Part 2.3 in A2 Part 2.3 Please Verify the Responsible Entity has documented provide: one or more visitor control programs to retain R2 Visitor Control Program – visitor logs for at least ninety days. (i) One or more Applicable systems documented visitor High Impact BES systems and their associated: control programs 1. electronic access control or monitoring pertaining to systems; and requirement R2 Part 2. protected assets 2.3. Medium Impact BES systems with external and their associated: routable connectivity 1. electronic access control or monitoring systems; and 2. protected cyber assets Requirements Retain visitor logs for at least ninety days. Measures An example of evidence may include, but is not limited to, documentation showing logs have been retained for at ninety days. (ii) Evidence that visitor Verify that visitor logs are retained for at least control programs ninety days. pertaining to requirement R2 Part 2.3 have been implemented. Findings
Part 2.3 in R2 – Visitor Control Program Applicable systems High Impact BES systems and their associated: 1. electronic access control or monitoring systems; and 2. protected assets Medium Impact BES systems with external routable connectivity and their associated: 1. electronic access control or monitoring systems; and 2. protected cyber assets Requirements Retain visitor logs for at least ninety days. Measures An example of evidence may include, but is not limited to, documentation showing logs have been retained for at ninety days. A2 Part 2.3 Please provide: (i) One or more documented visitor control programs pertaining to requirement R2 Part 2.3. Verify the Responsible Entity has documented one or more visitor control programs to retain visitor logs for at least ninety days. (ii) Evidence that visitor control programs pertaining to requirement R2 Part 2.3 have been implemented. Verify that visitor logs are retained for at least ninety days. Findings
CIP-006-AB-5-RSAW.docx