[See Table R5 of the standard.] but did not technically changes or an obligation to of all known enabled items in CIP-007-6 or procedurally enforce change the password within 16 default or other generic Table R5. (R5) password changes or an calendar months but less than account types, either by OR obligation to change the or equal to 17 calendar months system, by groups of password within 15 of the last password change. systems, by location, or The Responsible Entity calendar months but (5.6) by system type(s). (5.2) has implemented one less than or equal to 16 or more documented OR calendar months of the process(es) for System last password change. The Responsible Entity Access Controls but, (5.6) has implemented one or where technically more documented feasible, does not have process(es) for System a method(s) to enforce Access Controls but, did authentication of not include the interactive user access. identification of the (5.1) individuals with OR authorized access to shared accounts. (5.3) The Responsible Entity has implemented one OR or more documented The Responsible Entity process(es) for System has implemented one or Access Controls but, more documented where technically process(es) for feasible, does not have authentication for a method(s) to enforce interactive user access authentication of that did not technically or interactive user access. procedurally enforce one (5.1) of the two password OR parameters as described in 5.5.1 and 5.5.2. (5.5) The Responsible Entity has implemented one OR or more documented The Responsible Entity process(es) for System has implemented one or Access Controls but more documented did not, per device process(es) for capability, change only authentication for interactive user access
[See Table R5 of the standard.] but did not technically or procedurally enforce password changes or an obligation to change the password within 15 calendar months but less than or equal to 16 calendar months of the last password change. (5.6) changes or an obligation to change the password within 16 calendar months but less than or equal to 17 calendar months of the last password change. (5.6) of all known enabled default or other generic account types, either by system, by groups of systems, by location, or by system type(s). (5.2) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but, did not include the identification of the individuals with authorized access to shared accounts. (5.3) OR The Responsible Entity has implemented one or more documented process(es) for authentication for interactive user access that did not technically or procedurally enforce one of the two password parameters as described in 5.5.1 and 5.5.2. (5.5) OR The Responsible Entity has implemented one or more documented process(es) for authentication for interactive user access items in CIP-007-6 Table R5. (R5) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but, where technically feasible, does not have a method(s) to enforce authentication of interactive user access. (5.1) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but, where technically feasible, does not have a method(s) to enforce authentication of interactive user access. (5.1) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but did not, per device capability, change only
VSL_Matrix_Complete_2016_01_27.docx