accounts and authorized OR The Responsible Entity OR unescorted physical has implemented one The Responsible Entity access by the end of the The Responsible Entity has or more process(es) to next calendar day has implemented one or implemented one or more determine that an following the more process(es) to process(es) to revoke the individual no longer predetermined date. (5.2) change passwords for access to the requires retention of individual’s shared accounts known designated storage locations for access following to the user upon OR BES Cyber System Information reassignments or termination action, but, for two individuals, did not The Responsible Entity transfers but, for three reassignment, or do so by the end of the next has implemented one or or more individuals, transfer, but did not do calendar day following the more process(es) to did not revoke the so for within 30 effective date and time of the revoke the authorized electronic individual’s calendar days of the termination action. (5.3) access to the designated access to individual date of termination storage locations for BES accounts and action, reassignment, or Cyber System authorized unescorted transfer for one or more Information but, for three physical access by the individuals. (5.5) or more individuals, did end of the next not do so by the end of calendar day following OR the next calendar day the predetermined date. The Responsible Entity following the effective (5.2) has implemented one or date and time of the more process(es) to termination action. (5.3) determine and document extenuating operating circumstances following a termination action, reassignment, or transfer, but did not change one or more passwords for shared accounts known to the user within 10 calendar days following the end of the extenuating operating circumstances. (5.5) Electronic Security Perimeter — CIP-005- R1. N/A N/A N/A The Responsible Entity The Responsible Entity shall did not ensure that
OR The Responsible Entity has implemented one or more process(es) to change passwords for shared accounts known to the user upon termination action, reassignment, or transfer, but did not do so for within 30 calendar days of the date of termination action, reassignment, or transfer for one or more individuals. (5.5) OR The Responsible Entity has implemented one or more process(es) to determine and document extenuating operating circumstances following a termination action, reassignment, or transfer, but did not change one or more passwords for shared accounts known to the user within 10 calendar days following the end of the extenuating operating circumstances. (5.5) OR The Responsible Entity has implemented one or more process(es) to revoke the individual’s access to the designated storage locations for BES Cyber System Information but, for two individuals, did not do so by the end of the next calendar day following the effective date and time of the termination action. (5.3) accounts and authorized unescorted physical access by the end of the next calendar day following the predetermined date. (5.2) OR The Responsible Entity has implemented one or more process(es) to revoke the individual’s access to the designated storage locations for BES Cyber System Information but, for three or more individuals, did not do so by the end of the next calendar day following the effective date and time of the termination action. (5.3) The Responsible Entity has implemented one or more process(es) to determine that an individual no longer requires retention of access following reassignments or transfers but, for three or more individuals, did not revoke the authorized electronic access to individual accounts and authorized unescorted physical access by the end of the next calendar day following the predetermined date. (5.2) R1. Electronic Security Perimeter — The Responsible Entity shall N/A N/A N/A The Responsible Entity did not ensure that CIP-005-
VSL_Matrix_Complete_2016_01_27.docx