The Responsible Entity has tested the recovery plan(s) according to R2 Part 2.3 but did not identify, assess, or correct the deficiencies. (2.3) R3. Each Responsible Entity shall CIP-009-5 The Responsible Entity The Responsible Entity has not The Responsible Entity The Responsible Entity maintain each of its recovery has not notified each updated the recovery plan(s) has neither documented has neither documented plans in accordance with each of person or group with a based on any documented lessons learned nor lessons learned nor the applicable requirement parts defined role in the lessons learned within 90 and documented the absence documented the in CIP‐009‐5 Table R3 – recovery plan(s) of less than 120 calendar days of of any lessons learned absence of any lessons Recovery Plan Review, Update updates within 90 and each recovery plan test or within 90 and less than learned within 120 and Communication. less than 120 calendar actual recovery. (3.1.2) 120 calendar days of calendar days of each days of the update each recovery plan test or recovery plan test or OR being completed. actual recovery. (3.1.1) actual recovery. (3.1.1) (3.1.3) The Responsible Entity has not OR notified each person or group with a defined role in the The Responsible Entity recovery plan(s) of updates has not updated the within 120 calendar days of the recovery plan(s) based on update being completed. (3.1.3) any documented lessons learned within 120 OR calendar days of each recovery plan test or The Responsible Entity has not actual recovery. (3.1.2) updated the recovery plan(s) or notified each person or group OR with a defined role within 60 and less than 90 calendar days The Responsible Entity of any of the following changes has not updated the that the responsible entity recovery plan(s) or determines would impact the notified each person or ability to execute the plan: (3.2) group with a defined role within 90 calendar days of Roles or responsibilities, or any of the following Responders, or changes that the responsible entity Technology changes. determines would impact
The Responsible Entity has tested the recovery plan(s) according to R2 Part 2.3 but did not identify, assess, or correct the deficiencies. (2.3) CIP-009-5 R3. Each Responsible Entity shall maintain each of its recovery plans in accordance with each of the applicable requirement parts in CIP‐009‐5 Table R3 – Recovery Plan Review, Update and Communication. The Responsible Entity has not notified each person or group with a defined role in the recovery plan(s) of updates within 90 and less than 120 calendar days of the update being completed. (3.1.3) The Responsible Entity has not updated the recovery plan(s) based on any documented lessons learned within 90 and less than 120 calendar days of each recovery plan test or actual recovery. (3.1.2) OR The Responsible Entity has not notified each person or group with a defined role in the recovery plan(s) of updates within 120 calendar days of the update being completed. (3.1.3) OR The Responsible Entity has not updated the recovery plan(s) or notified each person or group with a defined role within 60 and less than 90 calendar days of any of the following changes that the responsible entity determines would impact the ability to execute the plan: (3.2) Roles or responsibilities, or Responders, or Technology changes. The Responsible Entity has neither documented lessons learned nor documented the absence of any lessons learned within 90 and less than 120 calendar days of each recovery plan test or actual recovery. (3.1.1) OR The Responsible Entity has not updated the recovery plan(s) based on any documented lessons learned within 120 calendar days of each recovery plan test or actual recovery. (3.1.2) OR The Responsible Entity has not updated the recovery plan(s) or notified each person or group with a defined role within 90 calendar days of any of the following changes that the responsible entity determines would impact The Responsible Entity has neither documented lessons learned nor documented the absence of any lessons learned within 120 calendar days of each recovery plan test or actual recovery. (3.1.1)
VSL_Matrix_Complete_2016_01_27.docx