OR OR The Responsible Entity The Responsible Entity has a process(es) to verify has a process(es) to that required security determine required controls in CIP-005 and security controls in CIP-007 are not adversely CIP-005 and CIP-007 affected by a change(s) that could be impacted that deviates from the by a change(s) that existing baseline deviates from the configuration and existing baseline identified deficiencies in configuration but did required controls, but did not verify and not assess, or correct the document that the deficiencies. (1.4.2) required controls were not adversely affected OR following the change. (1.4.2 & 1.4.3) The Responsible Entity has a process(es) to verify OR that required security controls in CIP-005 and The Responsible Entity CIP-007 are not adversely does not have a process affected by a change(s) for testing changes in that deviates from the an environment that existing baseline models the baseline configuration but did not configuration prior to identify, assess, or correct implementing a change the deficiencies in the that deviates from required controls. (1.4.2) baseline configuration. (1.5.1) OR OR The Responsible Entity has a process for testing The Responsible Entity changes in an does not have a process environment that models to document the test the baseline configuration results and, if using a prior to implementing a test environment, change that deviates from document the baseline configuration, differences between the
OR The Responsible Entity has a process(es) to verify that required security controls in CIP-005 and CIP-007 are not adversely affected by a change(s) that deviates from the existing baseline configuration and identified deficiencies in required controls, but did not assess, or correct the deficiencies. (1.4.2) OR The Responsible Entity has a process(es) to verify that required security controls in CIP-005 and CIP-007 are not adversely affected by a change(s) that deviates from the existing baseline configuration but did not identify, assess, or correct the deficiencies in the required controls. (1.4.2) OR The Responsible Entity has a process for testing changes in an environment that models the baseline configuration prior to implementing a change that deviates from baseline configuration, OR The Responsible Entity has a process(es) to determine required security controls in CIP-005 and CIP-007 that could be impacted by a change(s) that deviates from the existing baseline configuration but did not verify and document that the required controls were not adversely affected following the change. (1.4.2 & 1.4.3) OR The Responsible Entity does not have a process for testing changes in an environment that models the baseline configuration prior to implementing a change that deviates from baseline configuration. (1.5.1) OR The Responsible Entity does not have a process to document the test results and, if using a test environment, document the differences between the
VSL_Matrix_Complete_2016_01_27.docx