber security policy is CIP-003-3 R1.2. N/A N/A N/A The Responsible readily available to all personnel Entity's cyber security who have access to, or are policy is not readily responsible for, Critical Cyber available to all Assets. personnel who have access to, or are (Retirement approved by FERC responsible for, Critical effective January 21, 2014) Cyber Assets. Annual review and approval of CIP-003-3 R1.3 N/A N/A N/A The Responsible the cyber security policy by the Entity's senior senior manager assigned pursuant manager, assigned to R2. pursuant to R2, did not complete the annual
delegate according to Requirement R2 within 15 calendar months but less than or equal to 16 calendar months of the previous approval. (R2.2) or equal to 17 calendar months of the previous approval. (R2.2) according to Requirement R2 within 17 calendar months but less than or equal to 18 calendar months of the previous approval. (R2.2) Requirement R2 within 18 calendar months of the previous approval. (R2.2) CIP-003-3 R1. Cyber Security Policy — The Responsible Entity shall document and implement a cyber security policy that represents management’s commitment and ability to secure its Critical Cyber Assets. The Responsible Entity shall, at minimum, ensure the following: N/A N/A N/A The Responsible Entity has not documented or implemented a cyber security policy. CIP-003-3 R1.1. The cyber security policy addresses the requirements in Standards CIP-002-3 through CIP-009-3, including provision for emergency situations. N/A N/A N/A The Responsible Entity's cyber security policy does not address all the requirements in Standards CIP-002 through CIP-009, including provision for emergency situations. CIP-003-3 R1.2. The cyber security policy is readily available to all personnel who have access to, or are responsible for, Critical Cyber Assets. (Retirement approved by FERC effective January 21, 2014) N/A N/A N/A The Responsible Entity's cyber security policy is not readily available to all personnel who have access to, or are responsible for, Critical Cyber Assets. CIP-003-3 R1.3 Annual review and approval of the cyber security policy by the senior manager assigned pursuant to R2. N/A N/A N/A The Responsible Entity's senior manager, assigned pursuant to R2, did not complete the annual
VSL_Matrix_Complete_2016_01_27.docx