and identified required security controls in OR correct the deficiencies. deficiencies in the CIP-005 and CIP-007 that (1.1) The Responsible Entity verification could be impacted by a has a process(es) that OR documentation but did change(s) that deviates from the requires authorization and not assess or correct the existing baseline configuration The Responsible Entity documentation for deficiencies. (1.4.3) but did not identify, assess, or does not have a changes that deviate from correct the deficiencies in the process(es) that OR the existing baseline determination of affected requires authorization configuration but did not security controls. (1.4.1) The Responsible Entity and documentation of identify, assess, or correct has a process(es) to changes that deviate the deficiencies. (1.2) perform steps in 1.4.1 from the existing and 1.4.2 for a OR baseline configuration. change(s) that deviates (1.2) The Responsible Entity from the existing has a process(es) to OR baseline configuration update baseline but did not identify, The Responsible Entity configurations within 30 assess, or correct the does not have a calendar days of deficiencies in the process(es) to update completing a change(s) verification baseline configurations that deviates from the documentation. (1.4.3) within 30 calendar days existing baseline of completing a configuration and change(s) that deviates identified deficiencies but from the existing did not assess or correct baseline the deficiencies. (1.3) configuration.(1.3) OR OR The Responsible Entity The Responsible Entity has a process(es) to does not have a update baseline process(es) to configurations within 30 determine required calendar days of security controls in completing a change(s) CIP-005 and CIP-007 that deviates from the that could be impacted existing baseline by a change(s) that configuration but did not deviates from the identify, assess, or correct existing baseline the deficiencies. (1.3) configuration. (1.4.1)
and identified deficiencies in the verification documentation but did not assess or correct the deficiencies. (1.4.3) OR The Responsible Entity has a process(es) to perform steps in 1.4.1 and 1.4.2 for a change(s) that deviates from the existing baseline configuration but did not identify, assess, or correct the deficiencies in the verification documentation. (1.4.3) required security controls in CIP-005 and CIP-007 that could be impacted by a change(s) that deviates from the existing baseline configuration but did not identify, assess, or correct the deficiencies in the determination of affected security controls. (1.4.1) OR The Responsible Entity has a process(es) that requires authorization and documentation for changes that deviate from the existing baseline configuration but did not identify, assess, or correct the deficiencies. (1.2) OR The Responsible Entity has a process(es) to update baseline configurations within 30 calendar days of completing a change(s) that deviates from the existing baseline configuration and identified deficiencies but did not assess or correct the deficiencies. (1.3) OR The Responsible Entity has a process(es) to update baseline configurations within 30 calendar days of completing a change(s) that deviates from the existing baseline configuration but did not identify, assess, or correct the deficiencies. (1.3) correct the deficiencies. (1.1) OR The Responsible Entity does not have a process(es) that requires authorization and documentation of changes that deviate from the existing baseline configuration. (1.2) OR The Responsible Entity does not have a process(es) to update baseline configurations within 30 calendar days of completing a change(s) that deviates from the existing baseline configuration.(1.3) OR The Responsible Entity does not have a process(es) to determine required security controls in CIP-005 and CIP-007 that could be impacted by a change(s) that deviates from the existing baseline configuration. (1.4.1)
VSL_Matrix_Complete_2016_01_27.docx