of the applicable requirement responsibilities of Cyber identify, classify, and parts in Security Incident response respond to Cyber CIP‐008‐5 Table R1 – groups or individuals. Security Incidents. Cyber Security Incident Response (1.3) (1.1) Plan Specifications. OR OR The Responsible Entity The Responsible Entity has developed the Cyber has developed a Cyber Security Incident response Security Incident plan(s), but the plan does response plan, but the not include incident plan does not include handling procedures for one or more processes Cyber Security Incidents. to identify Reportable (1.4) Cyber Security Incidents. (1.2) OR The Responsible Entity has developed a Cyber Security Incident response plan, but did not provide at least preliminary notification to ES-ISAC within one from identification of a Reportable Cyber Security Incident. (1.2) Each Responsible Entity shall The Responsible Entity The Responsible Entity has not The Responsible Entity The Responsible Entity CIP-008-5 R2. implement each of its has not tested the Cyber tested the Cyber Security has not tested the Cyber has not tested the documented Cyber Security Security Incident Incident response plan(s) Security Incident response Cyber Security Incident Incident response plans to response plan(s) within within 16 calendar months, not plan(s) within 17 calendar response plan(s) within collectively include each of the 15 calendar months, not exceeding 17 calendar months months, not exceeding 18 18 calendar months applicable requirement parts in exceeding 16 calendar between tests of the plan. (2.1) calendar months between between tests of the months between tests of tests of the plan. (2.1) plan. (2.1) CIP‐008‐5 Table R2 Cyber – the plan. (2.1) OR OR Security Incident Response Plan The Responsible Entity The Responsible Entity Implementation and Testing. did not document did not retain relevant deviations, if any, from records related to the plan during a test or Reportable Cyber when a Reportable Cyber
of the applicable requirement parts in CIP‐008‐5 Table R1 – Cyber Security Incident Response Plan Specifications. responsibilities of Cyber Security Incident response groups or individuals. (1.3) OR The Responsible Entity has developed the Cyber Security Incident response plan(s), but the plan does not include incident handling procedures for Cyber Security Incidents. (1.4) identify, classify, and respond to Cyber Security Incidents. (1.1) OR The Responsible Entity has developed a Cyber Security Incident response plan, but the plan does not include one or more processes to identify Reportable Cyber Security Incidents. (1.2) OR The Responsible Entity has developed a Cyber Security Incident response plan, but did not provide at least preliminary notification to ES-ISAC within one from identification of a Reportable Cyber Security Incident. (1.2) CIP-008-5 R2. Each Responsible Entity shall implement each of its documented Cyber Security Incident response plans to collectively include each of the applicable requirement parts in CIP‐008‐5 Table R2 – Cyber Security Incident Response Plan Implementation and Testing. The Responsible Entity has not tested the Cyber Security Incident response plan(s) within 15 calendar months, not exceeding 16 calendar months between tests of the plan. (2.1) The Responsible Entity has not tested the Cyber Security Incident response plan(s) within 16 calendar months, not exceeding 17 calendar months between tests of the plan. (2.1) The Responsible Entity has not tested the Cyber Security Incident response plan(s) within 17 calendar months, not exceeding 18 calendar months between tests of the plan. (2.1) OR The Responsible Entity did not document deviations, if any, from the plan during a test or when a Reportable Cyber The Responsible Entity has not tested the Cyber Security Incident response plan(s) within 18 calendar months between tests of the plan. (2.1) OR The Responsible Entity did not retain relevant records related to Reportable Cyber
VSL_Matrix_Complete_2016_01_27.docx