previous review. The Responsible cyber security policies (R1) Entity did not for its high impact and complete its medium impact BES OR approval of the Cyber Systems as one or more required by R1 by the The Responsible documented cyber CIP Senior Manager or Entity did not security policies delegate within 18 complete its approval of the for its high impact calendar months of the and medium previous approval. (R1) one or more impact BES Cyber documented Systems as cyber security required by R1 by policies for its high impact and the CIP Senior Manager or medium impact delegate within 17 BES Cyber calendar months Systems as but did complete required by R1 this approval in by the CIP less than or equal Senior Manager to 18 calendar or delegate months of the within 15 previous approval. calendar months but did complete (R1) this approval in less than or equal to 16 calendar months of the previous approval. (R1) R2. Each Responsible Entity for its The Responsible Entity CIP-003-5 The Responsible The Responsible Entity documented The Responsible assets identified in CIP-002-5, did not document or Entity and implemented one or more cyber Entity documented Requirement R1, Part R1.3, shall implement any cyber documented and security policies for assets with a low and implemented implement, in a manner that security policies for implemented one impact rating that address only two of one or more cyber identifies, assesses, and corrects assets with a low or more cyber the topics as required by R2 and has security policies deficiencies, one or more impact rating that security policies identified deficiencies but did not for assets with a documented cyber security address the topics as for assets with a assess or correct the deficiencies. low impact rating policies that collectively address required by R2. (R2) low impact rating (R2) that address only the following topics, and review that address only one of the topics and obtain CIP Senior Manager
previous review. (R1) OR The Responsible Entity did not complete its approval of the one or more documented cyber security policies for its high impact and medium impact BES Cyber Systems as required by R1 by the CIP Senior Manager or delegate within 15 calendar months but did complete this approval in less than or equal to 16 calendar months of the previous approval. (R1) The Responsible Entity did not complete its approval of the one or more documented cyber security policies for its high impact and medium impact BES Cyber Systems as required by R1 by the CIP Senior Manager or delegate within 17 calendar months but did complete this approval in less than or equal to 18 calendar months of the previous approval. (R1) cyber security policies for its high impact and medium impact BES Cyber Systems as required by R1 by the CIP Senior Manager or delegate within 18 calendar months of the previous approval. (R1) CIP-003-5 R2. Each Responsible Entity for its assets identified in CIP-002-5, Requirement R1, Part R1.3, shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented cyber security policies that collectively address the following topics, and review and obtain CIP Senior Manager The Responsible Entity documented and implemented one or more cyber security policies for assets with a low impact rating that address only The Responsible Entity documented and implemented one or more cyber security policies for assets with a low impact rating that address only two of the topics as required by R2 and has identified deficiencies but did not assess or correct the deficiencies. (R2) The Responsible Entity documented and implemented one or more cyber security policies for assets with a low impact rating that address only one of the topics The Responsible Entity did not document or implement any cyber security policies for assets with a low impact rating that address the topics as required by R2. (R2)
VSL_Matrix_Complete_2016_01_01.docx