ports used for network connectivity, console commands, or Removable Media are protected against use. Compliance Summary: Finding Summary: Primary Documents Supporting Findings: Auditor Notes: R2 Supporting Evidence and Documentation R2. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R2 – Security Patch Management. [Violation Risk Factor: Medium] [Time Horizon: Operations Planning]. M2. Evidence must include each of the applicable documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R2 – Security Patch Management and additional evidence to demonstrate implementation as described in the Measures column of the table. CIP-007-5 Table R2 – Security Patch Management Part Applicable Systems Requirements Measures 2.1 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA A patch management process for tracking, evaluating, and installing cyber security patches for applicable Cyber Assets. The tracking portion shall include the identification of a source or sources that the Responsible Entity tracks for the release of cyber security patches for applicable Cyber Assets that are updateable and for which a patching source exists. An example of evidence may include, but is not limited to, documentation of a patch management process and documentation or lists of sources that are monitored, whether on an individual BES Cyber System or Cyber Asset basis. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required):
The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 2.1 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more patch management processes for tracking, evaluating, and installing cyber security patches for Cyber Assets of Applicable Systems. Verify that the tracking portion of each patch management process includes the identification of a source or sources that the Responsible Entity tracks for the release of cyber security patches for Cyber Assets of Applicable Systems that are updateable and for which a patching source exists. For each applicable Cyber Asset, verify at least one of the following is true: The Responsible Entity has identified one or more patching sources; The Responsible Entity has documented that the Cyber Asset is not updateable; or The Responsible Entity has documented that no patching source exists. CIP-007-5 Table R2 – Security Patch Management Part Applicable Systems Requirements Measures 2.2 High Impact BES Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA At once every 35 calendar days, evaluate security patches for applicability that have been released since the last evaluation from the source or sources identified in Part 2.1. An example of evidence may include, but is not limited to, an evaluation conducted by, referenced by, or on behalf of a Responsible Entity of security-related patches released by the documented sources at least once every 35 calendar days. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement.
communication with its command and control servers and by preventing its spread to other systems. Then the malicious code can be removed at a later time such as a plant outage. CIP-007-5 Table R3 – Malicious Code Prevention Part Applicable Systems Requirements Measures 3.3 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA For those methods identified in Part 3.1 that use signatures or patterns, have a process for the update of the signatures or patterns. The process must address testing and installing the signatures or patterns. An example of evidence may include, but is not limited to, documentation showing the process used for the update of signatures or patterns. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 3.3 This section to be completed by the Compliance Monitor Administrator For those methods identified in Part 3.1 that use signatures or patterns, verify the Responsible Entity has documented one or more processes to update the signatures or patterns. The process must address testing and installing the signatures or patterns. For each method deployed to deter, detect, or prevent malicious code that uses signatures or patterns, verify the associated process addresses testing and installing updates to signatures or patterns.
For each method deployed to detect, or prevent malicious code that uses signatures or patterns, verify the associated process is implemented. Compliance Summary: Finding Summary: Primary Documents Supporting Findings: Auditor Notes: R4 Supporting Evidence and Documentation R4. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R4 – Security Event Monitoring. [Violation Risk Factor: Medium] [Time Horizon: Same Day Operations and Operations Assessment.] M4. Evidence must include each of the documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R4 – Security Event Monitoring and additional evidence to demonstrate implementation as described in the Measures column of the table. CIP-007-5 Table R4 – Security Event Monitoring Part Applicable Systems Requirements Measures 4.1 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Cyber Systems and their associated: PACS; and PCA Log events at the BES Cyber System level (per BES Cyber System capability) or at the Cyber Asset level (per Cyber Asset capability) for identification of, and after-the-fact investigations of, Cyber Security Incidents that includes, as a minimum, each of the following types of events: Detected successful login attempts; Detected failed access attempts and failed login attempts; Detected malicious code. Examples of evidence may include, but are not limited to, a paper or system generated listing of event types for which the BES Cyber System is capable of detecting and, for generated events, is configured to log. This listing must include the required types of events. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement.
4.2 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: PACS; and PCA Generate alerts for security events that the Responsible Entity determines necessitates an alert, that includes, as a minimum, each of the following types of events (per Cyber Asset or BES Cyber System capability): Detected malicious code from Part 4.1; and Detected failure of Part 4.1 event logging. Examples of evidence may include, but are not limited to, or listing of security events that the Responsible Entity determined necessitate alerts, including paper or system generated list showing how alerts are configured. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 4.2 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more processes to generate alerts for security events that the Responsible Entity determines necessitates an alert, that includes, as a minimum, each of the following types of events (per Cyber Asset or BES Cyber System capability): Detected malicious code from Part 4.1; and detected failure of Part 4.1 event logging. Verify the Responsible Entity has determined the security events that necessitate an alert. Verify the security events determined to necessitate an alert include, at a minimum: Detected malicious code; and
CIP-007-5 Table R5 – System Access Control Part Applicable Systems Requirements Measures 5.4 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Change known default passwords, per Cyber Asset capability Examples of evidence may include, but are not limited to: Records of a procedure that passwords are changed when new devices are in production; or Documentation in system manuals or other vendor documents showing default vendor passwords were generated pseudo-randomly and are thereby unique to the device. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 5.4 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more processes to change known default passwords, per Cyber Asset capability. For Cyber Assets of Applicable Systems with the capability to change default passwords, verify the Responsible Entity has changed the known default passwords. For Assets of Applicable Systems that do not have the capability to change default passwords, verify the incapability to do so. CIP-007-5 R5 – System Access Control
documented one or more processes to either technically or procedurally enforce the following password parameters: Password length that is, at least, the lesser of eight characters or the maximum length supported by the Cyber Asset; and minimum password complexity that is the lesser of or more different types of characters (e.g., uppercase alphabetic, lowercase alphabetic, numeric, non-alphanumeric) or the maximum complexity supported by the Cyber Asset. For each Asset of Applicable Systems, for password-only authentication for interactive user access, verify password length is by either technical or procedural methods, per 5.5.1. For each Cyber Asset of Applicable Systems, for password-only authentication for interactive user access, verify password complexity is enforced by either technical or procedural methods, per 5.5.2. Note to Auditor: This Part does not apply to multi-factor authentication. CIP-007-5 Table R5 – System Access Control Part Applicable Systems Requirements Measures 5.6 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: PACS; and PCA Where technically feasible, for password-only authentication for interactive user access, either technically or procedurally enforce password changes or an obligation to change the password at least once every 15 calendar months. Examples of evidence may include, but are not limited to: System-generated reports or screen-shots of the periodicity of changing passwords; or Attestations that include a reference to the documented procedures that were followed. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document