third party review the evaluation Requirement R5 The Responsible Entity had an R5 but did so more in more than 120 performed under Requirement R4 but did so in unaffiliated third party review the than 110 calendar calendar days; and the security plan(s) more than 90 evaluation performed under days but less than OR developed under Requirement calendar days but Requirement R4 and the security or equal to 120 R5. The review may occur less than or equal plan(s) developed under Requirement calendar days; The Responsible concurrently with or after to 100 calendar R5 and modified or documented the Entity failed to have OR completion of the evaluation days; reason for not modifying the security an unaffiliated third performed under Requirement R4 plan(s) as specified in Part 6.3 but did The Responsible party review the OR and the security plan so more than 70 calendar days and Entity had an evaluation performed development under Requirement less than or equal to 80 calendar days The Responsible unaffiliated third under Requirement R4 R5. following completion of the third Entity had an party review the and the security unaffiliated third party review. evaluation plan(s) developed party review the performed under under Requirement evaluation Requirement R4 R5; performed under and the security OR Requirement R4 plan(s) developed and the security under Requirement The Responsible plan(s) R5 and modified Entity had an developed under or documented the unaffiliated third party Requirement R5 reason for not review the evaluation and modified or modifying the performed under documented the security plan(s) as Requirement R4 and reason for not specified in Part the security plan(s) modifying the 6.3 but did so developed under security plan(s) more than 80 Requirement R5 but as specified in calendar days failed to implement Part 6.3 but did following procedures for so more than 60 completion of the protecting information calendar days third party review; per Part 6.4. and less than or OR equal to 70 calendar days The Responsible following Entity had an completion of the unaffiliated third third party party review the review. evaluation performed under Requirement R4 and the security
third party review the evaluation performed under Requirement R4 and the security plan(s) developed under Requirement R5. The review may occur concurrently with or after completion of the evaluation performed under Requirement R4 and the security plan development under Requirement R5. Requirement R5 but did so in more than 90 calendar days but less than or equal to 100 calendar days; OR The Responsible Entity had an unaffiliated third party review the evaluation performed under Requirement R4 and the security plan(s) developed under Requirement R5 and modified or documented the reason for not modifying the security plan(s) as specified in Part 6.3 but did so more than 60 calendar days and less than or equal to 70 calendar days following completion of the third party review. The Responsible Entity had an unaffiliated third party review the evaluation performed under Requirement R4 and the security plan(s) developed under Requirement R5 and modified or documented the reason for not modifying the security plan(s) as specified in Part 6.3 but did so more than 70 calendar days and less than or equal to 80 calendar days following completion of the third party review. R5 but did so more than 110 calendar days but less than or equal to 120 calendar days; OR The Responsible Entity had an unaffiliated third party review the evaluation performed under Requirement R4 and the security plan(s) developed under Requirement R5 and modified or documented the reason for not modifying the security plan(s) as specified in Part 6.3 but did so more than 80 calendar days following completion of the third party review; OR The Responsible Entity had an unaffiliated third party review the evaluation performed under Requirement R4 and the security in more than 120 calendar days; OR The Responsible Entity failed to have an unaffiliated third party review the evaluation performed under Requirement R4 and the security plan(s) developed under Requirement R5; OR The Responsible Entity had an unaffiliated third party review the evaluation performed under Requirement R4 and the security plan(s) developed under Requirement R5 but failed to implement procedures for protecting information per Part 6.4.
VSL_Matrix_Complete_2016_01_01.docx