OR The Responsible Entity did not conduct Personnel Risk Assessments (PRAs) for four or more individuals with authorized electronic or authorized unescorted physical access within 7 calendar years of the previous PRA completion date. (3.5) Each Responsible Entity shall The Responsible Entity The Responsible Entity did not The Responsible Entity The Responsible Entity CIP-004-6 R4. implement one or more did not verify that verify that individuals with did not verify that did not implement any documented access management individuals with active active electronic or active individuals with active documented program(s) that collectively electronic or active unescorted physical access electronic or active program(s) for access include each of the applicable unescorted physical have authorization records unescorted physical management. (R4) requirement parts in access have during a calendar quarter but access have authorization CIP-004-6 authorization records did so between 10 and 20 records during a calendar OR Table R4 Access Management – during a calendar calendar days after the start of a quarter but did so between Program. The Responsible Entity quarter but did so less subsequent calendar quarter. 20 and 30 calendar days [See Table R4 of the standard] has implemented one than 10 calendar days (4.2) after the start of a or more documented after the start of a subsequent calendar program(s) for access subsequent calendar OR quarter. (4.2) management that quarter. (4.2) The Responsible Entity has includes a process to OR implemented processes to authorize electronic OR verify that user accounts, user The Responsible Entity access, unescorted The Responsible Entity account groups, or user role has implemented physical access, or has implemented categories, and their specific, processes to verify that access to the processes to verify that associated privileges are correct user accounts, user designated storage user accounts, user and necessary within 15 account groups, or user locations where BES account groups, or user calendar months of the previous role categories, and their Cyber System role categories, and verification but for more than specific, associated Information is located. their specific, 5% but less than (or equal to) privileges are correct and (4.1) associated privileges 10% of its BES Cyber Systems, necessary within 15 are correct and privileges were incorrect or calendar months of the OR necessary within 15 unnecessary. (4.3) previous verification but
OR The Responsible Entity did not conduct Personnel Risk Assessments (PRAs) for four or more individuals with authorized electronic or authorized unescorted physical access within 7 calendar years of the previous PRA completion date. (3.5) CIP-004-6 R4. Each Responsible Entity shall implement one or more documented access management program(s) that collectively include each of the applicable requirement parts in CIP-004-6 Table R4 – Access Management Program. [See Table R4 of the standard] The Responsible Entity did not verify that individuals with active electronic or active unescorted physical access have authorization records during a calendar quarter but did so less than 10 calendar days after the start of a subsequent calendar quarter. (4.2) OR The Responsible Entity has implemented processes to verify that user accounts, user account groups, or user role categories, and their specific, associated privileges are correct and necessary within 15 The Responsible Entity did not verify that individuals with active electronic or active unescorted physical access have authorization records during a calendar quarter but did so between 10 and 20 calendar days after the start of a subsequent calendar quarter. (4.2) OR The Responsible Entity has implemented processes to verify that user accounts, user account groups, or user role categories, and their specific, associated privileges are correct and necessary within 15 calendar months of the previous verification but for more than 5% but less than (or equal to) 10% of its BES Cyber Systems, privileges were incorrect or unnecessary. (4.3) The Responsible Entity did not verify that individuals with active electronic or active unescorted physical access have authorization records during a calendar quarter but did so between 20 and 30 calendar days after the start of a subsequent calendar quarter. (4.2) OR The Responsible Entity has implemented processes to verify that user accounts, user account groups, or user role categories, and their specific, associated privileges are correct and necessary within 15 calendar months of the previous verification but The Responsible Entity did not implement any documented program(s) for access management. (R4) OR The Responsible Entity has implemented one or more documented program(s) for access management that includes a process to authorize electronic access, unescorted physical access, or access to the designated storage locations where BES Cyber System Information is located. (4.1) OR
VSL_Matrix_Complete_2016_01_27.docx