emergency operations on Cyber Assets inside the Electronic Security Perimeter(s). The Responsible Entity shall R2.2. N/A N/A N/A The Responsible Entity disable other ports and services, did not disable one or including those used for testing more other ports or purposes, prior to production use services, including of all Cyber Assets inside the those used for testing Electronic Security Perimeter(s). purposes, prior to production use for Cyber Assets inside the Electronic Security Perimeter(s). In the case where unused ports R2.3. N/A N/A N/A For cases where unused and services cannot be disabled ports and services due to technical limitations, the cannot be disabled due Responsible Entity shall to technical limitations, document compensating the Responsible Entity measure(s) applied to mitigate did not document risk exposure. compensating measure(s) applied to mitigate risk. Security Patch Management N/A The Responsible Entity — R3. N/A N/A The Responsible Entity, either did not separately or as a component of establish (implement) the documented configuration or did not document, management process specified in either separately or as a CIP-003-3 Requirement R6, shall component of the establish, document and documented implement a security patch management program for configuration tracking, evaluating, testing, and management process installing applicable cyber specified in CIP-003-3 security software patches for all Requirement R6, a Cyber Assets within the security patch Electronic Security Perimeter(s).
emergency operations on Cyber Assets inside the Electronic Security Perimeter(s). R2.2. The Responsible Entity shall disable other ports and services, including those used for testing purposes, prior to production use of all Cyber Assets inside the Electronic Security Perimeter(s). N/A N/A N/A The Responsible Entity did not disable one or more other ports or services, including those used for testing purposes, prior to production use for Cyber Assets inside the Electronic Security Perimeter(s). R2.3. In the case where unused ports and services cannot be disabled due to technical limitations, the Responsible Entity shall document compensating measure(s) applied to mitigate risk exposure. N/A N/A N/A For cases where unused ports and services cannot be disabled due to technical limitations, the Responsible Entity did not document compensating measure(s) applied to mitigate risk. R3. Security Patch Management — The Responsible Entity, either separately or as a component of the documented configuration management process specified in CIP-003-3 Requirement R6, shall establish, document and implement a security patch management program for tracking, evaluating, testing, and installing applicable cyber security software patches for all Cyber Assets within the Electronic Security Perimeter(s). N/A N/A N/A The Responsible Entity did not establish (implement) or did not document, either separately or as a component of the documented configuration management process specified in CIP-003-3 Requirement R6, a security patch
VSL_Matrix_Complete_2016_01_27.docx