personnel risk assessment. The Responsible Entity shall R3.3. The Responsible The Responsible Entity did not The Responsible The Responsible Entity document the results of personnel Entity did not document the results of personnel Entity did not did not document the risk assessments of its personnel document the risk assessments for 5% or more but document the results of personnel having authorized cyber or results of less than 10% of all personnel with results of risk assessments for authorized unescorted physical personnel risk authorized cyber or authorized personnel risk 15% or more of all access to Critical Cyber Assets, assessments for unescorted physical access to Critical assessments for personnel with and that personnel risk at least one Cyber Assets, pursuant to Standard 10% or more but authorized cyber or assessments of contractor and individual but CIP-004. less than 15% of authorized unescorted service vendor personnel with less than 5% of all personnel with physical access to such access are conducted all personnel authorized cyber Critical Cyber Assets, pursuant to Standard CIP-004-3. with authorized or authorized pursuant to Standard cyber or unescorted CIP-004. authorized physical access to unescorted Critical Cyber physical access Assets, pursuant to to Critical Cyber Standard CIP-004. Assets, pursuant to Standard Access The Responsible — R4. The Responsible The Responsible Entity did not The Responsible The Responsible Entity Entity shall maintain list(s) of Entity did not maintain complete list(s) of personnel Entity did not did not maintain personnel with authorized cyber maintain with authorized cyber or authorized maintain complete complete list(s) of or authorized unescorted physical complete list(s) unescorted physical access to Critical list(s) of personnel personnel with access to Critical Cyber Assets, of personnel with Cyber Assets, including their specific with authorized authorized cyber or including their specific electronic authorized cyber electronic and physical access rights cyber or authorized unescorted and physical access rights to or authorized to Critical Cyber Assets, missing 5% authorized physical access to Critical Cyber Assets. unescorted or more but less than 10% of the unescorted Critical Cyber Assets, physical access authorized personnel. physical access to including their specific to Critical Cyber Critical Cyber electronic and physical Assets, including Assets, including access rights to Critical their specific their specific Cyber Assets, missing electronic and electronic and 15% or more of the physical access physical access authorized personnel. rights to Critical rights to Critical Cyber Assets, Cyber Assets, missing at least missing 10% or
personnel risk assessment. R3.3. The Responsible Entity shall document the results of personnel risk assessments of its personnel having authorized cyber or authorized unescorted physical access to Critical Cyber Assets, and that personnel risk assessments of contractor and service vendor personnel with such access are conducted pursuant to Standard CIP-004-3. The Responsible Entity did not document the results of personnel risk assessments for at least one individual but less than 5% of all personnel with authorized cyber or authorized unescorted physical access to Critical Cyber Assets, pursuant to Standard The Responsible Entity did not document the results of personnel risk assessments for 5% or more but less than 10% of all personnel with authorized cyber or authorized unescorted physical access to Critical Cyber Assets, pursuant to Standard CIP-004. The Responsible Entity did not document the results of personnel risk assessments for 10% or more but less than 15% of all personnel with authorized cyber or authorized unescorted physical access to Critical Cyber Assets, pursuant to Standard CIP-004. The Responsible Entity did not document the results of personnel risk assessments for 15% or more of all personnel with authorized cyber or authorized unescorted physical access to Critical Cyber Assets, pursuant to Standard CIP-004. R4. Access — The Responsible Entity shall maintain list(s) of personnel with authorized cyber or authorized unescorted physical access to Critical Cyber Assets, including their specific electronic and physical access rights to Critical Cyber Assets. The Responsible Entity did not maintain complete list(s) of personnel with authorized cyber or authorized unescorted physical access to Critical Cyber Assets, including their specific electronic and physical access rights to Critical Cyber Assets, missing at least The Responsible Entity did not maintain complete list(s) of personnel with authorized cyber or authorized unescorted physical access to Critical Cyber Assets, including their specific electronic and physical access rights to Critical Cyber Assets, missing 5% or more but less than 10% of the authorized personnel. The Responsible Entity did not maintain complete list(s) of personnel with authorized cyber or authorized unescorted physical access to Critical Cyber Assets, including their specific electronic and physical access rights to Critical Cyber Assets, missing 10% or The Responsible Entity did not maintain complete list(s) of personnel with authorized cyber or authorized unescorted physical access to Critical Cyber Assets, including their specific electronic and physical access rights to Critical Cyber Assets, missing 15% or more of the authorized personnel.
VSL_Matrix_Complete_2016_01_01.docx