calendar months of the for more than 10% but The Responsible Entity previous verification OR less than (or equal to) did not verify that but for 5% or less of its 15% of its BES Cyber The Responsible Entity has individuals with active BES Cyber Systems, Systems, privileges were implemented processes to electronic or active privileges were incorrect or unnecessary. verify that access to the unescorted physical incorrect or (4.3) designated storage locations for access have unnecessary. (4.3) BES Cyber System Information authorization records OR OR is correct and necessary within for at least two The Responsible Entity 15 calendar months of the The Responsible Entity consecutive calendar has implemented previous verification but for has implemented quarters. (4.2) processes to verify that more than 5% but less than (or processes to verify that access to the designated equal to) 10% of its BES Cyber access to the designated OR storage locations for System Information storage storage locations for BES The Responsible Entity BES Cyber System locations, privileges were Cyber System has implemented Information is correct incorrect or unnecessary. (4.4) Information is correct and processes to verify that and necessary within 15 necessary within 15 user accounts, user calendar months of the calendar months of the account groups, or user previous verification previous verification but role categories, and but for 5% or less of its for more than 10% but their specific, BES Cyber System less than (or equal to) associated privileges Information storage 15% of its BES Cyber are correct and locations, privileges System Information necessary within 15 were incorrect or storage locations, calendar months of the unnecessary. (4.4) privileges were incorrect previous verification or unnecessary. (4.4) but for more than 15% of its BES Cyber Systems, privileges were incorrect or unnecessary. (4.3) OR The Responsible Entity has implemented processes to verify that access to the designated storage locations for BES Cyber System
calendar months of the previous verification but for 5% or less of its BES Cyber Systems, privileges were incorrect or unnecessary. (4.3) OR The Responsible Entity has implemented processes to verify that access to the designated storage locations for BES Cyber System Information is correct and necessary within 15 calendar months of the previous verification but for 5% or less of its BES Cyber System Information storage locations, privileges were incorrect or unnecessary. (4.4) OR The Responsible Entity has implemented processes to verify that access to the designated storage locations for BES Cyber System Information is correct and necessary within 15 calendar months of the previous verification but for more than 5% but less than (or equal to) 10% of its BES Cyber System Information storage locations, privileges were incorrect or unnecessary. (4.4) for more than 10% but less than (or equal to) 15% of its BES Cyber Systems, privileges were incorrect or unnecessary. (4.3) OR The Responsible Entity has implemented processes to verify that access to the designated storage locations for BES Cyber System Information is correct and necessary within 15 calendar months of the previous verification but for more than 10% but less than (or equal to) 15% of its BES Cyber System Information storage locations, privileges were incorrect or unnecessary. (4.4) The Responsible Entity did not verify that individuals with active electronic or active unescorted physical access have authorization records for at least two consecutive calendar quarters. (4.2) OR The Responsible Entity has implemented processes to verify that user accounts, user account groups, or user role categories, and their specific, associated privileges are correct and necessary within 15 calendar months of the previous verification but for more than 15% of its BES Cyber Systems, privileges were incorrect or unnecessary. (4.3) OR The Responsible Entity has implemented processes to verify that access to the designated storage locations for BES Cyber System
VSL_Matrix_Complete_2016_01_27.docx