authentication when establishing dial-up connectivity with the applicable Cyber Assets, where technically feasible. (1.4) R2. Each Responsible Entity The Responsible Entity The Responsible Entity did not The Responsible Entity The Responsible Entity CIP-005-5 allowing Interactive Remote does not have implement processes for one of did not implement did not implement Access to BES Cyber Systems documented processes the applicable items for processes for two of the processes for three of shall implement one or more for one or more of the Requirement Parts 2.1 through applicable items for the applicable items for documented processes that applicable items for 2.3. Requirement Parts 2.1 Requirement Parts 2.1 collectively include the Requirement Parts 2.1 through 2.3. through 2.3. applicable requirement parts, through 2.3. where technically feasible, in CIP-005-5 Table R2 Interactive – Remote Access Management. R1. Physical Security Plan The N/A N/A The Responsible Entity The Responsible Entity — Responsible Entity shall created a physical security did not document, document, implement, and plan but did not gain implement, and maintain a physical security plan, approval by a senior maintain a physical approved by the senior manager manager or delegate(s). security plan. or delegate(s) that shall address, at a minimum, the following: OR The Responsible Entity created and implemented but did not maintain a physical security plan. R1.1. All Cyber Assets within an N/A N/A N/A The Responsible Electronic Security Perimeter Entity's physical shall reside within an identified security plan does not Physical Security Perimeter. include processes to Where a completely enclosed ensure and document cannot be that all Cyber Assets (“six-wall”) border established, the Responsible within an Electronic Entity shall deploy and document Security Perimeter also alternative measures to control reside within an
authentication when establishing dial-up connectivity with the applicable Cyber Assets, where technically feasible. (1.4) CIP-005-5 R2. Each Responsible Entity allowing Interactive Remote Access to BES Cyber Systems shall implement one or more documented processes that collectively include the applicable requirement parts, where technically feasible, in CIP-005-5 Table R2 – Interactive Remote Access Management. The Responsible Entity does not have documented processes for one or more of the applicable items for Requirement Parts 2.1 through 2.3. The Responsible Entity did not implement processes for one of the applicable items for Requirement Parts 2.1 through 2.3. The Responsible Entity did not implement processes for two of the applicable items for Requirement Parts 2.1 through 2.3. The Responsible Entity did not implement processes for three of the applicable items for Requirement Parts 2.1 through 2.3. R1. Physical Security Plan — The Responsible Entity shall document, implement, and maintain a physical security plan, approved by the senior manager or delegate(s) that shall address, at a minimum, the following: N/A N/A The Responsible Entity created a physical security plan but did not gain approval by a senior manager or delegate(s). OR The Responsible Entity created and implemented but did not maintain a physical security plan. The Responsible Entity did not document, implement, and maintain a physical security plan. R1.1. All Cyber Assets within an Electronic Security Perimeter shall reside within an identified Physical Security Perimeter. Where a completely enclosed (“six-wall”) border cannot be established, the Responsible Entity shall deploy and document alternative measures to control N/A N/A N/A The Responsible Entity's physical security plan does not include processes to ensure and document that all Cyber Assets within an Electronic Security Perimeter also reside within an
VSL_Matrix_Complete_2016_01_27.docx