Incident response plans Systems, but failed to Attachment 1, Section 4. within its cyber security document the determination of (R2) plan(s) for its assets whether an identified Cyber OR containing low impact Security Incident is a BES Cyber Systems, Reportable Cyber Security The Responsible Entity but failed to update Incident and subsequent documented and each Cyber Security notification to the Electricity implemented electronic Incident response Sector Information Sharing and access controls for LERC, plan(s) within 180 days Analysis Center (ES-ISAC) but failed to implement a according to CIP-003-6, according to CIP-003-6, LEAP or permit inbound Requirement R2, Requirement R2, Attachment 1, and outbound access Attachment 1, Section Section 4. according to CIP-003-6, 4. (R2) Requirement R2, OR Attachment 1, Section 3. The Responsible Entity (R2) documented its cyber security OR plan(s) for its assets containing low impact BES Cyber The Responsible Entity Systems, but failed to documented and document physical security implemented electronic controls according to access controls for its Requirement R2, Attachment assets containing low 1, Section 2. (R2) impact BES Cyber Systems, but failed to OR document and implement The Responsible Entity authentication of all documented its cyber security Connectivity, if any, plan(s) for its assets containing that provides access to low impact BES Cyber low impact BES Cyber Systems, but failed to Systems according to document electronic access CIP-003-6, Requirement controls according to R2, Attachment 1, Section Requirement R2, Attachment 3. (R2) 1, Section 3. (R2) OR The Responsible Entity documented the physical access controls for its assets containing low
Incident response plans within its cyber security plan(s) for its assets containing low impact BES Cyber Systems, but failed to update each Cyber Security Incident response plan(s) within 180 days according to CIP-003-6, Requirement R2, Attachment 1, Section 4. (R2) Systems, but failed to document the determination of whether an identified Cyber Security Incident is a Reportable Cyber Security Incident and subsequent notification to the Electricity Sector Information Sharing and Analysis Center (ES-ISAC) according to CIP-003-6, Requirement R2, Attachment 1, Section 4. OR The Responsible Entity documented its cyber security plan(s) for its assets containing low impact BES Cyber Systems, but failed to document physical security controls according to Requirement R2, Attachment 1, Section 2. (R2) OR The Responsible Entity documented its cyber security plan(s) for its assets containing low impact BES Cyber Systems, but failed to document electronic access controls according to Requirement R2, Attachment 1, Section 3. (R2) Attachment 1, Section 4. (R2) OR The Responsible Entity documented and implemented electronic access controls for LERC, but failed to implement a LEAP or permit inbound and outbound access according to CIP-003-6, Requirement R2, Attachment 1, Section 3. (R2) OR The Responsible Entity documented and implemented electronic access controls for its assets containing low impact BES Cyber Systems, but failed to document and implement authentication of all Connectivity, if any, that provides access to low impact BES Cyber Systems according to CIP-003-6, Requirement R2, Attachment 1, Section 3. (R2) OR The Responsible Entity documented the physical access controls for its assets containing low
VSL_Matrix_Complete_2016_01_27.docx