Part 2.3 in AR2 Part 2.3 Please Verify the Responsible Entity has documented one Table R2 Interactive Remote Access Management – provide: or more processes which require multi-factor authentication for all interactive remote access (i) One or more Applicable systems sessions. documented processes High Impact BES cyber systems and their associated: pertaining to protected cyber assets requirement R2 Part 2.3. Medium Impact BES cyber systems with external routable connectivity and their associated: protected cyber assets Requirements Require multi‐factor authentication for all interactive remote access sessions. Measures An example of evidence may include, but is not limited to, architecture documents detailing the authentication factors used. Examples of authenticators may include, but are not limited to, something the individual knows such as passwords or PINs. This does not include User ID; (ii) Evidence that the Verify all interactive remote access sessions something the individual has such as tokens, processes pertaining to require multi-factor authentication, or that an digital certificates, or smart cards; or requirement R2 Part approved Technical Feasibility Exception covers this something the individual is such as fingerprints, iris 2.3 have been scans, or other biometric characteristics. circumstance. implemented. If an approved Technical Feasibility Exception is applicable to this Part, verify the compensating measures identified by the approved Technical Feasibility Exception are implemented. Findings
Part 2.3 in Table R2 – Interactive Remote Access Management Applicable systems High Impact BES cyber systems and their associated: protected cyber assets Medium Impact BES cyber systems with external routable connectivity and their associated: protected cyber assets Requirements Require multi‐factor authentication for all interactive remote access sessions. Measures An example of evidence may include, but is not limited to, architecture documents detailing the authentication factors used. Examples of authenticators may include, but are not limited to, something the individual knows such as passwords or PINs. This does not include User ID; something the individual has such as tokens, digital certificates, or smart cards; or something the individual is such as fingerprints, iris scans, or other biometric characteristics. AR2 Part 2.3 Please provide: (i) One or more documented processes pertaining to requirement R2 Part 2.3. Verify the Responsible Entity has documented one or more processes which require multi-factor authentication for all interactive remote access sessions. (ii) Evidence that the processes pertaining to requirement R2 Part 2.3 have been implemented. Verify all interactive remote access sessions require multi-factor authentication, or that an approved Technical Feasibility Exception covers this circumstance. If an approved Technical Feasibility Exception is applicable to this Part, verify the compensating measures identified by the approved Technical Feasibility Exception are implemented. Findings
CIP-005-AB-5-RSAW.docx