verify that access Information is correct the deficiencies. to the designated correct and (4.3) storage locations necessary within for BES Cyber 15 calendar OR System months of the The Responsible Entity Information is previous has implemented correct and verification but for processes to verify that necessary within more than 10% but access to the 15 calendar less than (or equal designated storage months of the to) 15% of its BES locations for BES previous Cyber System Cyber System verification but Information Information is correct for 5% or less of storage locations, and necessary within its BES Cyber privileges were 15 calendar months of System incorrect or the previous Information unnecessary, and verification but for storage locations, did not identify, more than 15% of its privileges were assess, and correct BES Cyber System incorrect or the deficiencies. Information storage unnecessary, and (4.4) locations, privileges did not identify, were incorrect or assess and unnecessary, and did correct the not identify, assess, and deficiencies. correct the deficiencies. (4.4) (4.4) R5. The Responsible The Responsible Entity has The Responsible Each Responsible Entity shall The Responsible Entity Entity has implemented one or more process(es) Entity has 5.1 implement, in a manner that has not implemented implemented one to remove the ability for unescorted implemented one identifies, assesses, and corrects any documented or more physical access and Interactive or more deficiencies, one or more program(s) for access process(es) to Remote Access upon a termination process(es) to documented access revocation revocation for revoke the action or complete the removal remove the ability programs that collectively electronic access, within 24 hours of the termination for unescorted individual’s include each of the applicable unescorted physical access to the action but did not initiate those physical access requirement parts in CIP-004-5.1 access, or BES Cyber designated removals for one individual, and did and Interactive Table R5 Access Revocation. – System Information storage locations not identify, assess, and correct the Remote Access storage locations. (R5) for BES Cyber deficiencies. (5.1) upon a termination System action or complete OR Information OR the removal within 24 hours of the
verify that access to the designated storage locations for BES Cyber System Information is correct and necessary within 15 calendar months of the previous verification but for 5% or less of its BES Cyber System Information storage locations, privileges were incorrect or unnecessary, and did not identify, assess and correct the deficiencies. (4.4) Information is correct and necessary within 15 calendar months of the previous verification but for more than 10% but less than (or equal to) 15% of its BES Cyber System Information storage locations, privileges were incorrect or unnecessary, and did not identify, assess, and correct the deficiencies. (4.4) correct the deficiencies. (4.3) OR The Responsible Entity has implemented processes to verify that access to the designated storage locations for BES Cyber System Information is correct and necessary within 15 calendar months of the previous verification but for more than 15% of its BES Cyber System Information storage locations, privileges were incorrect or unnecessary, and did not identify, assess, and correct the deficiencies. (4.4) R5. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented access revocation programs that collectively include each of the applicable requirement parts in CIP-004-5.1 Table R5 – Access Revocation. The Responsible Entity has implemented one or more process(es) to revoke the individual’s access to the designated storage locations for BES Cyber System Information The Responsible Entity has implemented one or more process(es) to remove the ability for unescorted physical access and Interactive Remote Access upon a termination action or complete the removal within 24 hours of the termination action but did not initiate those removals for one individual, and did not identify, assess, and correct the deficiencies. (5.1) OR The Responsible Entity has implemented one or more process(es) to remove the ability for unescorted physical access and Interactive Remote Access upon a termination action or complete the removal within 24 hours of the The Responsible Entity has not implemented any documented program(s) for access revocation for electronic access, unescorted physical access, or BES Cyber System Information storage locations. (R5) OR 5.1
VSL_Matrix_Complete_2016_01_01.docx