more than 5% but less than (or The Responsible Entity The Responsible Entity equal to) 10% of its BES Cyber OR has implemented has implemented System Information storage processes to verify that processes to verify that The Responsible Entity locations, privileges were access to the designated access to the designated has implemented incorrect or unnecessary, and storage locations for storage locations for BES processes to verify that did not identify, assess, and BES Cyber System Cyber System user accounts, user correct the deficiencies. (4.4) Information is correct Information is correct and account groups, or user and necessary within 15 necessary within 15 role categories, and calendar months of the calendar months of the their specific, previous verification previous verification but associated privileges but for 5% or less of its for more than 10% but are correct and BES Cyber System less than (or equal to) necessary within 15 Information storage 15% of its BES Cyber calendar months of the locations, privileges System Information previous verification were incorrect or storage locations, but for more than 15% unnecessary, and did privileges were incorrect of its BES Cyber not identify, assess and or unnecessary, and did Systems, privileges correct the deficiencies. not identify, assess, and were incorrect or (4.4) correct the deficiencies. unnecessary, and did (4.4) not identify, assess, and correct the deficiencies. (4.3) OR The Responsible Entity has implemented processes to verify that access to the designated storage locations for BES Cyber System Information is correct and necessary within 15 calendar months of the previous verification but for more than 15% of its BES Cyber System
The Responsible Entity has implemented processes to verify that access to the designated storage locations for BES Cyber System Information is correct and necessary within 15 calendar months of the previous verification but for 5% or less of its BES Cyber System Information storage locations, privileges were incorrect or unnecessary, and did not identify, assess and correct the deficiencies. (4.4) more than 5% but less than (or equal to) 10% of its BES Cyber System Information storage locations, privileges were incorrect or unnecessary, and did not identify, assess, and correct the deficiencies. (4.4) The Responsible Entity has implemented processes to verify that access to the designated storage locations for BES Cyber System Information is correct and necessary within 15 calendar months of the previous verification but for more than 10% but less than (or equal to) 15% of its BES Cyber System Information storage locations, privileges were incorrect or unnecessary, and did not identify, assess, and correct the deficiencies. (4.4) OR The Responsible Entity has implemented processes to verify that user accounts, user account groups, or user role categories, and their specific, associated privileges are correct and necessary within 15 calendar months of the previous verification but for more than 15% of its BES Cyber Systems, privileges were incorrect or unnecessary, and did not identify, assess, and correct the deficiencies. (4.3) OR The Responsible Entity has implemented processes to verify that access to the designated storage locations for BES Cyber System Information is correct and necessary within 15 calendar months of the previous verification but for more than 15% of its BES Cyber System
VSL_Matrix_Complete_2016_01_27.docx