deficiencies were according to R2 Part 2.2 within 16 identified, deficiencies, but did identified, calendar months, not exceeding 17 assessed, and not assess or correct the assessed, and calendar months between tests, and corrected. (2.1) deficiencies. (2.1) corrected. (2.1) when tested, any deficiencies were OR OR identified, assessed, and corrected. OR (2.2) The Responsible The Responsible Entity The Responsible Entity has not has tested the recovery OR Entity has not tested a plan(s) according to R2 tested a The Responsible Entity has not tested representative Part 2.1 but did not representative the recovery plan according to R2 sample of the identify, assess, or sample of the Part 2.3 within 37 calendar months, information used correct the deficiencies. information used not exceeding 38 calendar months in the recovery of (2.1) in the recovery between tests, and when tested, any BES Cyber OR of BES Cyber deficiencies were identified, assessed, System System and corrected. (2.3) functionality The Responsible Entity functionality according to R2 has not tested a according to R2 Part 2.2 within 17 representative sample Part 2.2 within calendar months, of the information used 15 calendar not exceeding 18 in the recovery of BES months, not calendar months Cyber System exceeding 16 between tests, and functionality according calendar months when tested, any to R2 Part 2.2 within between tests, deficiencies were 18 calendar months and when tested, identified, between tests. (2.2) any deficiencies assessed, and OR were identified, corrected. (2.2) assessed, and The Responsible Entity OR corrected. (2.2) has tested a The Responsible representative sample OR Entity has not of the information used The Responsible tested the recovery in the recovery of BES Entity has not plan according to Cyber System tested the R2 Part 2.3 within functionality according recovery plan 38 calendar to R2 Part 2.2 and according to R2 months, not identified deficiencies, Part 2.3 within exceeding 39 but did not assess or 36 calendar calendar months correct the deficiencies. months, not between tests, and (2.2) exceeding 37 when tested, any
deficiencies were identified, assessed, and corrected. (2.1) OR The Responsible Entity has not tested a representative sample of the information used in the recovery of BES Cyber System functionality according to R2 Part 2.2 within 15 calendar months, not exceeding 16 calendar months between tests, and when tested, any deficiencies were identified, assessed, and corrected. (2.2) OR The Responsible Entity has not tested the recovery plan according to R2 Part 2.3 within 36 calendar months, not exceeding 37 according to R2 Part 2.2 within 16 calendar months, not exceeding 17 calendar months between tests, and when tested, any deficiencies were identified, assessed, and corrected. (2.2) OR The Responsible Entity has not tested the recovery plan according to R2 Part 2.3 within 37 calendar months, not exceeding 38 calendar months between tests, and when tested, any deficiencies were identified, assessed, and corrected. (2.3) identified, assessed, and corrected. (2.1) OR The Responsible Entity has not tested a representative sample of the information used in the recovery of BES Cyber System functionality according to R2 Part 2.2 within 17 calendar months, not exceeding 18 calendar months between tests, and when tested, any deficiencies were identified, assessed, and corrected. (2.2) OR The Responsible Entity has not tested the recovery plan according to R2 Part 2.3 within 38 calendar months, not exceeding 39 calendar months between tests, and when tested, any deficiencies, but did not assess or correct the deficiencies. (2.1) OR The Responsible Entity has tested the recovery plan(s) according to R2 Part 2.1 but did not identify, assess, or correct the deficiencies. (2.1) OR The Responsible Entity has not tested a representative sample of the information used in the recovery of BES Cyber System functionality according to R2 Part 2.2 within 18 calendar months between tests. (2.2) OR The Responsible Entity has tested a representative sample of the information used in the recovery of BES Cyber System functionality according to R2 Part 2.2 and identified deficiencies, but did not assess or correct the deficiencies. (2.2)
VSL_Matrix_Complete_2016_01_01.docx