approval for those policies at three of the OR as required by R2 OR least once every 15 calendar topics as required and has identified The Responsible Entity documented The Responsible Entity months: [please see standard for by R2 and has deficiencies but and implemented one or more cyber did not complete its more information] identified did not assess or security policies for assets with a low review of the one or deficiencies but correct the impact rating that address only two of more documented did not assess or deficiencies. (R2) the topics as required by R2 but did cyber security policies correct the not identify, assess, or correct the OR for assets with a low deficiencies. deficiencies. impact rating as (R2) The Responsible required by R2 within OR Entity documented OR 18 calendar months of and implemented the previous review. The Responsible Entity did not The Responsible one or more cyber complete its review of the one or (R2) Entity security policies more documented cyber security documented and for assets with a OR policies for assets with a low impact implemented one low impact rating rating as required by R2 within 16 The Responsible Entity or more cyber that address only calendar months but did complete did not complete its security policies one of the topics this review in less than or equal to 17 approval of the one or for assets with a as required by R2 calendar months of the previous more documented low impact rating but did not review. (R2) cyber security policies that address only identify, assess, or for assets with a low three of the OR correct the impact rating as topics as required deficiencies. required by R2 by the The Responsible Entity did not by R2 but did not OR CIP Senior Manager complete its approval of the one or identify, assess, within 18 calendar more documented cyber security or correct the The Responsible months of the previous policies for assets with a low impact deficiencies. Entity did not approval. (R2) rating as required by R2 by the CIP complete its OR Senior Manager within 16 calendar review of the one months but did complete this The Responsible or more approval in less than or equal to 17 Entity did not documented cyber calendar months of the previous complete its security policies approval. (R2) review of the one for assets with a or more low impact rating documented as required by R2 cyber security within 17 calendar policies for months but did assets with a low complete this impact rating as review in less than required by R2 or equal to 18
approval for those policies at least once every 15 calendar months: [please see standard for more information] three of the topics as required by R2 and has identified deficiencies but did not assess or correct the deficiencies. (R2) OR The Responsible Entity documented and implemented one or more cyber security policies for assets with a low impact rating that address only three of the topics as required by R2 but did not identify, assess, or correct the deficiencies. OR The Responsible Entity did not complete its review of the one or more documented cyber security policies for assets with a low impact rating as required by R2 OR The Responsible Entity documented and implemented one or more cyber security policies for assets with a low impact rating that address only two of the topics as required by R2 but did not identify, assess, or correct the deficiencies. OR The Responsible Entity did not complete its review of the one or more documented cyber security policies for assets with a low impact rating as required by R2 within 16 calendar months but did complete this review in less than or equal to 17 calendar months of the previous review. (R2) OR The Responsible Entity did not complete its approval of the one or more documented cyber security policies for assets with a low impact rating as required by R2 by the CIP Senior Manager within 16 calendar months but did complete this approval in less than or equal to 17 calendar months of the previous approval. (R2) as required by R2 and has identified deficiencies but did not assess or correct the deficiencies. (R2) OR The Responsible Entity documented and implemented one or more cyber security policies for assets with a low impact rating that address only one of the topics as required by R2 but did not identify, assess, or correct the deficiencies. OR The Responsible Entity did not complete its review of the one or more documented cyber security policies for assets with a low impact rating as required by R2 within 17 calendar months but did complete this review in less than or equal to 18 OR The Responsible Entity did not complete its review of the one or more documented cyber security policies for assets with a low impact rating as required by R2 within 18 calendar months of the previous review. (R2) OR The Responsible Entity did not complete its approval of the one or more documented cyber security policies for assets with a low impact rating as required by R2 by the CIP Senior Manager within 18 calendar months of the previous approval. (R2)
VSL_Matrix_Complete_2016_01_01.docx