Part 2.2 in Verify the Responsible Entity has documented AR2. Part 2.2 Please one or more processes to evaluate security provide: Table R2 Security Patch Management – patches for applicability that have been released since the last evaluation from the source or One or more Applicable Systems sources identified in Part 2.1, at least once documented processes every 35 days. High Impact BES cyber systems and their associated: pertaining to requirement R2 Part electronic access control or monitoring systems; 2.2. physical access control systems; and protected cyber assets Medium Impact BES systems and their associated: electronic access control or monitoring systems; physical access control systems; and protected assets Requirements At least once every 35 evaluate security patches for days, applicability that have been released since the last evaluation from the source or sources identified in Part 2.1. Evidence that the For each identified patch source, verify that processes pertaining to security patches have been evaluated for requirement R2 Part applicability at least once every 35 days. 2.2 have been Measures implemented; including An example of evidence may include, but is not limited to, For each identified patch source, verify the the date when the an evaluation conducted by, referenced by, or on behalf of a results of the evaluations for applicability. evaluation was Responsible Entity of security‐related patches released by completed and the the documented sources at least once every 35 days. results of the evaluation during the audit period.
Part 2.2 in Table R2 – Security Patch Management Applicable Systems High Impact BES cyber systems and their associated: electronic access control or monitoring systems; physical access control systems; and protected cyber assets Medium Impact BES systems and their associated: electronic access control or monitoring systems; physical access control systems; and protected assets Requirements At least once every 35 days, evaluate security patches for applicability that have been released since the last evaluation from the source or sources identified in Part 2.1. Measures An example of evidence may include, but is not limited to, an evaluation conducted by, referenced by, or on behalf of a Responsible Entity of security‐related patches released by the documented sources at least once every 35 days. AR2. Part 2.2 Please provide: One or more documented processes pertaining to requirement R2 Part 2.2. Verify the Responsible Entity has documented one or more processes to evaluate security patches for applicability that have been released since the last evaluation from the source or sources identified in Part 2.1, at least once every 35 days. Evidence that the processes pertaining to requirement R2 Part 2.2 have been implemented; including the date when the evaluation was completed and the results of the evaluation during the audit period. For each identified patch source, verify that security patches have been evaluated for applicability at least once every 35 days. For each identified patch source, verify the results of the evaluations for applicability.
CIP-007-AB-5-RSAW.docx