but, in order to evaluating cyber security patches but, documented and delegate and has mitigate the in order to mitigate the vulnerabilities implemented one identified deficiencies vulnerabilities exposed by applicable security or more but did not assess or exposed by patches, did not apply the applicable process(es) to correct the deficiencies. applicable patches, create a dated mitigation evaluate (2.4) security patches, plan, or revise an existing mitigation uninstalled OR did not apply the plan within 50 calendar days but less released security The Responsible Entity applicable than 65 calendar days of the patches for documented a patches, create a evaluation completion but did not applicability but mitigation plan for an dated mitigation identify, assess, or correct the did not evaluate applicable cyber plan, or revise an deficiencies. (2.3) the security security patch and existing patches for documented a revision mitigation plan applicability or extension to the within 35 within 65 calendar timeframe but did not calendar days but days of the last obtain approval by the less than 50 evaluation for the CIP Senior Manager or calendar days of days source or delegate but did not the evaluation sources identified identify, assess, or completion and but did not correct the deficiencies. has identified identify, assess, or (2.4) deficiencies but correct the OR did not assess or deficiencies. (2.2) correct the The Responsible Entity OR deficiencies. documented a The Responsible (2.3) mitigation plan for an Entity has one or applicable cyber OR more documented security patch but did The Responsible process(es) for not implement the plan Entity has one or evaluating cyber as created or revised more security patches within the timeframe documented but, in order to specified in the plan process(es) for mitigate the and has identified evaluating cyber vulnerabilities deficiencies but did not security patches exposed by assess or correct the but, in order to applicable security deficiencies. (2.4) mitigate the patches, did not OR vulnerabilities apply the exposed by applicable patches, The Responsible Entity applicable create a dated documented a security patches, mitigation plan, or mitigation plan for an
but, in order to mitigate the vulnerabilities exposed by applicable security patches, did not apply the applicable patches, create a dated mitigation plan, or revise an existing mitigation plan within 35 calendar days but less than 50 calendar days of the evaluation completion and has identified deficiencies but did not assess or correct the deficiencies. (2.3) OR The Responsible Entity has one or more documented process(es) for evaluating cyber security patches but, in order to mitigate the vulnerabilities exposed by applicable security patches, evaluating cyber security patches but, in order to mitigate the vulnerabilities exposed by applicable security patches, did not apply the applicable patches, create a dated mitigation plan, or revise an existing mitigation plan within 50 calendar days but less than 65 calendar days of the evaluation completion but did not identify, assess, or correct the deficiencies. (2.3) documented and implemented one or more process(es) to evaluate uninstalled released security patches for applicability but did not evaluate the security patches for applicability within 65 calendar days of the last evaluation for the days source or sources identified but did not identify, assess, or correct the deficiencies. (2.2) OR The Responsible Entity has one or more documented process(es) for evaluating cyber security patches but, in order to mitigate the vulnerabilities exposed by applicable security patches, did not apply the applicable patches, create a dated mitigation plan, or delegate and has identified deficiencies but did not assess or correct the deficiencies. (2.4) OR The Responsible Entity documented a mitigation plan for an applicable cyber security patch and documented a revision or extension to the timeframe but did not obtain approval by the CIP Senior Manager or delegate but did not identify, assess, or correct the deficiencies. (2.4) OR The Responsible Entity documented a mitigation plan for an applicable cyber security patch but did not implement the plan as created or revised within the timeframe specified in the plan and has identified deficiencies but did not assess or correct the deficiencies. (2.4) OR The Responsible Entity documented a mitigation plan for an
VSL_Matrix_Complete_2016_01_01.docx