prevention “signatures.” Account Management The — R5. N/A N/A N/A The Responsible Entity Responsible Entity shall did not document or establish, implement, and did not implement document technical and technical and procedural controls that enforce procedural controls that access authentication of, and enforce access accountability for, all user authentication of, and activity, and that minimize the accountability for, all risk of unauthorized system user activity. access. The Responsible Entity shall R5.1. N/A N/A N/A The Responsible Entity ensure that individual and shared did not ensure that system accounts and authorized individual and shared access permissions are consistent system accounts and with the concept of to “need authorized access with respect to work know” permissions are functions performed. consistent with the concept of to “need with respect to know” work functions performed. The Responsible Entity shall R5.1.1. N/A N/A N/A One or more user ensure that user accounts are accounts implemented implemented as approved by by the Responsible designated personnel. Refer to Entity were not Standard CIP-003-3 Requirement implemented as R5. approved by designated personnel. The Responsible Entity shall R5.1.2. N/A The Responsible Entity The Responsible Entity The Responsible Entity establish methods, processes, and generated logs with sufficient generated logs with did not generate logs of procedures that generate logs of detail to create historical audit insufficient detail to individual user account sufficient detail to create trails of individual user account create historical audit access activity. historical audit trails of access activity, however the trails of individual user individual user account access logs do not contain activity for account access activity. a minimum of 90 days.
prevention “signatures.” R5. Account Management — The Responsible Entity shall establish, implement, and document technical and procedural controls that enforce access authentication of, and accountability for, all user activity, and that minimize the risk of unauthorized system access. N/A N/A N/A The Responsible Entity did not document or did not implement technical and procedural controls that enforce access authentication of, and accountability for, all user activity. R5.1. The Responsible Entity shall ensure that individual and shared system accounts and authorized access permissions are consistent with the concept of “need to know” with respect to work functions performed. N/A N/A N/A The Responsible Entity did not ensure that individual and shared system accounts and authorized access permissions are consistent with the concept of “need to know” with respect to work functions performed. R5.1.1. The Responsible Entity shall ensure that user accounts are implemented as approved by designated personnel. Refer to Standard CIP-003-3 Requirement R5. N/A N/A N/A One or more user accounts implemented by the Responsible Entity were not implemented as approved by designated personnel. R5.1.2. The Responsible Entity shall establish methods, processes, and procedures that generate logs of sufficient detail to create historical audit trails of individual user account access N/A The Responsible Entity generated logs with sufficient detail to create historical audit trails of individual user account access activity, however the logs do not contain activity for a minimum of 90 days. The Responsible Entity generated logs with insufficient detail to create historical audit trails of individual user account access activity. The Responsible Entity did not generate logs of individual user account access activity.
VSL_Matrix_Complete_2016_01_27.docx