R2 Part 2.3 CIP-007-6 Table R2 – Security Patch Management Part Applicable Systems Requirements Measures 2.3 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Cyber Systems and their associated: PACS; and PCA For applicable patches identified in Part 2.2, within 35 calendar days of the evaluation completion, take one of the following actions: Apply the applicable patches; or Create a dated mitigation plan; or Revise an existing mitigation plan. Mitigation plans shall include the Responsible Entity’s planned actions to mitigate the vulnerabilities addressed by each security patch and a timeframe to complete these mitigations. Examples of evidence may include, but are not limited to: Records of the installation of the (e.g., exports from automated patch management tools that provide installation date, verification of BES Cyber System Component software revision, or registry exports that show software has been installed); or A dated plan showing when and how the vulnerability will be addressed, to include documentation of the actions to be taken by the Responsible Entity to mitigate the vulnerabilities addressed by the security patch and a timeframe for the completion of these mitigations. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document
4.1 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Systems and their associated: EACMS; PACS; and PCA Log events at the BES Cyber System level (per BES Cyber System capability) or at the Cyber Asset level (per Cyber Asset capability) for identification of, and after-the-fact investigations of, Cyber Security Incidents that includes, as a minimum, each of the following types of events: Detected successful login attempts; Detected failed access attempts and failed login attempts; Detected malicious code. Examples of evidence may include, but are not limited to, a paper or system generated listing of event types for which the BES Cyber System is capable of detecting and, for generated events, is configured to log. This listing must include the required types of events. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-007-6, R4, Part 4.1 This section to be completed by the Compliance Enforcement Authority
4.3 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Cyber Systems at Control Centers and their associated: EACMS; PACS; and PCA Where technically feasible, retain applicable event logs identified in Part 4.1 for at least the last 90 consecutive calendar days except under CIP Exceptional Circumstances. Examples of evidence may include, but are not limited to, documentation of the log retention process and paper or system generated reports showing log retention configuration set at 90 days or greater. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-007-6, R4, Part 4.3 This section to be completed by the Compliance Enforcement Authority Verify the Responsible Entity has documented one or more processes to retain applicable event logs identified in Part 4.1 for at least the last 90 consecutive calendar days, where technically feasible, except under CIP Exceptional Circumstances. For each Applicable System, verify logs are retained for at least 90 consecutive calendar days
unless: An approved TFE covers the Applicable System; or A documented CIP Exceptional Circumstance exists. If a TFE is applicable to this Part, verify the compensating measures identified by the TFE are implemented. If the Responsible Entity has experienced an exception for CIP Exceptional Circumstances, verify the Responsible Entity has adhered to any applicable cyber security policies. Note to Auditor: The Responsible Entity may reference a separate set of documents to demonstrate its response to any requirements impacted by CIP Exceptional Circumstances. Auditor Notes: R4 P4.3 Notes Summary RSAW Box The Notes Summary for Report R4 Part 4.4 CIP-007-6 Table R4 – Security Event Monitoring Part Applicable Systems Requirements Measures 4.4 High Impact BES Cyber Systems and their associated: and PCA Review a summarization or sampling of logged events as determined by the Responsible Entity at intervals no greater than 15 calendar days to identify undetected Security Incidents. Examples of evidence may include, but are not limited to, documentation describing the review, any findings from the review (if any), and dated documentation showing the review occurred. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended.
inventoried all known enabled default or other generic account types. These account types may be identified by system, by groups of systems, by location, or by system type. Auditor Notes: R5 P5.2 Notes Summary RSAW Box The Notes Summary for Report R5 Part 5.3 CIP-007-6 Table R5 – System Access Control Part Applicable Systems Requirements Measures 5.3 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: EACMS; PACS; and PCA Identify individuals who have authorized access to shared accounts. An example of evidence may include, but is not limited to, listing of shared accounts and the individuals who have authorized access to each shared account. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required):