the ability to execute the plan: (3.2) Roles or responsibilities, or Responders, or Technology changes. R1. Each Responsible Entity shall CIP-009-6 N/A The Responsible Entity has The Responsible Entity The Responsible Entity have one or more documented developed recovery plan(s), but has developed recovery has not created recovery plan(s) that collectively the plan(s) do not address one plan(s), but the plan(s) do recovery plan(s) for include each of the applicable of the requirements included in not address two of the BES Cyber Systems. requirement parts in CIP-009-6 Parts 1.2 through 1.5. requirements included in OR Table R1 Recovery Plan – Parts 1.2 through 1.5. Specifications. The Responsible Entity [See Table R1 of the standard.] has created recovery plan(s) for BES Cyber Systems, but the plan(s) does not address the conditions for activation in Part 1.1. OR The Responsible Entity has created recovery plan(s) for BES Cyber Systems, but the plan(s) does not address three or more of the requirements in Parts 1.2 through 1.5. R2. Each Responsible Entity shall CIP-009-6 The Responsible The Responsible Entity has The Responsible Entity The Responsible implement its documented Entity has not tested not tested the recovery plan(s) has not tested the Entity has not tested recovery plan(s) to collectively the recovery plan(s) within 16 calendar months, not recovery plan(s) the recovery plan(s) include each of the applicable according to R2 Part exceeding 17 calendar months according to R2 Part 2.1 according to R2 Part requirement parts in CIP-009-6 2.1 within 15 calendar between tests of the plan. (2.1) within 17 calendar 2.1 within 18 calendar
the ability to execute the plan: (3.2) Roles or responsibilities, or Responders, or Technology changes. CIP-009-6 R1. Each Responsible Entity shall have one or more documented recovery plan(s) that collectively include each of the applicable requirement parts in CIP-009-6 Table R1 – Recovery Plan Specifications. [See Table R1 of the standard.] N/A The Responsible Entity has developed recovery plan(s), but the plan(s) do not address one of the requirements included in Parts 1.2 through 1.5. The Responsible Entity has developed recovery plan(s), but the plan(s) do not address two of the requirements included in Parts 1.2 through 1.5. The Responsible Entity has not created recovery plan(s) for BES Cyber Systems. OR The Responsible Entity has created recovery plan(s) for BES Cyber Systems, but the plan(s) does not address the conditions for activation in Part 1.1. OR The Responsible Entity has created recovery plan(s) for BES Cyber Systems, but the plan(s) does not address three or more of the requirements in Parts 1.2 through 1.5. CIP-009-6 R2. Each Responsible Entity shall implement its documented recovery plan(s) to collectively include each of the applicable requirement parts in CIP-009-6 The Responsible Entity has not tested the recovery plan(s) according to R2 Part 2.1 within 15 calendar The Responsible Entity has not tested the recovery plan(s) within 16 calendar months, not exceeding 17 calendar months between tests of the plan. (2.1) The Responsible Entity has not tested the recovery plan(s) according to R2 Part 2.1 within 17 calendar The Responsible Entity has not tested the recovery plan(s) according to R2 Part 2.1 within 18 calendar
VSL_Matrix_Complete_2016_01_27.docx