Part 1.5 in AR1 Part 1.5 Please Verify the Responsible Entity has documented Table R1 Physical Security Plan provide: one or more physical security plans to issue an – alarm or alert in response to detected Applicable Systems unauthorized access through a physical access (i) One or more High Impact BES cyber systems and their point into a physical security perimeter to the documented physical associated: personnel identified in the BES cyber security security plans pertaining 1. electronic access control or monitoring Incident response plan within 15 minutes of to requirement R1 Part systems; and detection. 1.5. 2. protected cyber assets Medium Impact BES cyber systems with external and their associated: routable connectivity 1. electronic access control or monitoring systems; and 2. protected cyber assets Requirements (ii) Evidence that physical Verify that an alarm or alert is issued in response security plans pertaining to detected unauthorized access through a Issue an alarm or alert in response to detected to requirement R1 Part physical access point into a physical security unauthorized access through a physical access point 1.5 have been perimeter to the personnel identified in the BES into a physical security perimeter to the personnel implemented. cyber security incident response plan within 15 identified in the bulk electric system cyber security minutes of detection. response plan within 15 minutes of detection. incident Measures An example of evidence may include, but is not limited to, language in the physical security plan that describes the issuance of an alarm or alert in response to unauthorized access through a physical access control into a physical security perimeter and additional evidence that the alarm or alert was issued and communicated as identified in the bulk electric system cyber security incident response plan, such as manual or electronic alarm or alert logs, cell phone or pager logs, or other evidence that documents that the alarm or alert was generated and communicated.
Part 1.5 in Table R1 – Physical Security Plan Applicable Systems High Impact BES cyber systems and their associated: 1. electronic access control or monitoring systems; and 2. protected cyber assets Medium Impact BES cyber systems with external routable connectivity and their associated: 1. electronic access control or monitoring systems; and 2. protected cyber assets Requirements Issue an alarm or alert in response to detected unauthorized access through a physical access point into a physical security perimeter to the personnel identified in the bulk electric system cyber security incident response plan within 15 minutes of detection. Measures An example of evidence may include, but is not limited to, language in the physical security plan that describes the issuance of an alarm or alert in response to unauthorized access through a physical access control into a physical security perimeter and additional evidence that the alarm or alert was issued and communicated as identified in the bulk electric system cyber security incident response plan, such as manual or electronic alarm or alert logs, cell phone or pager logs, or other evidence that documents that the alarm or alert was generated and communicated. AR1 Part 1.5 Please provide: (i) One or more documented physical security plans pertaining to requirement R1 Part 1.5. Verify the Responsible Entity has documented one or more physical security plans to issue an alarm or alert in response to detected unauthorized access through a physical access point into a physical security perimeter to the personnel identified in the BES cyber security Incident response plan within 15 minutes of detection. (ii) Evidence that physical security plans pertaining to requirement R1 Part 1.5 have been implemented. Verify that an alarm or alert is issued in response to detected unauthorized access through a physical access point into a physical security perimeter to the personnel identified in the BES cyber security incident response plan within 15 minutes of detection.
CIP-006-AB-5-RSAW.docx