one individual more but less than but less than 5% 15%of the of the authorized authorized personnel. personnel. The Responsible Entity shall R4.1. N/A The Responsible Entity did not The Responsible The Responsible Entity review the list(s) of its personnel review the list(s) of its personnel who Entity did not did not review the who have such access to Critical have access to Critical Cyber Assets update the list(s) list(s) of all personnel Cyber Assets quarterly, and quarterly. within seven who have access to update the list(s) within seven calendar days of Critical Cyber Assets calendar days of any change of any change of quarterly, nor update personnel with such access to personnel with the list(s) within seven Critical Cyber Assets, or any such access to calendar days of any change in the access rights of Critical Cyber change of personnel such personnel. The Responsible Assets, nor any with such access to Entity shall ensure access list(s) change in the Critical Cyber Assets, for contractors and service access rights of nor any change in the vendors are properly maintained. such personnel. access rights of such personnel. The Responsible Entity shall R4.2. N/A The Responsible Entity did not The Responsible The Responsible Entity revoke such access to Critical revoke access within seven calendar Entity did not did not revoke access Cyber Assets within 24 hours for days for personnel who no longer revoke access to to Critical Cyber personnel terminated for cause require such access to Critical Cyber Critical Cyber Assets within 24 hours and within seven calendar days Assets. Assets within 24 for personnel for personnel who no longer hours for terminated for cause require such access to Critical personnel nor within seven Cyber Assets. terminated for calendar days for cause. personnel who no longer require such access to Critical Cyber Assets. R1. Each Responsible Entity shall The Responsible The Responsible Entity did not The Responsible The Responsible Entity implement one or more Entity did not reinforce cyber security practices Entity did not did not document or documented processes that reinforce cyber during a calendar quarter but did so reinforce cyber implement any security collectively include each of the security practices between 10 and 30 calendar days security practices awareness process(es) applicable requirement parts in during a calendar after the start of a subsequent during a calendar to reinforce cyber CIP-004-5.1 Table R1 Security – quarter but did so calendar quarter. (1.1) quarter but did so security practices. (R1) Awareness Program. less than 10 within the OR
one individual but less than 5% of the authorized personnel. more but less than 15%of the authorized personnel. R4.1. The Responsible Entity shall review the list(s) of its personnel who have such access to Critical Cyber Assets quarterly, and update the list(s) within seven calendar days of any change of personnel with such access to Critical Cyber Assets, or any change in the access rights of such personnel. The Responsible Entity shall ensure access list(s) for contractors and service vendors are properly maintained. N/A The Responsible Entity did not review the list(s) of its personnel who have access to Critical Cyber Assets quarterly. The Responsible Entity did not update the list(s) within seven calendar days of any change of personnel with such access to Critical Cyber Assets, nor any change in the access rights of such personnel. The Responsible Entity did not review the list(s) of all personnel who have access to Critical Cyber Assets quarterly, nor update the list(s) within seven calendar days of any change of personnel with such access to Critical Cyber Assets, nor any change in the access rights of such personnel. R4.2. The Responsible Entity shall revoke such access to Critical Cyber Assets within 24 hours for personnel terminated for cause and within seven calendar days for personnel who no longer require such access to Critical Cyber Assets. N/A The Responsible Entity did not revoke access within seven calendar days for personnel who no longer require such access to Critical Cyber Assets. The Responsible Entity did not revoke access to Critical Cyber Assets within 24 hours for personnel terminated for cause. The Responsible Entity did not revoke access to Critical Cyber Assets within 24 hours for personnel terminated for cause nor within seven calendar days for personnel who no longer require such access to Critical Cyber Assets. R1. Each Responsible Entity shall implement one or more documented processes that collectively include each of the applicable requirement parts in CIP-004-5.1 Table R1 – Security Awareness Program. The Responsible Entity did not reinforce cyber security practices during a calendar quarter but did so less than 10 The Responsible Entity did not reinforce cyber security practices during a calendar quarter but did so between 10 and 30 calendar days after the start of a subsequent calendar quarter. (1.1) The Responsible Entity did not reinforce cyber security practices during a calendar quarter but did so within the The Responsible Entity did not document or implement any security awareness process(es) to reinforce cyber security practices. (R1) OR
VSL_Matrix_Complete_2016_01_01.docx