OR AND Changes to the delegated changes to the authority are not delegated authority are documented within thirty not documented within calendar days of the thirty calendar days of effective date. the effective date. CIP-003-3 R2.4 The senior manager or N/A N/A N/A The senior manager or delegate(s), shall authorize and delegate(s) did not document any exception from the authorize and requirements of the cyber document any security policy. exceptions from the requirements of the cyber security policy as required. Exceptions Instances where — CIP-003-3 R3. N/A N/A In Instances where the In Instances where the the Responsible Entity cannot Responsible Entity cannot Responsible Entity conform to its cyber security conform to its cyber cannot conform to its policy must be documented as security policy, in R1, cyber security policy, exceptions and authorized by the exceptions were in R1, exceptions were senior manager or delegate(s). documented, but were not not documented. authorized by the senior (Retirement approved by FERC manager or delegate(s). effective January 21, 2014) Exceptions to the Responsible CIP-003-3 R3.1. N/A N/A N/A Exceptions to the cyber security policy Entity’s Responsible Entity’s must be documented within thirty cyber security policy days of being approved by the were not documented senior manager or delegate(s). within 30 days of being approved by the senior (Retirement approved by FERC manager or delegate(s). effective January 21, 2014) Documented exceptions to the CIP-003-3 R3.2. N/A N/A The Responsible Entity The Responsible Entity cyber security policy must has a documented has a documented include an explanation as to why exception to the cyber exception to the cyber security policy in R1
OR Changes to the delegated authority are not documented within thirty calendar days of the effective date. AND changes to the delegated authority are not documented within thirty calendar days of the effective date. CIP-003-3 R2.4 The senior manager or delegate(s), shall authorize and document any exception from the requirements of the cyber security policy. N/A N/A N/A The senior manager or delegate(s) did not authorize and document any exceptions from the requirements of the cyber security policy as required. CIP-003-3 R3. Exceptions — Instances where the Responsible Entity cannot conform to its cyber security policy must be documented as exceptions and authorized by the senior manager or delegate(s). (Retirement approved by FERC effective January 21, 2014) N/A N/A In Instances where the Responsible Entity cannot conform to its cyber security policy, in R1, exceptions were documented, but were not authorized by the senior manager or delegate(s). In Instances where the Responsible Entity cannot conform to its cyber security policy, in R1, exceptions were not documented. CIP-003-3 R3.1. Exceptions to the Responsible Entity’s cyber security policy must be documented within thirty days of being approved by the senior manager or delegate(s). (Retirement approved by FERC effective January 21, 2014) N/A N/A N/A Exceptions to the Responsible Entity’s cyber security policy were not documented within 30 days of being approved by the senior manager or delegate(s). CIP-003-3 R3.2. Documented exceptions to the cyber security policy must include an explanation as to why N/A N/A The Responsible Entity has a documented exception to the cyber The Responsible Entity has a documented exception to the cyber security policy in R1
VSL_Matrix_Complete_2016_01_27.docx