security plan(s) as following completion of the 6.3 but did so more than OR specified in Part 6.3 but third party review. 80 calendar days The Responsible did so more than 60 following completion of Entity had an calendar days and less the third party review; unaffiliated third party than or equal to 70 OR review the evaluation calendar days following performed under completion of the third The Responsible Entity Requirement R4 and party review. had an unaffiliated third the security plan(s) party review the developed under evaluation performed Requirement R5 but under Requirement R4 failed to implement and the security plan(s) procedures for developed under protecting information Requirement R5 but did per Part 6.4. not document the reason for not modifying the security plan(s) as specified in Part 6.3.
security plan(s) as specified in Part 6.3 but did so more than 60 calendar days and less than or equal to 70 calendar days following completion of the third party review. following completion of the third party review. 6.3 but did so more than 80 calendar days following completion of the third party review; OR The Responsible Entity had an unaffiliated third party review the evaluation performed under Requirement R4 and the security plan(s) developed under Requirement R5 but did not document the reason for not modifying the security plan(s) as specified in Part 6.3. OR The Responsible Entity had an unaffiliated third party review the evaluation performed under Requirement R4 and the security plan(s) developed under Requirement R5 but failed to implement procedures for protecting information per Part 6.4.
VSL_Matrix_Complete_2016_01_27.docx