Part 2.2 in AR2 Part 2.2 Please Verify the Responsible Entity has documented provide: one or more visitor control programs to require Table R2 Visitor Control Program – manual or automated logging of visitor entry (i) One or more into and exit from the physical security Applicable Systems documented visitor perimeter that includes date and time of the High Impact BES cyber systems and their control programs initial entry and last exit, the visitor’s name, and associated: pertaining to the name of an individual point of contact 1. electronic access control or monitoring requirement R2 Part responsible for the visitor, except during CIP systems; and 2.2. exceptional circumstances. 2. protected cyber assets Medium Impact with BES cyber systems external routable connectivity and their associated: 1. electronic access control or monitoring systems; and 2. protected cyber assets Requirements Require manual or automated logging of visitor entry into and exit from the physical security perimeter that includes date and time of the initial entry and last exit, the visitor’s name, and the name of an individual point of contact responsible for the visitor, except during CIP exceptional circumstances. (ii) Evidence that visitor Verify that the Responsible Entity performs control programs manual or automated logging of visitor into Measures pertaining to and exit from the physical security perimeter An example of evidence may include, but is not requirement R2 Part that includes date and time of the initial entry limited to, language in a visitor control program that 2.2 have been and last exit, the visitor’s name, and the name requires continuous escorted access of visitors within implemented. of an individual point of contact responsible for physical security perimeters and additional the visitor, except during CIP exceptional evidence to demonstrate that the process was circumstances. implemented, such as dated visitor logs that include the required information. If the Responsible Entity has experienced an exception for CIP exceptional circumstances, verify the Responsible Entity has adhered to any applicable cyber security policies.
Part 2.2 in Table R2 – Visitor Control Program Applicable Systems High Impact BES cyber systems and their associated: 1. electronic access control or monitoring systems; and 2. protected cyber assets Medium Impact BES cyber systems with external routable connectivity and their associated: 1. electronic access control or monitoring systems; and 2. protected cyber assets Requirements Require manual or automated logging of visitor entry into and exit from the physical security perimeter that includes date and time of the initial entry and last exit, the visitor’s name, and the name of an individual point of contact responsible for the visitor, except during CIP exceptional circumstances. Measures An example of evidence may include, but is not limited to, language in a visitor control program that requires continuous escorted access of visitors within physical security perimeters and additional evidence to demonstrate that the process was implemented, such as dated visitor logs that include the required information. AR2 Part 2.2 Please provide: (i) One or more documented visitor control programs pertaining to requirement R2 Part 2.2. Verify the Responsible Entity has documented one or more visitor control programs to require manual or automated logging of visitor entry into and exit from the physical security perimeter that includes date and time of the initial entry and last exit, the visitor’s name, and the name of an individual point of contact responsible for the visitor, except during CIP exceptional circumstances. (ii) Evidence that visitor control programs pertaining to requirement R2 Part 2.2 have been implemented. Verify that the Responsible Entity performs manual or automated logging of visitor into and exit from the physical security perimeter that includes date and time of the initial entry and last exit, the visitor’s name, and the name of an individual point of contact responsible for the visitor, except during CIP exceptional circumstances. If the Responsible Entity has experienced an exception for CIP exceptional circumstances, verify the Responsible Entity has adhered to any applicable cyber security policies.
CIP-006-AB-5-RSAW.docx