management process specified in either separately or as a CIP-003-3 Requirement R6, shall component of the establish, document and documented implement a security patch configuration management program for management process tracking, evaluating, testing, and specified in CIP-003-3 installing applicable cyber Requirement R6, a security software patches for all security patch Cyber Assets within the Electronic Security Perimeter(s). management program for tracking, evaluating, testing, and installing applicable cyber security software patches for all Cyber Assets within the Electronic Security Perimeter(s). The Responsible Entity shall R3.1. N/A N/A N/A The Responsible Entity document the assessment of did not document the security patches and security assessment of security upgrades for applicability within patches and security thirty calendar days of upgrades for availability of the patches or applicability as upgrades. required in Requirement R3 within 30 calendar days after the availability of the patches and upgrades. The Responsible Entity shall R3.2. N/A N/A N/A The Responsible Entity document the implementation of did not document the security patches. In any case implementation of where the patch is not installed, applicable security the Responsible Entity shall patches as required in document compensating R3. measure(s) applied to mitigate OR risk exposure.
management process specified in CIP-003-3 Requirement R6, shall establish, document and implement a security patch management program for tracking, evaluating, testing, and installing applicable cyber security software patches for all Cyber Assets within the Electronic Security Perimeter(s). either separately or as a component of the documented configuration management process specified in CIP-003-3 Requirement R6, a security patch management program for tracking, evaluating, testing, and installing applicable cyber security software patches for all Cyber Assets within the Electronic Security Perimeter(s). R3.1. The Responsible Entity shall document the assessment of security patches and security upgrades for applicability within thirty calendar days of availability of the patches or upgrades. N/A N/A N/A The Responsible Entity did not document the assessment of security patches and security upgrades for applicability as required in Requirement R3 within 30 calendar days after the availability of the patches and upgrades. R3.2. The Responsible Entity shall document the implementation of security patches. In any case where the patch is not installed, the Responsible Entity shall document compensating measure(s) applied to mitigate risk exposure. N/A N/A N/A The Responsible Entity did not document the implementation of applicable security patches as required in R3. OR
VSL_Matrix_Complete_2016_01_01.docx