Incident response plans to Security Incident not exceeding 17 calendar months Security Incident response plan(s) within collectively include each of the response plan(s) between tests of the plan. (2.1) response plan(s) 18 calendar months applicable requirement parts in within 15 within 17 calendar between tests of the calendar months, months, not plan. (2.1) CIP‐008‐5 Table R2 Cyber – not exceeding 16 exceeding 18 OR Security Incident Response Plan calendar months calendar months The Responsible Entity Implementation and Testing. between tests of between tests of did not retain relevant the plan. (2.1) the plan. (2.1) records related to OR Reportable Cyber The Responsible Security Incidents. Entity did not (2.3) document deviations, if any, from the plan during a test or when a Reportable Cyber Security Incident occurs. (2.2) Each Responsible Entity shall The Responsible The Responsible Entity has not The Responsible The Responsible Entity CIP-008-5 R3. maintain each of its Cyber Entity has not updated the Cyber Security Incident Entity has neither has neither documented Security Incident response plans notified each response plan on any documented lessons learned nor according to each of the person or group documented lessons learned within lessons learned nor documented the applicable requirement parts in with a defined 90 and less than 120 calendar days of documented the absence of any lessons role in the Cyber a test or actual incident response to a absence of any learned within 120 CIP‐008‐5 Table R3 Cyber – Security Incident Reportable Cyber Security Incident. lessons learned calendar days of a test Security Incident Response Plan response plan of (3.1.2) within 90 and less or actual incident Review, Update, and updates to the OR than 120 calendar response to a Communication. Cyber Security The Responsible Entity has not days of a test or Reportable Cyber Incident response notified each person or group with a actual incident Security Incident. plan within defined role in the Cyber Security response to a (3.1.1) greater than 90 Incident response plan of updates to Reportable Cyber but less than 120 the Cyber Security Incident response Security Incident. calendar days of plan within 120 calendar days of a (3.1.1) a test or actual test or actual incident response to a OR incident response Reportable Cyber Security Incident. The Responsible to a Reportable (3.1.3) Entity has not Cyber Security OR updated the Cyber Incident. (3.1.3) Security Incident
Incident response plans to collectively include each of the applicable requirement parts in CIP‐008‐5 Table R2 – Cyber Security Incident Response Plan Implementation and Testing. Security Incident response plan(s) within 15 calendar months, not exceeding 16 calendar months between tests of the plan. (2.1) not exceeding 17 calendar months between tests of the plan. (2.1) Security Incident response plan(s) within 17 calendar months, not exceeding 18 calendar months between tests of the plan. (2.1) OR The Responsible Entity did not document deviations, if any, from the plan during a test or when a Reportable Cyber Security Incident occurs. (2.2) response plan(s) within 18 calendar months between tests of the plan. (2.1) OR The Responsible Entity did not retain relevant records related to Reportable Cyber Security Incidents. (2.3) CIP-008-5 R3. Each Responsible Entity shall maintain each of its Cyber Security Incident response plans according to each of the applicable requirement parts in CIP‐008‐5 Table R3 – Cyber Security Incident Response Plan Review, Update, and Communication. The Responsible Entity has not notified each person or group with a defined role in the Cyber Security Incident response plan of updates to the Cyber Security Incident response plan within greater than 90 but less than 120 calendar days of a test or actual incident response to a Reportable Cyber Security Incident. (3.1.3) The Responsible Entity has not updated the Cyber Security Incident response plan on any documented lessons learned within 90 and less than 120 calendar days of a test or actual incident response to a Reportable Cyber Security Incident. (3.1.2) OR The Responsible Entity has not notified each person or group with a defined role in the Cyber Security Incident response plan of updates to the Cyber Security Incident response plan within 120 calendar days of a test or actual incident response to a Reportable Cyber Security Incident. (3.1.3) OR The Responsible Entity has neither documented lessons learned nor documented the absence of any lessons learned within 90 and less than 120 calendar days of a test or actual incident response to a Reportable Cyber Security Incident. (3.1.1) OR The Responsible Entity has not updated the Cyber Security Incident The Responsible Entity has neither documented lessons learned nor documented the absence of any lessons learned within 120 calendar days of a test or actual incident response to a Reportable Cyber Security Incident. (3.1.1)
VSL_Matrix_Complete_2016_01_01.docx