must include, at a minimum, the and R6 function following: properly. OR The implemented program does not include one or more of the requirements; R8.1, R8.2, and R8.3. R8.1 Testing and maintenance of all N/A N/A N/A N/A physical security mechanisms on a cycle no longer than three years. R8.2 Retention of testing and N/A N/A N/A N/A maintenance records for the cycle determined by the Responsible Entity in Requirement R8.1. R8.3 Retention of outage records N/A N/A N/A N/A regarding access controls, logging, and monitoring for a minimum of one calendar year. Each Responsible Entity shall The Responsible Entity The Responsible Entity has a The Responsible Entity The Responsible Entity CIP-006-5 R1. implement, in a manner that has a process to log process to alert for has a process to alert for did not document or identifies, assesses, and corrects authorized physical unauthorized physical access to detected unauthorized implement operational deficiencies, one or more entry into any Physical Physical Access Control access through a physical or procedural controls documented physical security Security Perimeter with Systems and identified access point into a to restrict physical plans that collectively include all sufficient information deficiencies but did not assess Physical security access. (1.1) of the applicable requirement to identify the or correct the deficiencies. (1.7) Perimeter and identified OR parts in CIP-006-5 Table R1 individual and date and OR deficiencies but did not The Responsible Entity – Physical Security Plan. time of entry and The Responsible Entity has a assess or correct the documented and identified deficiencies process to alert for deficiencies. (1.5) implemented but did not assess or unauthorized physical access to OR operational or correct the deficiencies. Physical Access Control The Responsible Entity procedural controls to (1.8) Systems but did not identify, has a process to alert for restrict physical access OR detected unauthorized and identified
must include, at a minimum, the following: and R6 function properly. OR The implemented program does not include one or more of the requirements; R8.1, R8.2, and R8.3. R8.1 Testing and maintenance of all physical security mechanisms on a cycle no longer than three years. N/A N/A N/A N/A R8.2 Retention of testing and maintenance records for the cycle determined by the Responsible Entity in Requirement R8.1. N/A N/A N/A N/A R8.3 Retention of outage records regarding access controls, logging, and monitoring for a minimum of one calendar year. N/A N/A N/A N/A CIP-006-5 R1. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented physical security plans that collectively include all of the applicable requirement parts in CIP-006-5 Table R1 – Physical Security Plan. The Responsible Entity has a process to log authorized physical entry into any Physical Security Perimeter with sufficient information to identify the individual and date and time of entry and identified deficiencies but did not assess or correct the deficiencies. (1.8) OR The Responsible Entity has a process to alert for unauthorized physical access to Physical Access Control Systems and identified deficiencies but did not assess or correct the deficiencies. (1.7) OR The Responsible Entity has a process to alert for unauthorized physical access to Physical Access Control Systems but did not identify, The Responsible Entity has a process to alert for detected unauthorized access through a physical access point into a Physical security Perimeter and identified deficiencies but did not assess or correct the deficiencies. (1.5) OR The Responsible Entity has a process to alert for detected unauthorized The Responsible Entity did not document or implement operational or procedural controls to restrict physical access. (1.1) OR The Responsible Entity documented and implemented operational or procedural controls to restrict physical access and identified
VSL_Matrix_Complete_2016_01_27.docx