and correct the assess, and correct the OR deficiencies. (5.2) deficiencies. (5.2) The Responsible OR Entity has implemented one The Responsible or more Entity has process(es) to implemented one change or more passwords for process(es) to shared accounts revoke the known to the access individual’s user upon to the designated termination storage locations action, for BES Cyber reassignment, or System transfer, but did Information but, not do so for for three or more within 30 individuals, did calendar days of not do so by the the date of end of the next termination calendar day action, following the reassignment, or effective date and transfer for one time of the or more termination action, individuals, and and did not did not identify, identify, assess, assess, and and correct the correct the deficiencies. (5.3) deficiencies. (5.5) OR The Responsible Entity has implemented one or more process(es) to determine and
OR The Responsible Entity has implemented one or more process(es) to change passwords for shared accounts known to the user upon termination action, reassignment, or transfer, but did not do so for within 30 calendar days of the date of termination action, reassignment, or transfer for one or more individuals, and did not identify, assess, and correct the deficiencies. (5.5) OR The Responsible Entity has implemented one or more process(es) to determine and and correct the deficiencies. (5.2) OR The Responsible Entity has implemented one or more process(es) to revoke the individual’s access to the designated storage locations for BES Cyber System Information but, for three or more individuals, did not do so by the end of the next calendar day following the effective date and time of the termination action, and did not identify, assess, and correct the deficiencies. (5.3) assess, and correct the deficiencies. (5.2)
VSL_Matrix_Complete_2016_01_01.docx