and include, at a detailed in R2.2.1, minimum, the following required R2.2.2, R2.2.3, R2.2.4. items appropriate to personnel roles and responsibilities: R2.2.1. The proper use of Critical Cyber N/A N/A N/A N/A Assets; R2.2.2. Physical and electronic access N/A N/A N/A N/A controls to Critical Cyber Assets; R2.2.3. The proper handling of Critical N/A N/A N/A N/A Cyber Asset information; and, Action plans and procedures to R2.2.4. N/A N/A N/A N/A recover or re-establish Critical Cyber Assets and access thereto following a Cyber Security Incident. The Responsible Entity shall R2.3. N/A N/A The Responsible The Responsible Entity maintain documentation that Entity did did not maintain training is conducted at least maintain documentation that annually, including the date the documentation that training is conducted at training was completed and training is least annually, attendance records. conducted at least including the date the annually, but did training was completed not include and attendance records. attendance records. Personnel Risk Assessment R3. N/A The Responsible Entity has a The Responsible The Responsible Entity Responsible Entity shall personnel risk assessment program, Entity has a does not have a have a documented personnel as stated in R3, for personnel having personnel risk documented personnel risk assessment program, in authorized cyber or authorized assessment risk assessment accordance with federal, state, unescorted physical access, but the program as stated program, as stated in provincial, and local laws, and program is not documented. in R3, but R3, for personnel subject to existing collective conducted the having authorized bargaining unit agreements, for personnel risk cyber or authorized personnel having authorized assessment unescorted physical cyber or authorized unescorted pursuant to that access. physical access to Critical Cyber program after such Assets. A personnel risk
and include, at a minimum, the following required items appropriate to personnel roles and responsibilities: detailed in R2.2.1, R2.2.2, R2.2.3, R2.2.4. R2.2.1. The proper use of Critical Cyber Assets; N/A N/A N/A N/A R2.2.2. Physical and electronic access controls to Critical Cyber Assets; N/A N/A N/A N/A R2.2.3. The proper handling of Critical Cyber Asset information; and, N/A N/A N/A N/A R2.2.4. Action plans and procedures to recover or re-establish Critical Cyber Assets and access thereto following a Cyber Security Incident. N/A N/A N/A N/A R2.3. The Responsible Entity shall maintain documentation that training is conducted at least annually, including the date the training was completed and attendance records. N/A N/A The Responsible Entity did maintain documentation that training is conducted at least annually, but did not include attendance records. The Responsible Entity did not maintain documentation that training is conducted at least annually, including the date the training was completed and attendance records. R3. Personnel Risk Assessment Responsible Entity shall have a documented personnel risk assessment program, in accordance with federal, state, provincial, and local laws, and subject to existing collective bargaining unit agreements, for personnel having authorized cyber or authorized unescorted physical access to Critical Cyber Assets. A personnel risk N/A The Responsible Entity has a personnel risk assessment program, as stated in R3, for personnel having authorized cyber or authorized unescorted physical access, but the program is not documented. The Responsible Entity has a personnel risk assessment program as stated in R3, but conducted the personnel risk assessment pursuant to that program after such The Responsible Entity does not have a documented personnel risk assessment program, as stated in R3, for personnel having authorized cyber or authorized unescorted physical access.
VSL_Matrix_Complete_2016_01_01.docx