once every 35 calendar days but did not identify, assess, or correct the deficiencies. (2.1) R3. Each Responsible Entity shall CIP-010-1 The Responsible Entity The Responsible Entity has The Responsible Entity The Responsible Entity implement one or more has implemented one or implemented one or more has implemented one or has not implemented documented processes that more documented documented vulnerability more documented any vulnerability collectively include each of the vulnerability assessment processes for each vulnerability assessment assessment processes applicable requirement parts in assessment processes of its applicable BES Cyber processes for each of its for one of its applicable CIP‐010‐1 Table R3– for each of its Systems, but has performed a applicable BES Cyber BES Cyber Systems. Vulnerability Assessments. applicable BES Cyber vulnerability assessment more Systems, but has (R3) Systems, but has than 18 months, but less than performed a vulnerability OR performed a 21, months since the last assessment more than 21 vulnerability assessment on one of its months, but less than 24 The Responsible Entity assessment more than applicable BES Cyber Systems. months, since the last has implemented one 15 months, but less than (3.1) assessment on one of its or more documented 18 months, since the applicable BES Cyber vulnerability OR last assessment on one Systems. (3.1) assessment processes of its applicable BES The Responsible Entity has for each of its OR Cyber Systems. (3.1) implemented one or more applicable BES Cyber documented active The Responsible Entity Systems, but has OR vulnerability assessment has implemented one or performed a The Responsible Entity processes for Applicable more documented active vulnerability has implemented one or Systems, but has performed an vulnerability assessment assessment more than more documented active vulnerability assessment processes for Applicable 24 months since the active vulnerability more than 39 months, but less Systems, but has last assessment on one assessment processes than 42 months, since the last performed an active of its applicable BES for Applicable Systems, active assessment on one of its vulnerability assessment Cyber Systems. (3.1) but has performed an applicable BES Cyber Systems. more than 42 months, but OR active vulnerability (3.2) less than 45 months, since assessment more than the last active assessment The Responsible Entity 36 months, but less than on one of its applicable has implemented one 39 months, since the BES Cyber Systems. (3.2) or more documented last active assessment active vulnerability on one of its applicable assessment processes for Applicable Systems, but has
once every 35 calendar days but did not identify, assess, or correct the deficiencies. (2.1) CIP-010-1 R3. Each Responsible Entity shall implement one or more documented processes that collectively include each of the applicable requirement parts in CIP‐010‐1 Table R3– Vulnerability Assessments. The Responsible Entity has implemented one or more documented vulnerability assessment processes for each of its applicable BES Cyber Systems, but has performed a vulnerability assessment more than 15 months, but less than 18 months, since the last assessment on one of its applicable BES Cyber Systems. (3.1) OR The Responsible Entity has implemented one or more documented active vulnerability assessment processes for Applicable Systems, but has performed an active vulnerability assessment more than 36 months, but less than 39 months, since the last active assessment on one of its applicable The Responsible Entity has implemented one or more documented vulnerability assessment processes for each of its applicable BES Cyber Systems, but has performed a vulnerability assessment more than 18 months, but less than 21, months since the last assessment on one of its applicable BES Cyber Systems. (3.1) OR The Responsible Entity has implemented one or more documented active vulnerability assessment processes for Applicable Systems, but has performed an active vulnerability assessment more than 39 months, but less than 42 months, since the last active assessment on one of its applicable BES Cyber Systems. (3.2) The Responsible Entity has implemented one or more documented vulnerability assessment processes for each of its applicable BES Cyber Systems, but has performed a vulnerability assessment more than 21 months, but less than 24 months, since the last assessment on one of its applicable BES Cyber Systems. (3.1) OR The Responsible Entity has implemented one or more documented active vulnerability assessment processes for Applicable Systems, but has performed an active vulnerability assessment more than 42 months, but less than 45 months, since the last active assessment on one of its applicable BES Cyber Systems. (3.2) The Responsible Entity has not implemented any vulnerability assessment processes for one of its applicable BES Cyber Systems. (R3) OR The Responsible Entity has implemented one or more documented vulnerability assessment processes for each of its applicable BES Cyber Systems, but has performed a vulnerability assessment more than 24 months since the last assessment on one of its applicable BES Cyber Systems. (3.1) OR The Responsible Entity has implemented one or more documented active vulnerability assessment processes for Applicable Systems, but has
VSL_Matrix_Complete_2016_01_27.docx