correct the deficiencies. (2.3) R3. Each Responsible Entity shall CIP-009-5 The Responsible The Responsible Entity has not The Responsible The Responsible Entity maintain each of its recovery Entity has not updated the recovery plan(s) based on Entity has neither has neither documented plans in accordance with each of notified each any documented lessons learned documented lessons learned nor the applicable requirement parts person or group within 90 and less than 120 calendar lessons learned nor documented the in CIP‐009‐5 Table R3 – with a defined days of each recovery plan test or documented the absence of any lessons Recovery Plan Review, Update role in the actual recovery. (3.1.2) absence of any learned within 120 and Communication. recovery plan(s) lessons learned calendar days of each OR of updates within within 90 and less recovery plan test or 90 and less than than 120 calendar actual recovery. (3.1.1) The Responsible Entity has not 120 calendar days of each notified each person or group with a days of the recovery plan test defined role in the recovery plan(s) of update being updates within 120 calendar days of or actual recovery. completed. (3.1.1) the update being completed. (3.1.3) (3.1.3) OR OR The Responsible Entity has not The Responsible Entity has not updated the recovery plan(s) or updated the notified each person or group with a recovery plan(s) defined role within 60 and less than 90 calendar days of any of the based on any following changes that the documented lessons learned responsible entity determines would within 120 impact the ability to execute the plan: calendar days of (3.2) each recovery plan Roles or responsibilities, or test or actual recovery. (3.1.2) Responders, or OR Technology changes. The Responsible Entity has not updated the recovery plan(s) or notified each person or group with a defined role
correct the deficiencies. (2.3) CIP-009-5 R3. Each Responsible Entity shall maintain each of its recovery plans in accordance with each of the applicable requirement parts in CIP‐009‐5 Table R3 – Recovery Plan Review, Update and Communication. The Responsible Entity has not notified each person or group with a defined role in the recovery plan(s) of updates within 90 and less than 120 calendar days of the update being completed. (3.1.3) The Responsible Entity has not updated the recovery plan(s) based on any documented lessons learned within 90 and less than 120 calendar days of each recovery plan test or actual recovery. (3.1.2) OR The Responsible Entity has not notified each person or group with a defined role in the recovery plan(s) of updates within 120 calendar days of the update being completed. (3.1.3) OR The Responsible Entity has not updated the recovery plan(s) or notified each person or group with a defined role within 60 and less than 90 calendar days of any of the following changes that the responsible entity determines would impact the ability to execute the plan: (3.2) Roles or responsibilities, or Responders, or Technology changes. The Responsible Entity has neither documented lessons learned nor documented the absence of any lessons learned within 90 and less than 120 calendar days of each recovery plan test or actual recovery. (3.1.1) OR The Responsible Entity has not updated the recovery plan(s) based on any documented lessons learned within 120 calendar days of each recovery plan test or actual recovery. (3.1.2) OR The Responsible Entity has not updated the recovery plan(s) or notified each person or group with a defined role The Responsible Entity has neither documented lessons learned nor documented the absence of any lessons learned within 120 calendar days of each recovery plan test or actual recovery. (3.1.1)
VSL_Matrix_Complete_2016_01_01.docx