being completed. The Responsible Entity has not OR actual recovery. (3.1.3) notified each person or group (3.1.1) The Responsible Entity with a defined role in the has not updated the recovery plan(s) of updates recovery plan(s) based on within 120 calendar days of the any documented lessons update being completed. (3.1.3) learned within 120 OR calendar days of each recovery plan test or The Responsible Entity has not actual recovery. (3.1.2) updated the recovery plan(s) or notified each person or group OR with a defined role within 60 The Responsible Entity and less than 90 calendar days has not updated the of any of the following changes recovery plan(s) or that the responsible entity notified each person or determines would impact the group with a defined role ability to execute the plan: (3.2) within 90 calendar days of Roles or responsibilities, or any of the following • Responders, or changes that the • Technology changes. responsible entity • determines would impact the ability to execute the plan: (3.2) Roles or • responsibilities, or Responders, or • Technology changes. • R1. Each Responsible Entity shall CIP-010-1 The Responsible Entity The Responsible Entity has The Responsible Entity The Responsible Entity implement, in a manner that has documented and documented and implemented a has documented and has not documented or identifies, assesses, and corrects implemented a configuration change implemented a implemented any deficiencies, one or more configuration change management process(es) that configuration change configuration change documented processes that management includes three of the management process(es) management collectively include each of the process(es) that required baseline items listed in that includes only two of process(es). (R1) applicable requirement parts in includes four of 1.1.1 through 1.1.5. (1.1) the required baseline OR CIP‐010‐1 Table R1 – the required baseline items listed in 1.1.1 OR Configuration Change items listed in 1.1.1 through 1.1.5. (1.1) The Responsible Entity Management. through 1.1.5. (1.1) has documented and
being completed. (3.1.3) The Responsible Entity has not notified each person or group with a defined role in the recovery plan(s) of updates within 120 calendar days of the update being completed. (3.1.3) OR The Responsible Entity has not updated the recovery plan(s) or notified each person or group with a defined role within 60 and less than 90 calendar days of any of the following changes that the responsible entity determines would impact the ability to execute the plan: (3.2) • Roles or responsibilities, or • Responders, or • Technology changes. OR The Responsible Entity has not updated the recovery plan(s) based on any documented lessons learned within 120 calendar days of each recovery plan test or actual recovery. (3.1.2) OR The Responsible Entity has not updated the recovery plan(s) or notified each person or group with a defined role within 90 calendar days of any of the following changes that the responsible entity determines would impact the ability to execute the plan: (3.2) • Roles or responsibilities, or • Responders, or • Technology changes. actual recovery. (3.1.1) CIP-010-1 R1. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented processes that collectively include each of the applicable requirement parts in CIP‐010‐1 Table R1 – Configuration Change Management. The Responsible Entity has documented and implemented a configuration change management process(es) that includes four of the required baseline items listed in 1.1.1 through 1.1.5. (1.1) The Responsible Entity has documented and implemented a configuration change management process(es) that includes three of the required baseline items listed in 1.1.1 through 1.1.5. (1.1) OR The Responsible Entity has documented and implemented a configuration change management process(es) that includes only two of the required baseline items listed in 1.1.1 through 1.1.5. (1.1) The Responsible Entity has not documented or implemented any configuration change management process(es). (R1) OR The Responsible Entity has documented and
VSL_Matrix_Complete_2016_01_27.docx