action plan to remediate deficiencies identified during the assessment. Access Control The — CIP-003-3 R5. N/A N/A N/A The Responsible Entity Responsible Entity shall did not implement or document and implement a did not document a program for managing access to program for managing protected Critical Cyber Asset access to protected information. Critical Cyber Asset information. The Responsible Entity shall CIP-003-3 R5.1. N/A N/A The Responsible The Responsible Entity maintain a list of designated Entity maintained did not maintain a list personnel who are responsible a list of designated of designated personnel for authorizing logical or personnel for who are responsible for physical access to protected authorizing either authorizing logical or information. logical or physical physical access to access but not protected information. both. Personnel shall be identified by CIP-003-3 R5.1.1. N/A N/A The Responsible Personnel are not name, title, and the information Entity did identify identified by name, for which they are responsible for the personnel by title, or the information authorizing access. name, title, and the for which they are information for responsible for which they are authorizing access. responsible for authorizing access, but the business phone is missing. The list of personnel responsible CIP-003-3 R5.1.2. N/A N/A N/A The Responsible Entity for authorizing access to did not verify at least protected information shall be annually the list of verified at least annually. personnel responsible for authorizing access to protected information.
action plan to remediate deficiencies identified during the assessment. CIP-003-3 R5. Access Control — The Responsible Entity shall document and implement a program for managing access to protected Critical Cyber Asset information. N/A N/A N/A The Responsible Entity did not implement or did not document a program for managing access to protected Critical Cyber Asset information. CIP-003-3 R5.1. The Responsible Entity shall maintain a list of designated personnel who are responsible for authorizing logical or physical access to protected information. N/A N/A The Responsible Entity maintained a list of designated personnel for authorizing either logical or physical access but not both. The Responsible Entity did not maintain a list of designated personnel who are responsible for authorizing logical or physical access to protected information. CIP-003-3 R5.1.1. Personnel shall be identified by name, title, and the information for which they are responsible for authorizing access. N/A N/A The Responsible Entity did identify the personnel by name, title, and the information for which they are responsible for authorizing access, but the business phone is missing. Personnel are not identified by name, title, or the information for which they are responsible for authorizing access. CIP-003-3 R5.1.2. The list of personnel responsible for authorizing access to protected information shall be verified at least annually. N/A N/A N/A The Responsible Entity did not verify at least annually the list of personnel responsible for authorizing access to protected information.
VSL_Matrix_Complete_2016_01_01.docx