Cyber Assets and of malicious code, or Media, but failed to Removable Media, mitigation of the risk of implement mitigation of but failed to unauthorized use for Transient software vulnerabilities, document the Cyber Assets managed by the mitigation for the Removable Media Responsible Entity according introduction of sections according to to CIP-010-2, Requirement malicious code, or CIP-010-2, R4, Attachment 1, Sections mitigation of the risk of Requirement R4, 1.3, 1.4, and 1.5. (R4) unauthorized use for Attachment 1, Section Transient Cyber Assets OR 3. (R4) managed by the Responsible Entity The Responsible Entity OR documented its plan(s) for according to CIP-010-2, Requirement R4, The Responsible Transient Cyber Assets and Attachment 1, Sections Entity documented its Removable Media, but failed 1.3, 1.4, and 1.5. (R4) plan(s) for Transient to document mitigation of Cyber Assets and software vulnerabilities or OR Removable Media, mitigation for the introduction but failed to of malicious code for The Responsible Entity document Transient Cyber Assets documented its plan(s) authorization for managed by a party other than for Transient Cyber Transient Cyber the Responsible Entity Assets and Removable Assets managed by according to CIP-010-2, Media, but failed to the Responsible Requirement R4, Attachment implement mitigation of Entity according to 1, Sections 2.1, 2.2, and 2.3. software vulnerabilities CIP-010-2, (R4) or mitigation for the Requirement R4, introduction of Attachment 1, Section malicious code for 1.2. (R4) Transient Cyber Assets managed by a party other than the Responsible Entity according to CIP-010-2, Requirement R4, Attachment 1, Sections 2.1, 2.2, and 2.3. (R4) R1. Each Responsible Entity shall CIP-011-1 N/A The Responsible Entity The Responsible Entity implement, in a manner that has implemented a BES has not documented or identifies, assesses, and corrects Cyber System implemented a BES
Cyber Assets and Removable Media, but failed to document the Removable Media sections according to CIP-010-2, Requirement R4, Attachment 1, Section 3. (R4) OR The Responsible Entity documented its plan(s) for Transient Cyber Assets and Removable Media, but failed to document authorization for Transient Cyber Assets managed by the Responsible Entity according to CIP-010-2, Requirement R4, Attachment 1, Section 1.2. (R4) of malicious code, or mitigation of the risk of unauthorized use for Transient Cyber Assets managed by the Responsible Entity according to CIP-010-2, Requirement R4, Attachment 1, Sections 1.3, 1.4, and 1.5. (R4) OR The Responsible Entity documented its plan(s) for Transient Cyber Assets and Removable Media, but failed to document mitigation of software vulnerabilities or mitigation for the introduction of malicious code for Transient Cyber Assets managed by a party other than the Responsible Entity according to CIP-010-2, Requirement R4, Attachment 1, Sections 2.1, 2.2, and 2.3. (R4) Media, but failed to implement mitigation of software vulnerabilities, mitigation for the introduction of malicious code, or mitigation of the risk of unauthorized use for Transient Cyber Assets managed by the Responsible Entity according to CIP-010-2, Requirement R4, Attachment 1, Sections 1.3, 1.4, and 1.5. (R4) OR The Responsible Entity documented its plan(s) for Transient Cyber Assets and Removable Media, but failed to implement mitigation of software vulnerabilities or mitigation for the introduction of malicious code for Transient Cyber Assets managed by a party other than the Responsible Entity according to CIP-010-2, Requirement R4, Attachment 1, Sections 2.1, 2.2, and 2.3. (R4) CIP-011-1 R1. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects N/A The Responsible Entity has implemented a BES Cyber System The Responsible Entity has not documented or implemented a BES
VSL_Matrix_Complete_2016_01_27.docx