process(es) to identify undetected Cyber Security Incidents by reviewing an entity-determined summarization or sampling of logged events at least every 15 calendar days but missed two or more intervals and did not identify, assess, or correct the deficiencies. (4.4) Each Responsible Entity shall CIP-007-5 R5. The Responsible The Responsible Entity has The Responsible The Responsible Entity implement, in a manner that Entity has implemented one or more Entity has did not implement or identifies, assesses, and corrects implemented one documented process(es) for implemented one document one or more deficiencies, one or more or more password-only authentication for or more process(es) that documented processes that documented interactive user access but did not documented included the applicable collectively include each of the process(es) for technically or procedurally enforce process(es) for items in CIP-007-5 applicable requirement parts in password-only password changes or an obligation to System Access Table R5 and has CIP-007-5 Table R5 System – authentication change the password within 16 Controls but, did identified deficiencies Access Controls. for interactive calendar months but less than or not include the but did not assess or user access but equal to 17 calendar months of the identification or correct the deficiencies. did not last password change and has inventory of all (R5) technically or identified deficiencies but did not known enabled OR procedurally assess or correct the deficiencies. default or other The Responsible Entity enforce password (5.6) generic account did not implement or changes or an types, either by OR document one or more obligation to system, by groups The Responsible Entity has process(es) that change the of systems, by implemented one or more included the applicable password within location, or by documented process(es) for items in CIP-007-5 15 calendar system type(s) and password-only authentication for Table R5 and did not months but less has identified interactive user access but did not identify, assess, or than or equal to deficiencies but technically or procedurally enforce 16 calendar did not assess or
process(es) to identify undetected Cyber Security Incidents by reviewing an entity-determined summarization or sampling of logged events at least every 15 calendar days but missed two or more intervals and did not identify, assess, or correct the deficiencies. (4.4) CIP-007-5 R5. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R5 – System Access Controls. The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access but did not technically or procedurally enforce password changes or an obligation to change the password within 15 calendar months but less than or equal to 16 calendar The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access but did not technically or procedurally enforce password changes or an obligation to change the password within 16 calendar months but less than or equal to 17 calendar months of the last password change and has identified deficiencies but did not assess or correct the deficiencies. (5.6) OR The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access but did not technically or procedurally enforce The Responsible Entity has implemented one or more documented process(es) for System Access Controls but, did not include the identification or inventory of all known enabled default or other generic account types, either by system, by groups of systems, by location, or by system type(s) and has identified deficiencies but did not assess or The Responsible Entity did not implement or document one or more process(es) that included the applicable items in CIP-007-5 Table R5 and has identified deficiencies but did not assess or correct the deficiencies. (R5) OR The Responsible Entity did not implement or document one or more process(es) that included the applicable items in CIP-007-5 Table R5 and did not identify, assess, or
VSL_Matrix_Complete_2016_01_01.docx