program to retain visitor logs initial entry and last for at least ninety days and exit dates and times of identified deficiencies but did the visitor, the visitor’s not assess or correct the name, and the point of deficiencies. (2.3) contact. (2.2) OR OR The Responsible Entity The Responsible Entity included a visitor control failed to include or program to retain visitor logs implement a visitor for at least ninety days but did control program to not identify, assess, or correct retain visitor logs for at the deficiencies. (2.3) least ninety days. (2.3) Each Responsible Entity shall CIP-006-5 R3. The Responsible Entity The Responsible Entity has The Responsible Entity The Responsible Entity implement one or more has documented and documented and implemented a has documented and has not documented documented Physical Access implemented a maintenance and testing implemented a and implemented a Control System maintenance and maintenance and testing program for Physical Access maintenance and testing maintenance and testing programs that collectively program for Physical Control Systems and locally program for Physical testing program for include each of the applicable Access Control Systems mounted hardware or devices at Access Control Systems Physical Access requirement parts in CIP-006-5 and locally mounted the Physical Security Perimeter, and locally mounted Control Systems and Table R3 Maintenance and – hardware or devices at but did not complete required hardware or devices at the locally mounted Testing Program. the Physical Security testing within 25 calendar Physical Security hardware or devices at Perimeter, but did not months but did complete Perimeter, but did not the Physical Security complete required required testing within 26 complete required testing Perimeter. (3.1) testing within 24 calendar months. (3.1) within 26 calendar OR calendar months but did months but did complete complete required required testing within 27 The Responsible Entity testing within 25 calendar months. (3.1) has documented and calendar months. (3.1) implemented a maintenance and testing program for Physical Access Control Systems and locally mounted hardware or devices at the Physical Security Perimeter, but did not complete required
program to retain visitor logs for at least ninety days and identified deficiencies but did not assess or correct the deficiencies. (2.3) OR The Responsible Entity included a visitor control program to retain visitor logs for at least ninety days but did not identify, assess, or correct the deficiencies. (2.3) initial entry and last exit dates and times of the visitor, the visitor’s name, and the point of contact. (2.2) OR The Responsible Entity failed to include or implement a visitor control program to retain visitor logs for at least ninety days. (2.3) CIP-006-5 R3. Each Responsible Entity shall implement one or more documented Physical Access Control System maintenance and testing programs that collectively include each of the applicable requirement parts in CIP-006-5 Table R3 – Maintenance and Testing Program. The Responsible Entity has documented and implemented a maintenance and testing program for Physical Access Control Systems and locally mounted hardware or devices at the Physical Security Perimeter, but did not complete required testing within 24 calendar months but did complete required testing within 25 calendar months. (3.1) The Responsible Entity has documented and implemented a maintenance and testing program for Physical Access Control Systems and locally mounted hardware or devices at the Physical Security Perimeter, but did not complete required testing within 25 calendar months but did complete required testing within 26 calendar months. (3.1) The Responsible Entity has documented and implemented a maintenance and testing program for Physical Access Control Systems and locally mounted hardware or devices at the Physical Security Perimeter, but did not complete required testing within 26 calendar months but did complete required testing within 27 calendar months. (3.1) The Responsible Entity has not documented and implemented a maintenance and testing program for Physical Access Control Systems and locally mounted hardware or devices at the Physical Security Perimeter. (3.1) OR The Responsible Entity has documented and implemented a maintenance and testing program for Physical Access Control Systems and locally mounted hardware or devices at the Physical Security Perimeter, but did not complete required
VSL_Matrix_Complete_2016_01_27.docx