Assessments and did not (PRAs) for one identify, assess, individual with and correct the authorized deficiencies. (3.5) electronic or authorized unescorted physical access within 7 calendar years of the previous PRA completion date, and did not identify, assess, and correct the deficiencies. (3.5) R4. The Responsible The Responsible Entity did not verify The Responsible The Responsible Entity Each Responsible Entity shall Entity did not that individuals with active electronic Entity did not did not implement any 5.1 implement, in a manner that verify that or active unescorted physical access verify that documented identifies, assesses, and corrects individuals with have authorization records during a individuals with program(s) for access deficiencies, one or more active electronic calendar quarter but did so between active electronic or management. (R4) documented access management or active 10 and 20 calendar days after the start active unescorted programs that collectively unescorted of a subsequent calendar quarter, and physical access OR include each of the applicable physical access did not identify, assess, and correct have authorization requirement parts in CIP-004-5.1 The Responsible Entity have the deficiencies. (4.2) records during a Table R4 Access Management – has implemented one authorization calendar quarter Program. or more documented records during a OR but did so between program(s) for access calendar quarter 20 and 30 calendar The Responsible Entity has management that but did so less days after the start implemented processes to verify that includes a process to than 10 calendar of a subsequent user accounts, user account groups, authorize electronic days after the calendar quarter, or user role categories, and their access, unescorted start of a and did not specific, associated privileges are physical access, or subsequent identify, assess, correct and necessary within 15 access to the calendar quarter, and correct the calendar months of the previous designated storage and did not deficiencies. (4.2) verification but for more than 5% but locations where BES identify, assess less than (or equal to) 10% of its BES Cyber System and correct the OR Cyber Systems, privileges were Information is located,
Assessments (PRAs) for one individual with authorized electronic or authorized unescorted physical access within 7 calendar years of the previous PRA completion date, and did not identify, assess, and correct the deficiencies. (3.5) and did not identify, assess, and correct the deficiencies. (3.5) R4. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented access management programs that collectively include each of the applicable requirement parts in CIP-004-5.1 Table R4 – Access Management Program. The Responsible Entity did not verify that individuals with active electronic or active unescorted physical access have authorization records during a calendar quarter but did so less than 10 calendar days after the start of a subsequent calendar quarter, and did not identify, assess and correct the The Responsible Entity did not verify that individuals with active electronic or active unescorted physical access have authorization records during a calendar quarter but did so between 10 and 20 calendar days after the start of a subsequent calendar quarter, and did not identify, assess, and correct the deficiencies. (4.2) OR The Responsible Entity has implemented processes to verify that user accounts, user account groups, or user role categories, and their specific, associated privileges are correct and necessary within 15 calendar months of the previous verification but for more than 5% but less than (or equal to) 10% of its BES Cyber Systems, privileges were The Responsible Entity did not verify that individuals with active electronic or active unescorted physical access have authorization records during a calendar quarter but did so between 20 and 30 calendar days after the start of a subsequent calendar quarter, and did not identify, assess, and correct the deficiencies. (4.2) OR The Responsible Entity did not implement any documented program(s) for access management. (R4) OR The Responsible Entity has implemented one or more documented program(s) for access management that includes a process to authorize electronic access, unescorted physical access, or access to the designated storage locations where BES Cyber System Information is located, 5.1
VSL_Matrix_Complete_2016_01_01.docx