deficiencies but required controls were did not assess or not adversely affected correct the following the change. deficiencies. (1.3) (1.4.2 & 1.4.3) OR OR The Responsible The Responsible Entity Entity has a does not have a process process(es) to for testing changes in update baseline an environment that configurations models the baseline within 30 calendar configuration prior to days of completing implementing a change a change(s) that that deviates from deviates from the baseline configuration. existing baseline (1.5.1) configuration but OR did not identify, assess, or correct The Responsible Entity the deficiencies. does not have a process (1.3) to document the test results and, if using a OR test environment, The Responsible document the Entity has a differences between the process(es) to test and production verify that required environments. (1.5.2) security controls in CIP-005 and are not adversely affected by a change(s) that deviates from the existing baseline configuration and identified deficiencies in required controls,
deficiencies but did not assess or correct the deficiencies. (1.3) OR The Responsible Entity has a process(es) to update baseline configurations within 30 calendar days of completing a change(s) that deviates from the existing baseline configuration but did not identify, assess, or correct the deficiencies. (1.3) OR The Responsible Entity has a process(es) to verify that required security controls in CIP-005 and are not adversely affected by a change(s) that deviates from the existing baseline configuration and identified deficiencies in required controls, required controls were not adversely affected following the change. (1.4.2 & 1.4.3) OR The Responsible Entity does not have a process for testing changes in an environment that models the baseline configuration prior to implementing a change that deviates from baseline configuration. (1.5.1) OR The Responsible Entity does not have a process to document the test results and, if using a test environment, document the differences between the test and production environments. (1.5.2)
VSL_Matrix_Complete_2016_01_01.docx