personnel who are responsible designated personnel for of designated personnel for authorizing logical or authorizing either logical who are responsible for physical access to protected or physical access but not authorizing logical or information. both. physical access to protected information. Personnel shall be identified by CIP-003-3 R5.1.1. N/A N/A The Responsible Entity Personnel are not name, title, and the information did identify the personnel identified by name, for which they are responsible for by name, title, and the title, or the information authorizing access. information for which for which they are they are responsible for responsible for authorizing access, but the authorizing access. business phone is missing. The list of personnel responsible CIP-003-3 R5.1.2. N/A N/A N/A The Responsible Entity for authorizing access to did not verify at least protected information shall be annually the list of verified at least annually. personnel responsible for authorizing access to protected information. The Responsible Entity shall CIP-003-3 R5.2. N/A N/A N/A The Responsible Entity review at least annually the did not review at least access privileges to protected annually the access privileges to protected information to confirm that information to confirm access privileges are correct and that access privileges that they correspond with the are correct and that Responsible needs and Entity’s they correspond with appropriate personnel roles and the Responsible responsibilities. needs and Entity’s appropriate personnel roles and responsibilities. The Responsible Entity shall CIP-003-3 R5.3. N/A N/A N/A The Responsible Entity assess and document at least did not assess and annually the processes for document at least controlling access privileges to annually the processes protected information. for controlling access
personnel who are responsible for authorizing logical or physical access to protected information. designated personnel for authorizing either logical or physical access but not both. of designated personnel who are responsible for authorizing logical or physical access to protected information. CIP-003-3 R5.1.1. Personnel shall be identified by name, title, and the information for which they are responsible for authorizing access. N/A N/A The Responsible Entity did identify the personnel by name, title, and the information for which they are responsible for authorizing access, but the business phone is missing. Personnel are not identified by name, title, or the information for which they are responsible for authorizing access. CIP-003-3 R5.1.2. The list of personnel responsible for authorizing access to protected information shall be verified at least annually. N/A N/A N/A The Responsible Entity did not verify at least annually the list of personnel responsible for authorizing access to protected information. CIP-003-3 R5.2. The Responsible Entity shall review at least annually the access privileges to protected information to confirm that access privileges are correct and that they correspond with the Responsible Entity’s needs and appropriate personnel roles and responsibilities. N/A N/A N/A The Responsible Entity did not review at least annually the access privileges to protected information to confirm that access privileges are correct and that they correspond with the Responsible Entity’s needs and appropriate personnel roles and responsibilities. CIP-003-3 R5.3. The Responsible Entity shall assess and document at least annually the processes for controlling access privileges to protected information. N/A N/A N/A The Responsible Entity did not assess and document at least annually the processes for controlling access
VSL_Matrix_Complete_2016_01_27.docx