The Responsible systems or controls Entity did not were not documented within thirty calendar document changes days of the change resulting from being completed. modifications to the systems or controls within thirty calendar days of the change being completed. Each Responsible Entity shall CIP-007-5 R1. N/A The Responsible Entity has The Responsible The Responsible Entity implement, in a manner that implemented and documented Entity has did not implement or identifies, assesses, and corrects processes for Ports and Services but implemented and document one or more deficiencies, one or more had no methods to protect against documented process(es) that documented processes that unnecessary physical input/output processes for included the applicable collectively include each of the ports used for network connectivity, determining items in CIP-007-5 applicable requirement parts in console commands, or removable necessary Ports Table R1 and has CIP-007-5 Table R1 Ports and – media and has identified deficiencies and Services but, identified deficiencies Services. but did not assess or correct the where technically but did not assess or deficiencies. (1.2) feasible, had one correct the deficiencies. or more unneeded (R1) OR logical network OR The Responsible Entity has accessible ports implemented and documented The Responsible Entity enabled and has processes for Ports and Services but did not implement or identified had no methods to protect against document one or more deficiencies but unnecessary physical input/output process(es) that did not assess or ports used for network connectivity, included the applicable correct the console commands, or removable items in CIP-007-5 deficiencies. (1.1) media but did not identify, assess, or Table R1 but did not OR correct the deficiencies. (1.2) identify, assess, or The Responsible correct the deficiencies. Entity has (R1) implemented and documented processes for determining necessary Ports
The Responsible Entity did not document changes resulting from modifications to the systems or controls within thirty calendar days of the change being completed. systems or controls were not documented within thirty calendar days of the change being completed. CIP-007-5 R1. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R1 – Ports and Services. N/A The Responsible Entity has implemented and documented processes for Ports and Services but had no methods to protect against unnecessary physical input/output ports used for network connectivity, console commands, or removable media and has identified deficiencies but did not assess or correct the deficiencies. (1.2) OR The Responsible Entity has implemented and documented processes for Ports and Services but had no methods to protect against unnecessary physical input/output ports used for network connectivity, console commands, or removable media but did not identify, assess, or correct the deficiencies. (1.2) The Responsible Entity has implemented and documented processes for determining necessary Ports and Services but, where technically feasible, had one or more unneeded logical network accessible ports enabled and has identified deficiencies but did not assess or correct the deficiencies. (1.1) OR The Responsible Entity has implemented and documented processes for determining necessary Ports The Responsible Entity did not implement or document one or more process(es) that included the applicable items in CIP-007-5 Table R1 and has identified deficiencies but did not assess or correct the deficiencies. (R1) OR The Responsible Entity did not implement or document one or more process(es) that included the applicable items in CIP-007-5 Table R1 but did not identify, assess, or correct the deficiencies. (R1)
VSL_Matrix_Complete_2016_01_01.docx