AR 5 Part 5.2 Please Verify the Responsible Entity has documented Part 5.2 in provide: one or more processes to identify and inventory Table R5 System Access Controls – all known enabled default or other generic account types, either by system, by groups of Applicable Systems One or more systems, by location, or by system type(s). High Impact BES cyber systems and their associated: documented processes electronic access control or monitoring pertaining to systems; requirement R5 Part physical access control systems; and 5.2. protected assets Medium Impact BES cyber systems and their associated: electronic access control or monitoring systems; physical access control systems; and protected assets Requirements Identify and inventory all known enabled default or other generic account types, either by system, by groups of systems, by location, or by system type(s). Measures An example of evidence may include, but is not limited to, a For each asset of an Applicable System, Evidence that the listing of accounts by account showing the enabled or verify the Responsible Entity has identified and processes pertaining to generic account types in use for the BES cyber system. inventoried all known enabled default or other requirement R5 Part generic account types. These account types 5.2 have been may be identified by system, by groups of implemented. systems, by location, or by system type.
Part 5.2 in Table R5 – System Access Controls Applicable Systems High Impact BES cyber systems and their associated: electronic access control or monitoring systems; physical access control systems; and protected assets Medium Impact BES cyber systems and their associated: electronic access control or monitoring systems; physical access control systems; and protected assets Requirements Identify and inventory all known enabled default or other generic account types, either by system, by groups of systems, by location, or by system type(s). Measures An example of evidence may include, but is not limited to, a listing of accounts by account showing the enabled or generic account types in use for the BES cyber system. AR 5 Part 5.2 Please provide: One or more documented processes pertaining to requirement R5 Part 5.2. Verify the Responsible Entity has documented one or more processes to identify and inventory all known enabled default or other generic account types, either by system, by groups of systems, by location, or by system type(s). Evidence that the processes pertaining to requirement R5 Part 5.2 have been implemented. For each asset of an Applicable System, verify the Responsible Entity has identified and inventoried all known enabled default or other generic account types. These account types may be identified by system, by groups of systems, by location, or by system type.
CIP-007-AB-5-RSAW.docx