The Responsible not identify, restricts access to Entity has a assess, or correct Applicable Systems process to retain the deficiencies. using at least one physical access (1.5) control, but did not logs for 90 OR identify, assess, or calendar days but The Responsible correct the deficiencies. did not identify, Entity has a (1.2) assess, or correct process to monitor OR the deficiencies. for unauthorized The Responsible Entity (1.9) physical access to has documented and a Physical Access implemented physical Control Systems access controls, but at and identified least two different deficiencies but controls do not exist to did not assess or restrict access to correct the Applicable Systems. deficiencies. (1.6) (1.3) OR OR The Responsible The Responsible Entity Entity has a documented and process to monitor implemented for unauthorized operational or physical access to procedural controls, a Physical Access restricts access to Control Systems Applicable Systems but did not using at least two identify, assess, or different controls, and correct the identified deficiencies, deficiencies. (1.6) but did not assess or correct the deficiencies. (1.3) OR The Responsible Entity documented and implemented operational or procedural controls, restricts access to Applicable Systems
The Responsible Entity has a process to retain physical access logs for 90 calendar days but did not identify, assess, or correct the deficiencies. (1.9) not identify, assess, or correct the deficiencies. (1.5) OR The Responsible Entity has a process to monitor for unauthorized physical access to a Physical Access Control Systems and identified deficiencies but did not assess or correct the deficiencies. (1.6) OR The Responsible Entity has a process to monitor for unauthorized physical access to a Physical Access Control Systems but did not identify, assess, or correct the deficiencies. (1.6) restricts access to Applicable Systems using at least one control, but did not identify, assess, or correct the deficiencies. (1.2) OR The Responsible Entity has documented and implemented physical access controls, but at least two different controls do not exist to restrict access to Applicable Systems. (1.3) OR The Responsible Entity documented and implemented operational or procedural controls, restricts access to Applicable Systems using at least two different controls, and identified deficiencies, but did not assess or correct the deficiencies. (1.3) OR The Responsible Entity documented and implemented operational or procedural controls, restricts access to Applicable Systems
VSL_Matrix_Complete_2016_01_01.docx