ensure that the information is that is stored on backup available. Testing can be media has not been completed off site. tested at least annually to ensure that the information is available. R1. Each Responsible Entity shall CIP-009-5 N/A The Responsible Entity has The Responsible Entity The Responsible Entity have one or more documented developed recovery plan(s), but has developed recovery has not created recovery plans that collectively the plan(s) do not address one plan(s), but the plan(s) do recovery plan(s) for include each of the applicable of the requirements included in not address two of the BES Cyber Systems. requirement parts in CIP‐009‐5 Parts 1.2 through 1.5. requirements included in OR Table R1 Recovery Plan – Parts 1.2 through 1.5. Specifications. The Responsible Entity has created recovery plan(s) for BES Cyber Systems, but the plan(s) does not address the conditions for activation in Part 1.1. OR The Responsible Entity has created recovery plan(s) for BES Cyber Systems, but the plan(s) does not address three or more of the requirements in Parts 1.2 through 1.5. R2. Each Responsible Entity shall CIP-009-5 The Responsible Entity The Responsible Entity has not The Responsible Entity The Responsible Entity implement, in a manner that has not tested the tested the recovery plan(s) has not tested the has not tested the identifies, assesses, and corrects recovery plan(s) within 16 calendar months, not recovery plan(s) recovery plan(s) deficiencies, its documented according to R2 Part 2.1 exceeding 17 calendar months according to R2 Part 2.1 according to R2 Part recovery plan(s) to collectively within 15 calendar between tests of the plan, and within 17 calendar 2.1 within 18 calendar include each of the applicable months, not exceeding when tested, any deficiencies months, not exceeding 18 months between tests requirement parts in CIP‐009‐5 16 calendar months calendar months between of the plan. (2.1) Table R2 Recovery Plan –
ensure that the information is available. Testing can be completed off site. that is stored on backup media has not been tested at least annually to ensure that the information is available. CIP-009-5 R1. Each Responsible Entity shall have one or more documented recovery plans that collectively include each of the applicable requirement parts in CIP‐009‐5 Table R1 – Recovery Plan Specifications. N/A The Responsible Entity has developed recovery plan(s), but the plan(s) do not address one of the requirements included in Parts 1.2 through 1.5. The Responsible Entity has developed recovery plan(s), but the plan(s) do not address two of the requirements included in Parts 1.2 through 1.5. The Responsible Entity has not created recovery plan(s) for BES Cyber Systems. OR The Responsible Entity has created recovery plan(s) for BES Cyber Systems, but the plan(s) does not address the conditions for activation in Part 1.1. OR The Responsible Entity has created recovery plan(s) for BES Cyber Systems, but the plan(s) does not address three or more of the requirements in Parts 1.2 through 1.5. CIP-009-5 R2. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, its documented recovery plan(s) to collectively include each of the applicable requirement parts in CIP‐009‐5 Table R2 – Recovery Plan The Responsible Entity has not tested the recovery plan(s) according to R2 Part 2.1 within 15 calendar months, not exceeding 16 calendar months The Responsible Entity has not tested the recovery plan(s) within 16 calendar months, not exceeding 17 calendar months between tests of the plan, and when tested, any deficiencies The Responsible Entity has not tested the recovery plan(s) according to R2 Part 2.1 within 17 calendar months, not exceeding 18 calendar months between The Responsible Entity has not tested the recovery plan(s) according to R2 Part 2.1 within 18 calendar months between tests of the plan. (2.1)
VSL_Matrix_Complete_2016_01_27.docx