implement a process to ensure document a process to that only those ports and services ensure that only those required for normal and ports and services emergency operations are required for normal and enabled. emergency operations are enabled. The Responsible Entity shall R2.1. N/A N/A N/A The Responsible Entity enable only those ports and enabled one or more services required for normal and ports or services not emergency operations. required for normal and emergency operations on Cyber Assets inside the Electronic Security Perimeter(s). The Responsible Entity shall R2.2. N/A N/A N/A The Responsible Entity disable other ports and services, did not disable one or including those used for testing more other ports or purposes, prior to production use services, including of all Cyber Assets inside the those used for testing Electronic Security Perimeter(s). purposes, prior to production use for Cyber Assets inside the Electronic Security Perimeter(s). In the case where unused ports R2.3. N/A N/A N/A For cases where unused and services cannot be disabled ports and services due to technical limitations, the cannot be disabled due Responsible Entity shall to technical limitations, document compensating the Responsible Entity measure(s) applied to mitigate did not document risk exposure. compensating measure(s) applied to mitigate risk. Security Patch Management N/A The Responsible Entity — R3. N/A N/A The Responsible Entity, either did not separately or as a component of establish (implement) the documented configuration or did not document,
implement a process to ensure that only those ports and services required for normal and emergency operations are enabled. document a process to ensure that only those ports and services required for normal and emergency operations are enabled. R2.1. The Responsible Entity shall enable only those ports and services required for normal and emergency operations. N/A N/A N/A The Responsible Entity enabled one or more ports or services not required for normal and emergency operations on Cyber Assets inside the Electronic Security Perimeter(s). R2.2. The Responsible Entity shall disable other ports and services, including those used for testing purposes, prior to production use of all Cyber Assets inside the Electronic Security Perimeter(s). N/A N/A N/A The Responsible Entity did not disable one or more other ports or services, including those used for testing purposes, prior to production use for Cyber Assets inside the Electronic Security Perimeter(s). R2.3. In the case where unused ports and services cannot be disabled due to technical limitations, the Responsible Entity shall document compensating measure(s) applied to mitigate risk exposure. N/A N/A N/A For cases where unused ports and services cannot be disabled due to technical limitations, the Responsible Entity did not document compensating measure(s) applied to mitigate risk. R3. Security Patch Management — The Responsible Entity, either separately or as a component of the documented configuration N/A N/A N/A The Responsible Entity did not establish (implement) or did not document,
VSL_Matrix_Complete_2016_01_01.docx