documented process(es) that documented or collectively include each of the implemented a applicable requirement parts in process(es) to monitor for, investigate, and CIP-010-2 Table R2 – document detected Configuration Monitoring. [See Table R2 of the standard.] unauthorized changes to the baseline at least once every 35 calendar days. (2.1) R3. Each Responsible Entity shall CIP-010-2 The Responsible Entity The Responsible Entity has The Responsible Entity The Responsible implement one or more has implemented one implemented one or more has implemented one or Entity has not documented process(es) that or more documented documented vulnerability more documented implemented any collectively include each of the vulnerability assessment processes for each vulnerability assessment vulnerability applicable requirement parts in assessment processes of its applicable BES Cyber processes for each of its assessment processes CIP-010-2 Table R3– for each of its Systems, but has performed a applicable BES Cyber for one of its Vulnerability Assessments. applicable BES Cyber vulnerability assessment more Systems, but has applicable BES Cyber [See Table R3 of the standard.] Systems, but has than 18 months, but less than performed a Systems. (R3) performed a 21, months since the last vulnerability assessment OR vulnerability assessment on one of its more than 21 months, assessment more than applicable BES Cyber but less than 24 months, The Responsible 15 months, but less Systems. (3.1) since the last assessment Entity has than 18 months, since on one of its applicable implemented one or OR the last assessment on BES Cyber Systems. more documented one of its applicable The Responsible Entity has (3.1) vulnerability BES Cyber Systems. implemented one or more assessment processes OR (3.1) documented active for each of its vulnerability assessment The Responsible Entity applicable BES Cyber OR processes for Applicable has implemented one or Systems, but has The Responsible Entity Systems, but has performed an more documented active performed a has implemented one active vulnerability assessment vulnerability assessment vulnerability or more documented more than 39 months, but less processes for Applicable assessment more than active vulnerability than 42 months, since the last Systems, but has 24 months since the assessment processes active assessment on one of its performed an active last assessment on one for Applicable applicable BES Cyber vulnerability assessment of its applicable BES Systems, but has Systems. (3.2) more than 42 months, Cyber Systems. (3.1) performed an active but less than 45 months, OR vulnerability since the last active assessment more than assessment on one of its
documented process(es) that collectively include each of the applicable requirement parts in CIP-010-2 Table R2 – Configuration Monitoring. [See Table R2 of the standard.] documented or implemented a process(es) to monitor for, investigate, and document detected unauthorized changes to the baseline at least once every 35 calendar days. (2.1) CIP-010-2 R3. Each Responsible Entity shall implement one or more documented process(es) that collectively include each of the applicable requirement parts in CIP-010-2 Table R3– Vulnerability Assessments. [See Table R3 of the standard.] The Responsible Entity has implemented one or more documented vulnerability assessment processes for each of its applicable BES Cyber Systems, but has performed a vulnerability assessment more than 15 months, but less than 18 months, since the last assessment on one of its applicable BES Cyber Systems. (3.1) OR The Responsible Entity has implemented one or more documented active vulnerability assessment processes for Applicable Systems, but has performed an active vulnerability assessment more than The Responsible Entity has implemented one or more documented vulnerability assessment processes for each of its applicable BES Cyber Systems, but has performed a vulnerability assessment more than 18 months, but less than 21, months since the last assessment on one of its applicable BES Cyber Systems. (3.1) OR The Responsible Entity has implemented one or more documented active vulnerability assessment processes for Applicable Systems, but has performed an active vulnerability assessment more than 39 months, but less than 42 months, since the last active assessment on one of its applicable BES Cyber Systems. (3.2) The Responsible Entity has implemented one or more documented vulnerability assessment processes for each of its applicable BES Cyber Systems, but has performed a vulnerability assessment more than 21 months, but less than 24 months, since the last assessment on one of its applicable BES Cyber Systems. (3.1) OR The Responsible Entity has implemented one or more documented active vulnerability assessment processes for Applicable Systems, but has performed an active vulnerability assessment more than 42 months, but less than 45 months, since the last active assessment on one of its The Responsible Entity has not implemented any vulnerability assessment processes for one of its applicable BES Cyber Systems. (R3) OR The Responsible Entity has implemented one or more documented vulnerability assessment processes for each of its applicable BES Cyber Systems, but has performed a vulnerability assessment more than 24 months since the last assessment on one of its applicable BES Cyber Systems. (3.1) OR
VSL_Matrix_Complete_2016_01_27.docx