deficiencies. incorrect or unnecessary, and did not and did not identify, The Responsible (4.2) identify, assess, and correct the assess, and correct the Entity has deficiencies. (4.3) deficiencies. (4.1) implemented OR OR processes to verify OR The Responsible that user accounts, The Responsible Entity Entity has The Responsible Entity has user account did not verify that implemented implemented processes to verify that groups, or user individuals with active processes to access to the designated storage role categories, electronic or active verify that user locations for BES Cyber System and their specific, unescorted physical accounts, user Information is correct and necessary associated access have account groups, within 15 calendar months of the privileges are authorization records or user role previous verification but for more correct and for at least two categories, and than 5% but less than (or equal to) necessary within consecutive calendar their specific, 10% of its BES Cyber System 15 calendar quarters, and did not associated Information storage locations, months of the identify, assess, and privileges are privileges were incorrect or previous correct the deficiencies. correct and unnecessary, and did not identify, verification but for (4.2) necessary within assess, and correct the deficiencies. more than 10% but 15 calendar (4.4) less than (or equal OR months of the to) 15% of its BES The Responsible Entity previous Cyber Systems, has implemented verification but privileges were processes to verify that for 5% or less of incorrect or user accounts, user its BES Cyber unnecessary, and account groups, or user Systems, did not identify, role categories, and privileges were assess, and correct their specific, incorrect or the deficiencies. associated privileges unnecessary, and (4.3) are correct and did not identify, necessary within 15 assess and OR calendar months of the correct the The Responsible previous verification deficiencies. Entity has but for more than 15% (4.3) implemented of its BES Cyber OR processes to verify Systems, privileges The Responsible that access to the were incorrect or Entity has designated storage unnecessary, and did implemented locations for BES not identify, assess, and processes to Cyber System
deficiencies. (4.2) OR The Responsible Entity has implemented processes to verify that user accounts, user account groups, or user role categories, and their specific, associated privileges are correct and necessary within 15 calendar months of the previous verification but for 5% or less of its BES Cyber Systems, privileges were incorrect or unnecessary, and did not identify, assess and correct the deficiencies. (4.3) OR The Responsible Entity has implemented processes to incorrect or unnecessary, and did not identify, assess, and correct the deficiencies. (4.3) OR The Responsible Entity has implemented processes to verify that access to the designated storage locations for BES Cyber System Information is correct and necessary within 15 calendar months of the previous verification but for more than 5% but less than (or equal to) 10% of its BES Cyber System Information storage locations, privileges were incorrect or unnecessary, and did not identify, assess, and correct the deficiencies. (4.4) The Responsible Entity has implemented processes to verify that user accounts, user account groups, or user role categories, and their specific, associated privileges are correct and necessary within 15 calendar months of the previous verification but for more than 10% but less than (or equal to) 15% of its BES Cyber Systems, privileges were incorrect or unnecessary, and did not identify, assess, and correct the deficiencies. (4.3) OR The Responsible Entity has implemented processes to verify that access to the designated storage locations for BES Cyber System and did not identify, assess, and correct the deficiencies. (4.1) OR The Responsible Entity did not verify that individuals with active electronic or active unescorted physical access have authorization records for at least two consecutive calendar quarters, and did not identify, assess, and correct the deficiencies. (4.2) OR The Responsible Entity has implemented processes to verify that user accounts, user account groups, or user role categories, and their specific, associated privileges are correct and necessary within 15 calendar months of the previous verification but for more than 15% of its BES Cyber Systems, privileges were incorrect or unnecessary, and did not identify, assess, and
VSL_Matrix_Complete_2016_01_01.docx