changes or an assess or correct the obligation to deficiencies. (5.7) change the OR password within The Responsible Entity 17 calendar has implemented one months but less or more documented than or equal to 18 process(es) for System calendar months of Access Control but, the last password where technically change and did not feasible, did not either identify, assess, or limit the number of correct the unsuccessful deficiencies. (5.6) authentication attempts or generate alerts after a threshold of unsuccessful authentication attempts and did not identify, assess, or correct the deficiencies. (5.7) Cyber Security Incident CIP-008-3 R1. N/A N/A The Responsible The Responsible Entity Response Plan The — Entity has has not developed a Responsible Entity shall develop developed a Cyber Cyber Security Incident and maintain a Cyber Security Security Incident response plan that Incident response plan and response plan that addresses all of the implement the plan in response to addresses all of the components required Cyber Security Incidents. The components by R1.1 through R1.6, Cyber Security Incident response required by R1.1 or has not implemented plan shall address, at a minimum, through R1.6 but the plan in response to the following: has not maintained a Cyber Security the plan in Incident. accordance with those components. CIP-008-3 R1.1. Procedures to characterize and N/A N/A N/A N/A classify events as reportable Cyber Security Incidents.
changes or an obligation to change the password within 17 calendar months but less than or equal to 18 calendar months of the last password change and did not identify, assess, or correct the deficiencies. (5.6) assess or correct the deficiencies. (5.7) OR The Responsible Entity has implemented one or more documented process(es) for System Access Control but, where technically feasible, did not either limit the number of unsuccessful authentication attempts or generate alerts after a threshold of unsuccessful authentication attempts and did not identify, assess, or correct the deficiencies. (5.7) CIP-008-3 R1. Cyber Security Incident Response Plan — The Responsible Entity shall develop and maintain a Cyber Security Incident response plan and implement the plan in response to Cyber Security Incidents. The Cyber Security Incident response plan shall address, at a minimum, the following: N/A N/A The Responsible Entity has developed a Cyber Security Incident response plan that addresses all of the components required by R1.1 through R1.6 but has not maintained the plan in accordance with those components. The Responsible Entity has not developed a Cyber Security Incident response plan that addresses all of the components required by R1.1 through R1.6, or has not implemented the plan in response to a Cyber Security Incident. CIP-008-3 R1.1. Procedures to characterize and classify events as reportable Cyber Security Incidents. N/A N/A N/A N/A
VSL_Matrix_Complete_2016_01_01.docx