retain visitor logs for at least ninety days. (2.3) Each Responsible Entity shall CIP-006-6 R3. The Responsible Entity The Responsible Entity has The Responsible Entity The Responsible Entity implement one or more has documented and documented and implemented a has documented and did not document or documented Physical Access implemented a maintenance and testing implemented a implement a Control System maintenance and maintenance and testing program for Physical Access maintenance and testing maintenance and testing program(s) that program for Physical Control Systems and locally program for Physical testing program for collectively include each of the Access Control Systems mounted hardware or devices at Access Control Systems Physical Access applicable requirement parts in and locally mounted the Physical Security Perimeter, and locally mounted Control Systems and CIP-006-6 Table R3 – hardware or devices at but did not complete required hardware or devices at the locally mounted Maintenance and Testing the Physical Security testing within 25 calendar Physical Security hardware or devices at Program. Perimeter, but did not months but did complete Perimeter, but did not the Physical Security [See Table R3 of the standard.] complete required required testing within 26 complete required testing Perimeter. (3.1) testing within 24 calendar months. (3.1) within 26 calendar OR calendar months but did months but did complete complete required required testing within 27 The Responsible Entity testing within 25 calendar months. (3.1) has documented and calendar months. (3.1) implemented a maintenance and testing program for Physical Access Control Systems and locally mounted hardware or devices at the Physical Security Perimeter, but did not complete required testing within 27 calendar months. (3.1) Test Procedures The — R1. N/A N/A N/A The Responsible Entity Responsible Entity shall ensure did not ensure the that new Cyber Assets and prevention of adverse significant changes to existing affects described in R1, Cyber Assets within the by not including the Electronic Security Perimeter do required minimum not adversely affect existing significant changes. cyber security controls. For OR
retain visitor logs for at least ninety days. (2.3) CIP-006-6 R3. Each Responsible Entity shall implement one or more documented Physical Access Control System maintenance and testing program(s) that collectively include each of the applicable requirement parts in CIP-006-6 Table R3 – Maintenance and Testing Program. [See Table R3 of the standard.] The Responsible Entity has documented and implemented a maintenance and testing program for Physical Access Control Systems and locally mounted hardware or devices at the Physical Security Perimeter, but did not complete required testing within 24 calendar months but did complete required testing within 25 calendar months. (3.1) The Responsible Entity has documented and implemented a maintenance and testing program for Physical Access Control Systems and locally mounted hardware or devices at the Physical Security Perimeter, but did not complete required testing within 25 calendar months but did complete required testing within 26 calendar months. (3.1) The Responsible Entity has documented and implemented a maintenance and testing program for Physical Access Control Systems and locally mounted hardware or devices at the Physical Security Perimeter, but did not complete required testing within 26 calendar months but did complete required testing within 27 calendar months. (3.1) The Responsible Entity did not document or implement a maintenance and testing program for Physical Access Control Systems and locally mounted hardware or devices at the Physical Security Perimeter. (3.1) OR The Responsible Entity has documented and implemented a maintenance and testing program for Physical Access Control Systems and locally mounted hardware or devices at the Physical Security Perimeter, but did not complete required testing within 27 calendar months. (3.1) R1. Test Procedures — The Responsible Entity shall ensure that new Cyber Assets and significant changes to existing Cyber Assets within the Electronic Security Perimeter do not adversely affect existing cyber security controls. For N/A N/A N/A The Responsible Entity did not ensure the prevention of adverse affects described in R1, by not including the required minimum significant changes. OR
VSL_Matrix_Complete_2016_01_27.docx