Cyber Security Incidents to Cyber Security reportable per Requirement R1.1 Incidents reportable per for three calendar years. Requirement R1.1 for at least three calendar years. Each Responsible Entity shall N/A N/A The Responsible The Responsible Entity CIP-008-5 R1. document one or more Cyber Entity has has not developed a Security Incident response developed the Cyber Security Incident plan(s) that collectively include Cyber Security response plan with one each Incident response or more processes to of the applicable requirement plan(s), but the identify, classify, and parts in plan does not respond to Cyber CIP‐008‐5 Table R1 – include the roles Security Incidents. Cyber Security Incident Response and (1.1) Plan Specifications. responsibilities of OR Cyber Security The Responsible Entity Incident response has developed a Cyber groups or Security Incident individuals. (1.3) response plan, but the OR plan does not include The Responsible one or more processes Entity has to identify Reportable developed the Cyber Security Cyber Security Incidents. (1.2) Incident response OR plan(s), but the The Responsible Entity plan does not has developed a Cyber include incident Security Incident handling response plan, but did procedures for not provide at least Cyber Security preliminary notification Incidents. (1.4) to ES-ISAC within one from identification of a Reportable Cyber Security Incident. (1.2) Each Responsible Entity shall The Responsible The Responsible Entity has not tested The Responsible The Responsible Entity CIP-008-5 R2. implement each of its Entity has not the Cyber Security Incident response Entity has not has not tested the documented Cyber Security tested the Cyber plan(s) within 16 calendar months, tested the Cyber Cyber Security Incident
Cyber Security Incidents reportable per Requirement R1.1 for three calendar years. to Cyber Security Incidents reportable per Requirement R1.1 for at least three calendar years. CIP-008-5 R1. Each Responsible Entity shall document one or more Cyber Security Incident response plan(s) that collectively include each of the applicable requirement parts in CIP‐008‐5 Table R1 – Cyber Security Incident Response Plan Specifications. N/A N/A The Responsible Entity has developed the Cyber Security Incident response plan(s), but the plan does not include the roles and responsibilities of Cyber Security Incident response groups or individuals. (1.3) OR The Responsible Entity has developed the Cyber Security Incident response plan(s), but the plan does not include incident handling procedures for Cyber Security Incidents. (1.4) The Responsible Entity has not developed a Cyber Security Incident response plan with one or more processes to identify, classify, and respond to Cyber Security Incidents. (1.1) OR The Responsible Entity has developed a Cyber Security Incident response plan, but the plan does not include one or more processes to identify Reportable Cyber Security Incidents. (1.2) OR The Responsible Entity has developed a Cyber Security Incident response plan, but did not provide at least preliminary notification to ES-ISAC within one from identification of a Reportable Cyber Security Incident. (1.2) CIP-008-5 R2. Each Responsible Entity shall implement each of its documented Cyber Security The Responsible Entity has not tested the Cyber The Responsible Entity has not tested the Cyber Security Incident response plan(s) within 16 calendar months, The Responsible Entity has not tested the Cyber The Responsible Entity has not tested the Cyber Security Incident
VSL_Matrix_Complete_2016_01_01.docx