2.1 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Systems and their associated: EACMS; PACS; and PCA A patch management process for tracking, evaluating, and installing cyber security patches for applicable Cyber Assets. The tracking portion shall include the identification of a source or sources that the Responsible Entity tracks for the release of cyber security patches for applicable Cyber Assets that are updateable and for which a patching source exists. An example of evidence may include, but is not limited to, documentation of a patch management process and documentation or lists of sources that are monitored, whether on an individual BES Cyber System or Cyber Asset basis. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 2.1 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more patch management processes for tracking, evaluating, and installing cyber security patches for Cyber Assets of Applicable Systems. Verify that the tracking portion of each patch management process includes the identification of a source or sources that the Responsible Entity tracks for the release of cyber security patches for Cyber Assets of Applicable Systems that are updateable and for which a patching source exists. For each applicable Cyber Asset, verify at least one of the following is true: The Responsible Entity has identified one or more patching sources;
Verify the Responsible Entity has determined the security events that necessitate an alert. Verify the security events determined to necessitate an alert include, at a minimum: Detected malicious code; and detected failure of logging. For each of the security events determined to necessitate an alert: If alerting is performed on a per Cyber Asset basis, is the Cyber Asset capable of alerting on the event type? If yes, verify either: Alerting is configured for the Cyber Asset for the event type; or an actual alert has been generated. If no, verify the inability of the Cyber Asset to generate an alert for the event type. If alerting is performed on a per BES System basis, is the BES Cyber System capable of alerting on the event type? If yes, verify either: Alerting is configured for the BES Cyber System for the event type; or an actual alert has been generated. If no, verify the inability of the BES Cyber System to generate an alert for the event type. CIP-007-6 Table R4 – Security Event Monitoring Part Applicable Systems Requirements Measures 4.3 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Systems at Control Centers and their associated: EACMS; PACS; and PCA technically feasible, retain applicable event logs identified in Part 4.1 for at least the last 90 consecutive calendar days except under CIP Exceptional Circumstances. Examples of evidence may include, but are not limited to, documentation of the event log retention process and paper or system generated reports showing log retention configuration set at 90 days or greater. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) Description of Applicability of Document