Security Incident occurs. Security Incidents. (2.2) (2.3) Each Responsible Entity shall The Responsible Entity The Responsible Entity has not The Responsible Entity The Responsible Entity CIP-008-5 R3. maintain each of its Cyber has not notified each updated the Cyber Security has neither documented has neither documented Security Incident response plans person or group with a Incident response plan on lessons learned nor lessons learned nor according to each of the defined role in the any documented lessons documented the absence documented the applicable requirement parts in Cyber Security Incident learned within 90 and less than of any lessons learned absence of any lessons response plan of 120 calendar days of a test or within 90 and less than learned within 120 CIP‐008‐5 Table R3 Cyber – updates to the Cyber actual incident response to a 120 calendar days of a calendar days of a test Security Incident Response Plan Security Incident Reportable Cyber Security test or actual incident or actual incident Review, Update, and response plan within Incident. (3.1.2) response to a Reportable response to a Communication. greater than 90 but less OR Cyber Security Incident. Reportable Cyber than 120 calendar days The Responsible Entity has not (3.1.1) Security Incident. of a test or actual notified each person or group OR (3.1.1) incident response to a with a defined role in the Cyber The Responsible Entity Reportable Cyber Security Incident response plan has not updated the Cyber Security Incident. of updates to the Cyber Security Incident response (3.1.3) Security Incident response plan plan based on any within 120 calendar days of a documented lessons test or actual incident response learned within 120 to a Reportable Cyber Security calendar days of a test or Incident. (3.1.3) actual incident response OR to a Reportable Cyber The Responsible Entity has not Security Incident. (3.1.2) updated the Cyber Security OR Incident response plan(s) or The Responsible Entity notified each person or group has not updated the Cyber with a defined role within 60 Security Incident response and less than 90 calendar days plan(s) or notified each of any of the following changes person or group with a that the responsible entity defined role within 90 determines would impact the calendar days of any of ability to execute the plan: (3.2) the following changes that Roles or responsibilities, or the responsible entity Cyber Security Incident determines would impact response groups or individuals, the ability to execute the or plan: (3.2) Technology changes. Roles or responsibilities, or
Security Incident occurs. (2.2) Security Incidents. (2.3) CIP-008-5 R3. Each Responsible Entity shall maintain each of its Cyber Security Incident response plans according to each of the applicable requirement parts in CIP‐008‐5 Table R3 – Cyber Security Incident Response Plan Review, Update, and Communication. The Responsible Entity has not notified each person or group with a defined role in the Cyber Security Incident response plan of updates to the Cyber Security Incident response plan within greater than 90 but less than 120 calendar days of a test or actual incident response to a Reportable Cyber Security Incident. (3.1.3) The Responsible Entity has not updated the Cyber Security Incident response plan on any documented lessons learned within 90 and less than 120 calendar days of a test or actual incident response to a Reportable Cyber Security Incident. (3.1.2) OR The Responsible Entity has not notified each person or group with a defined role in the Cyber Security Incident response plan of updates to the Cyber Security Incident response plan within 120 calendar days of a test or actual incident response to a Reportable Cyber Security Incident. (3.1.3) OR The Responsible Entity has not updated the Cyber Security Incident response plan(s) or notified each person or group with a defined role within 60 and less than 90 calendar days of any of the following changes that the responsible entity determines would impact the ability to execute the plan: (3.2) Roles or responsibilities, or Cyber Security Incident response groups or individuals, or Technology changes. The Responsible Entity has neither documented lessons learned nor documented the absence of any lessons learned within 90 and less than 120 calendar days of a test or actual incident response to a Reportable Cyber Security Incident. (3.1.1) OR The Responsible Entity has not updated the Cyber Security Incident response plan based on any documented lessons learned within 120 calendar days of a test or actual incident response to a Reportable Cyber Security Incident. (3.1.2) OR The Responsible Entity has not updated the Cyber Security Incident response plan(s) or notified each person or group with a defined role within 90 calendar days of any of the following changes that the responsible entity determines would impact the ability to execute the plan: (3.2) Roles or responsibilities, or The Responsible Entity has neither documented lessons learned nor documented the absence of any lessons learned within 120 calendar days of a test or actual incident response to a Reportable Cyber Security Incident. (3.1.1)
VSL_Matrix_Complete_2016_01_27.docx