The Responsible Entity shall CIP-003-3 R5.2. N/A N/A N/A The Responsible Entity review at least annually the did not review at least access privileges to protected annually the access privileges to protected information to confirm that information to confirm access privileges are correct and that access privileges that they correspond with the are correct and that Responsible needs and Entity’s they correspond with appropriate personnel roles and the Responsible responsibilities. needs and Entity’s appropriate personnel roles and responsibilities. The Responsible Entity shall CIP-003-3 R5.3. N/A N/A N/A The Responsible Entity assess and document at least did not assess and annually the processes for document at least controlling access privileges to annually the processes protected information. for controlling access privileges to protected information. Change Control and CIP-003-3 R6. N/A N/A N/A The Responsible Entity Configuration Management — has not established or The Responsible Entity shall documented a change establish and document a process control process for the of change control and activities required in configuration management for R6, adding, modifying, replacing, or OR removing Critical Cyber Asset The Responsible Entity hardware or software, and has not established or implement supporting documented a configuration management configuration activities to identify, control and management process document all entity or vendor for the activities related changes to hardware and required in R6. software components of Critical Cyber Assets pursuant to the change control process.
CIP-003-3 R5.2. The Responsible Entity shall review at least annually the access privileges to protected information to confirm that access privileges are correct and that they correspond with the Responsible Entity’s needs and appropriate personnel roles and responsibilities. N/A N/A N/A The Responsible Entity did not review at least annually the access privileges to protected information to confirm that access privileges are correct and that they correspond with the Responsible Entity’s needs and appropriate personnel roles and responsibilities. CIP-003-3 R5.3. The Responsible Entity shall assess and document at least annually the processes for controlling access privileges to protected information. N/A N/A N/A The Responsible Entity did not assess and document at least annually the processes for controlling access privileges to protected information. CIP-003-3 R6. Change Control and Configuration Management — The Responsible Entity shall establish and document a process of change control and configuration management for adding, modifying, replacing, or removing Critical Cyber Asset hardware or software, and implement supporting configuration management activities to identify, control and document all entity or vendor related changes to hardware and software components of Critical Cyber Assets pursuant to the change control process. N/A N/A N/A The Responsible Entity has not established or documented a change control process for the activities required in R6, OR The Responsible Entity has not established or documented a configuration management process for the activities required in R6.
VSL_Matrix_Complete_2016_01_01.docx