performed a The Responsible Entity has vulnerability vulnerability vulnerability implemented one or more assessment more assessment processes assessment more documented active vulnerability than 21 months, for each of its than 15 months, assessment processes for Applicable but less than 24 applicable BES Cyber but less than 18 Systems, but has performed an active months, since the Systems, but has months, since the vulnerability assessment more than last assessment on performed a last assessment 39 months, but less than 42 months, one of its vulnerability on one of its since the last active assessment on applicable BES assessment more than applicable BES one of its applicable BES Cyber Cyber Systems. 24 months since the Cyber Systems. Systems. (3.2) (3.1) last assessment on one (3.1) of its applicable BES OR Cyber Systems. (3.1) OR The Responsible OR The Responsible Entity has Entity has implemented one The Responsible Entity implemented one or more has implemented one or more documented active or more documented documented vulnerability active vulnerability active assessment assessment processes vulnerability processes for for Applicable assessment Applicable Systems, but has processes for Systems, but has performed an active Applicable performed an vulnerability Systems, but has active assessment more than performed an vulnerability 45 months since the active assessment more last active assessment vulnerability than 42 months, on one of its applicable assessment more but less than 45 BES Cyber than 36 months, months, since the Systems.(3.2) but less than 39 last active OR months, since the assessment on one last active of its applicable The Responsible Entity assessment on BES Cyber has implemented and one of its Systems. (3.2) documented one or applicable BES more vulnerability Cyber Systems. assessment processes (3.2) for each of its applicable BES Cyber Systems, but did not
performed a vulnerability assessment more than 15 months, but less than 18 months, since the last assessment on one of its applicable BES Cyber Systems. (3.1) OR The Responsible Entity has implemented one or more documented active vulnerability assessment processes for Applicable Systems, but has performed an active vulnerability assessment more than 36 months, but less than 39 months, since the last active assessment on one of its applicable BES Cyber Systems. (3.2) The Responsible Entity has implemented one or more documented active vulnerability assessment processes for Applicable Systems, but has performed an active vulnerability assessment more than 39 months, but less than 42 months, since the last active assessment on one of its applicable BES Cyber Systems. (3.2) vulnerability assessment more than 21 months, but less than 24 months, since the last assessment on one of its applicable BES Cyber Systems. (3.1) OR The Responsible Entity has implemented one or more documented active vulnerability assessment processes for Applicable Systems, but has performed an active vulnerability assessment more than 42 months, but less than 45 months, since the last active assessment on one of its applicable BES Cyber Systems. (3.2) vulnerability assessment processes for each of its applicable BES Cyber Systems, but has performed a vulnerability assessment more than 24 months since the last assessment on one of its applicable BES Cyber Systems. (3.1) OR The Responsible Entity has implemented one or more documented active vulnerability assessment processes for Applicable Systems, but has performed an active vulnerability assessment more than 45 months since the last active assessment on one of its applicable BES Cyber Systems.(3.2) OR The Responsible Entity has implemented and documented one or more vulnerability assessment processes for each of its applicable BES Cyber Systems, but did not
VSL_Matrix_Complete_2016_01_01.docx