Transmission but did so more of the removal from the Operator that than 11 calendar identification in operates the days and less than Requirement R1 but primary control or equal to 13 did so more than 13 center of the calendar days calendar days removal from following the following the the verification or the verification or the identification in subsequent risk subsequent risk Requirement R1 assessment. assessment. but did so more OR than seven calendar days The Transmission and less than or Owner failed to notify equal to nine the Transmission calendar days Operator that operates following the the primary control verification or center of the removal the subsequent from the identification risk assessment. in Requirement R1. R4. Each Transmission Owner that The Responsible Entity conducted an The Responsible The Responsible Entity CIP-014-2 N/A identified a Transmission station, evaluation of the potential physical Entity conducted failed to conduct an Transmission substation, or a threats and vulnerabilities to each of an evaluation of evaluation of the primary control center in its Transmission station(s), the potential potential physical Requirement R1 and verified Transmission substation(s), and physical threats threats and according to Requirement R2, primary control center(s) identified in and vulnerabilities vulnerabilities to each and each Transmission Operator Requirement R1 but failed to to each of its of its Transmission notified by a Transmission consider one of Parts 4.1 through 4.3 Transmission station(s), Owner according to Requirement in the evaluation. station(s), Transmission R3, shall conduct an evaluation Transmission substation(s), and of the potential threats and substation(s), and primary control vulnerabilities of a physical primary control center(s) identified in attack to each of their respective center(s) identified Requirement R1; Transmission station(s), in Requirement R1 OR Transmission substation(s), and but failed to primary control center(s) consider two of The Responsible Entity identified in Requirement R1 and Parts 4.1 through conducted an evaluation of the
Transmission Operator that operates the primary control center of the removal from the identification in Requirement R1 but did so more than seven calendar days and less than or equal to nine calendar days following the verification or the subsequent risk assessment. but did so more than 11 calendar days and less than or equal to 13 calendar days following the verification or the subsequent risk assessment. of the removal from the identification in Requirement R1 but did so more than 13 calendar days following the verification or the subsequent risk assessment. OR The Transmission Owner failed to notify the Transmission Operator that operates the primary control center of the removal from the identification in Requirement R1. CIP-014-2 R4. Each Transmission Owner that identified a Transmission station, Transmission substation, or a primary control center in Requirement R1 and verified according to Requirement R2, and each Transmission Operator notified by a Transmission Owner according to Requirement R3, shall conduct an evaluation of the potential threats and vulnerabilities of a physical attack to each of their respective Transmission station(s), Transmission substation(s), and primary control center(s) identified in Requirement R1 and N/A The Responsible Entity conducted an evaluation of the potential physical threats and vulnerabilities to each of its Transmission station(s), Transmission substation(s), and primary control center(s) identified in Requirement R1 but failed to consider one of Parts 4.1 through 4.3 in the evaluation. The Responsible Entity conducted an evaluation of the potential physical threats and vulnerabilities to each of its Transmission station(s), Transmission substation(s), and primary control center(s) identified in Requirement R1 but failed to consider two of Parts 4.1 through The Responsible Entity failed to conduct an evaluation of the potential physical threats and vulnerabilities to each of its Transmission station(s), Transmission substation(s), and primary control center(s) identified in Requirement R1; OR The Responsible Entity conducted an evaluation of the
VSL_Matrix_Complete_2016_01_01.docx