the senior manager, AND OR changes to the delegated authority are not documented within Changes to the thirty calendar days of delegated authority the effective date. are not documented within thirty calendar days of the effective date. CIP-003-3 R2.4 The senior manager or N/A N/A N/A The senior manager or delegate(s), shall authorize and delegate(s) did not document any exception from the authorize and requirements of the cyber document any security policy. exceptions from the requirements of the cyber security policy as required. Exceptions Instances where — CIP-003-3 R3. N/A N/A In Instances where In Instances where the the Responsible Entity cannot the Responsible Responsible Entity conform to its cyber security Entity cannot cannot conform to its policy must be documented as conform to its cyber security policy, exceptions and authorized by the cyber security in R1, exceptions were senior manager or delegate(s). policy, in R1, not documented. exceptions were (Retirement approved by FERC documented, but effective January 21, 2014) were not authorized by the senior manager or delegate(s). Exceptions to the Responsible CIP-003-3 R3.1. N/A N/A N/A Exceptions to the cyber security policy Entity’s Responsible Entity’s must be documented within thirty cyber security policy were not documented
the senior manager, OR Changes to the delegated authority are not documented within thirty calendar days of the effective date. AND changes to the delegated authority are not documented within thirty calendar days of the effective date. CIP-003-3 R2.4 The senior manager or delegate(s), shall authorize and document any exception from the requirements of the cyber security policy. N/A N/A N/A The senior manager or delegate(s) did not authorize and document any exceptions from the requirements of the cyber security policy as required. CIP-003-3 R3. Exceptions — Instances where the Responsible Entity cannot conform to its cyber security policy must be documented as exceptions and authorized by the senior manager or delegate(s). (Retirement approved by FERC effective January 21, 2014) N/A N/A In Instances where the Responsible Entity cannot conform to its cyber security policy, in R1, exceptions were documented, but were not authorized by the senior manager or delegate(s). In Instances where the Responsible Entity cannot conform to its cyber security policy, in R1, exceptions were not documented. CIP-003-3 R3.1. Exceptions to the Responsible Entity’s cyber security policy must be documented within thirty N/A N/A N/A Exceptions to the Responsible Entity’s cyber security policy were not documented
VSL_Matrix_Complete_2016_01_01.docx