1.4.1 and 1.4.2 changes that OR for a change(s) deviate from the The Responsible Entity that deviates existing baseline does not have a from the existing configuration and process(es) to update baseline identified baseline configurations configuration deficiencies but within 30 calendar days and identified did not assess or of completing a deficiencies in correct the change(s) that deviates the verification deficiencies. (1.2) from the existing documentation OR baseline but did not assess configuration.(1.3) or correct the The Responsible deficiencies. Entity has a OR (1.4.3) process(es) that The Responsible Entity requires OR does not have a authorization and process(es) to The Responsible documentation for determine required Entity has a changes that security controls in process(es) to deviate from the CIP-005 and CIP-007 perform steps in existing baseline that could be impacted 1.4.1 and 1.4.2 configuration but by a change(s) that for a change(s) did not identify, deviates from the that deviates assess, or correct existing baseline from the existing the deficiencies. configuration. (1.4.1) baseline (1.2) configuration but OR OR did not identify, The Responsible Entity assess, or correct The Responsible has a process(es) to the deficiencies Entity has a determine required in the process(es) to security controls in verification update baseline CIP-005 and CIP-007 documentation. configurations that could be impacted (1.4.3) within 30 calendar by a change(s) that days of completing deviates from the a change(s) that existing baseline deviates from the configuration but did existing baseline not verify and configuration and document that the identified
1.4.1 and 1.4.2 for a change(s) that deviates from the existing baseline configuration and identified deficiencies in the verification documentation but did not assess or correct the deficiencies. (1.4.3) OR The Responsible Entity has a process(es) to perform steps in 1.4.1 and 1.4.2 for a change(s) that deviates from the existing baseline configuration but did not identify, assess, or correct the deficiencies in the verification documentation. (1.4.3) changes that deviate from the existing baseline configuration and identified deficiencies but did not assess or correct the deficiencies. (1.2) OR The Responsible Entity has a process(es) that requires authorization and documentation for changes that deviate from the existing baseline configuration but did not identify, assess, or correct the deficiencies. (1.2) OR The Responsible Entity has a process(es) to update baseline configurations within 30 calendar days of completing a change(s) that deviates from the existing baseline configuration and identified OR The Responsible Entity does not have a process(es) to update baseline configurations within 30 calendar days of completing a change(s) that deviates from the existing baseline configuration.(1.3) OR The Responsible Entity does not have a process(es) to determine required security controls in CIP-005 and CIP-007 that could be impacted by a change(s) that deviates from the existing baseline configuration. (1.4.1) OR The Responsible Entity has a process(es) to determine required security controls in CIP-005 and CIP-007 that could be impacted by a change(s) that deviates from the existing baseline configuration but did not verify and document that the
VSL_Matrix_Complete_2016_01_01.docx