and Services but, where technically feasible, had one or more unneeded logical network accessible ports enabled but did not identify, assess, or correct the deficiencies. (1.1) Each Responsible Entity shall CIP-007-5 R2. The Responsible The Responsible Entity has The Responsible The Responsible Entity implement, in a manner that Entity has documented or implemented one or Entity has did not implement or identifies, assesses, and corrects documented and more process(es) for patch documented or document one or more deficiencies, one or more implemented one management but did not include any implemented one process(es) that documented processes that or more processes, including the identification or more included the applicable collectively include each of the process(es) to of sources, for tracking or evaluating process(es) for items in CIP-007-5 applicable requirement parts in evaluate cyber security patches for applicable patch management Table R2 and has CIP-007-5 Table R2 Security – uninstalled Cyber Assets and has identified but did not include identified deficiencies Patch Management. released security deficiencies but did not assess or any processes for but did not assess or patches for correct the deficiencies. (2.1) installing cyber correct the deficiencies. applicability but security patches (R2) OR did not evaluate for applicable OR The Responsible Entity has the security Cyber Assets and documented or implemented one or The Responsible Entity patches for has identified more process(es) for patch did not implement or applicability deficiencies but management but did not include any document one or more within 35 did not assess or processes, including the identification process(es) that calendar days but correct the of sources, for tracking, or included the applicable less than 50 deficiencies. (2.1) evaluating cyber security patches for items in CIP-007-5 calendar days of OR applicable Cyber Assets but did not Table R2 but did not the last identify, assess, or correct the The Responsible identify, assess, or evaluation for the deficiencies. (2.1) Entity has correct the deficiencies. source or sources documented or (R2) OR identified and implemented one OR has identified The Responsible Entity has or more deficiencies but documented and implemented one or The Responsible Entity process(es) for did not assess or more process(es) to evaluate has documented or patch management correct the uninstalled released security patches implemented one or but did not include
and Services but, where technically feasible, had one or more unneeded logical network accessible ports enabled but did not identify, assess, or correct the deficiencies. (1.1) CIP-007-5 R2. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R2 – Security Patch Management. The Responsible Entity has documented and implemented one or more process(es) to evaluate uninstalled released security patches for applicability but did not evaluate the security patches for applicability within 35 calendar days but less than 50 calendar days of the last evaluation for the source or sources identified and has identified deficiencies but did not assess or correct the The Responsible Entity has documented or implemented one or more process(es) for patch management but did not include any processes, including the identification of sources, for tracking or evaluating cyber security patches for applicable Cyber Assets and has identified deficiencies but did not assess or correct the deficiencies. (2.1) OR The Responsible Entity has documented or implemented one or more process(es) for patch management but did not include any processes, including the identification of sources, for tracking, or evaluating cyber security patches for applicable Cyber Assets but did not identify, assess, or correct the deficiencies. (2.1) OR The Responsible Entity has documented and implemented one or more process(es) to evaluate uninstalled released security patches The Responsible Entity has documented or implemented one or more process(es) for patch management but did not include any processes for installing cyber security patches for applicable Cyber Assets and has identified deficiencies but did not assess or correct the deficiencies. (2.1) OR The Responsible Entity has documented or implemented one or more process(es) for patch management but did not include The Responsible Entity did not implement or document one or more process(es) that included the applicable items in CIP-007-5 Table R2 and has identified deficiencies but did not assess or correct the deficiencies. (R2) OR The Responsible Entity did not implement or document one or more process(es) that included the applicable items in CIP-007-5 Table R2 but did not identify, assess, or correct the deficiencies. (R2) OR The Responsible Entity has documented or implemented one or
VSL_Matrix_Complete_2016_01_01.docx