unauthorized accesses at least every ninety calendar days. Cyber Vulnerability Assessment R4. N/A N/A N/A The Responsible Entity The Responsible Entity shall — did not perform a perform a cyber vulnerability Vulnerability assessment of the electronic Assessment at least access points to the Electronic annually for one or Security Perimeter(s) at least more of the access annually. The vulnerability points to the Electronic assessment shall include, at a Security Perimeter(s). minimum, the following: OR The vulnerability assessment did not include one (1) or more of the subrequirements R4.1, R4.2, R4.3, R4.4, R4.5. R4.1. A document identifying the N/A N/A N/A N/A vulnerability assessment process; A review to verify that only ports R4.2. N/A N/A N/A N/A and services required for operations at these access points are enabled; R4.3. The discovery of all access points N/A N/A N/A N/A to the Electronic Security Perimeter; A review of controls for default R4.4. N/A N/A N/A N/A accounts, passwords, and network management community strings; Documentation of the results of R4.5. N/A N/A N/A N/A the assessment, the action plan to remediate or mitigate vulnerabilities identified in the
unauthorized accesses at least every ninety calendar days. R4. Cyber Vulnerability Assessment — The Responsible Entity shall perform a cyber vulnerability assessment of the electronic access points to the Electronic Security Perimeter(s) at least annually. The vulnerability assessment shall include, at a minimum, the following: N/A N/A N/A The Responsible Entity did not perform a Vulnerability Assessment at least annually for one or more of the access points to the Electronic Security Perimeter(s). OR The vulnerability assessment did not include one (1) or more of the subrequirements R4.1, R4.2, R4.3, R4.4, R4.5. R4.1. A document identifying the vulnerability assessment process; N/A N/A N/A N/A R4.2. A review to verify that only ports and services required for operations at these access points are enabled; N/A N/A N/A N/A R4.3. The discovery of all access points to the Electronic Security Perimeter; N/A N/A N/A N/A R4.4. A review of controls for default accounts, passwords, and network management community strings; N/A N/A N/A N/A R4.5. Documentation of the results of the assessment, the action plan to remediate or mitigate vulnerabilities identified in the N/A N/A N/A N/A
VSL_Matrix_Complete_2016_01_01.docx