Standard CIP-003-3 Requirement implemented as R5. approved by designated personnel. The Responsible Entity shall R5.1.2. N/A The Responsible Entity generated The Responsible The Responsible Entity establish methods, processes, and logs with sufficient detail to create Entity generated did not generate logs of procedures that generate logs of historical audit trails of individual logs with individual user account sufficient detail to create user account access activity, however insufficient detail access activity. historical audit trails of the logs do not contain activity for a to create historical individual user account access minimum of 90 days. audit trails of activity for a minimum of ninety individual user days. account access activity. The Responsible Entity shall The Responsible Entity R5.1.3. N/A N/A N/A review, at least annually, user did not accounts to verify access review, at least privileges are in accordance with annually, user Standard CIP-003-3 Requirement R5 and Standard CIP-004-3 accounts to verify Requirement R4. access privileges are in accordance with Standard CIP-003-3 Requirement R5 and Standard Requirement R4. The Responsible Entity shall R5.2. N/A N/A N/A The Responsible Entity implement a policy to minimize did not implement a and manage the scope and policy to minimize and acceptable use of administrator, manage the scope and shared, and other generic account acceptable use of privileges including factory administrator, shared, default accounts. and other generic account privileges including factory default accounts. The policy shall include the R5.2.1. N/A N/A The Responsible For accounts that must removal, disabling, or renaming Entity's policy did remain enabled, the
Standard CIP-003-3 Requirement R5. implemented as approved by designated personnel. R5.1.2. The Responsible Entity shall establish methods, processes, and procedures that generate logs of sufficient detail to create historical audit trails of individual user account access activity for a minimum of ninety days. N/A The Responsible Entity generated logs with sufficient detail to create historical audit trails of individual user account access activity, however the logs do not contain activity for a minimum of 90 days. The Responsible Entity generated logs with insufficient detail to create historical audit trails of individual user account access activity. The Responsible Entity did not generate logs of individual user account access activity. R5.1.3. The Responsible Entity shall review, at least annually, user accounts to verify access privileges are in accordance with Standard CIP-003-3 Requirement R5 and Standard CIP-004-3 Requirement R4. N/A N/A N/A The Responsible Entity did not review, at least annually, user accounts to verify access privileges are in accordance with Standard CIP-003-3 Requirement R5 and Standard Requirement R4. R5.2. The Responsible Entity shall implement a policy to minimize and manage the scope and acceptable use of administrator, shared, and other generic account privileges including factory default accounts. N/A N/A N/A The Responsible Entity did not implement a policy to minimize and manage the scope and acceptable use of administrator, shared, and other generic account privileges including factory default accounts. R5.2.1. The policy shall include the removal, disabling, or renaming N/A N/A The Responsible Entity's policy did For accounts that must remain enabled, the
VSL_Matrix_Complete_2016_01_01.docx