screen upon all interactive access attempts. Monitoring Electronic Access — R3. N/A N/A N/A The Responsible Entity The Responsible Entity shall did not implement or implement and document an did not document electronic or manual process(es) electronic or manual for monitoring and logging processes monitoring access at access points to the and logging access Electronic Security Perimeter(s) points. twenty-four hours a day, seven days a week. For dial-up accessible Critical R3.1. N/A N/A N/A Where technically Cyber Assets that use feasible, the routable protocols, the Responsible Entity did Responsible Entity shall not implement or did implement and document not document monitoring process(es) at each electronic or manual access point to the dial-up processes for device, where technically monitoring at one or feasible. more access points to dial-up devices. Where technically feasible, the R3.2. N/A N/A N/A Where technically security monitoring process(es) feasible, the shall detect and alert for attempts Responsible Entity did at or actual unauthorized not implement security accesses. These alerts shall monitoring process(es) provide for appropriate to detect and alert for notification to designated attempts at or actual response personnel. Where unauthorized accesses. alerting is not technically OR feasible, the Responsible Entity The above alerts do not shall review or otherwise assess provide for appropriate access logs for attempts at or notification to actual unauthorized accesses at designated response least every ninety calendar days. personnel.
screen upon all interactive access attempts. R3. Monitoring Electronic Access — The Responsible Entity shall implement and document an electronic or manual process(es) for monitoring and logging access at access points to the Electronic Security Perimeter(s) twenty-four hours a day, seven days a week. N/A N/A N/A The Responsible Entity did not implement or did not document electronic or manual processes monitoring and logging access points. R3.1. For dial-up accessible Critical Cyber Assets that use protocols, the Responsible Entity shall implement and document monitoring process(es) at each access point to the dial-up device, where technically feasible. N/A N/A N/A Where technically feasible, the Responsible Entity did not implement or did not document electronic or manual processes for monitoring at one or more access points to dial-up devices. R3.2. Where technically feasible, the security monitoring process(es) shall detect and alert for attempts at or actual unauthorized accesses. These alerts shall provide for appropriate notification to designated response personnel. Where alerting is not technically feasible, the Responsible Entity shall review or otherwise assess access logs for attempts at or actual unauthorized accesses at least every ninety calendar days. N/A N/A N/A Where technically feasible, the Responsible Entity did not implement security monitoring process(es) to detect and alert for attempts at or actual unauthorized accesses. OR The above alerts do not provide for appropriate notification to designated response personnel. routable
VSL_Matrix_Complete_2016_01_27.docx