Part 2.3 in Table R2 Recovery Plan Implementation AR2 Part 2.3 Please – For each recovery plan, verify either: provide: and Testing the Responsible Entity has tested each of the recovery plans referenced in Applicable Systems Evidence that the Requirement R1 at least once every 36 High Impact BES cyber systems recovery plan(s) months through an operational exercise pertaining to of the recovery plans in an environment Requirements requirement R2 Part 2.3 representative of the production Test each of the recovery referenced in requirement R1 have been environment; or at least once every 36 months through an operational implemented. the Responsible Entity has performed exercise of the recovery plans in an environment an actual recovery response. representative of the production environment. An actual recovery response may substitute for an operational exercise. Measures Examples of evidence may include, but are not limited to, dated documentation of: an operational exercise at least once every 36 months between exercises, that demonstrates recovery in a representative environment; or an actual recovery response that occurred within the 36 months timeframe that exercised the recovery Findings
Part 2.3 in Table R2 – Recovery Plan Implementation and Testing Applicable Systems High Impact BES cyber systems Requirements Test each of the recovery referenced in requirement R1 at least once every 36 months through an operational exercise of the recovery plans in an environment representative of the production environment. An actual recovery response may substitute for an operational exercise. Measures Examples of evidence may include, but are not limited to, dated documentation of: an operational exercise at least once every 36 months between exercises, that demonstrates recovery in a representative environment; or an actual recovery response that occurred within the 36 months timeframe that exercised the recovery AR2 Part 2.3 Please provide: Evidence that the recovery plan(s) pertaining to requirement R2 Part 2.3 have been implemented. For each recovery plan, verify either: the Responsible Entity has tested each of the recovery plans referenced in Requirement R1 at least once every 36 months through an operational exercise of the recovery plans in an environment representative of the production environment; or the Responsible Entity has performed an actual recovery response. Findings
CIP-009-AB-5-RSAW.docx