Identify subject matter expert(s) responsible for this Reliability Standard. Insert additional lines if necessary. Registered Entity Response (Required): SME Name Title Organization Requirement(s) R1 Supporting Evidence and Documentation R1. Each Responsible Entity shall implement one or more documented physical security plan(s) that collectively include all of the applicable requirement parts in CIP-006-6 Table R1 – Physical Security Plan. [Violation Risk Factor: Medium] [Time Horizon: Long Term Planning and Same Day Operations]. M1. Evidence must include each of the documented physical security plans that collectively include all of the applicable requirement parts in CIP-006-6 Table R1 – Physical Security Plan and additional evidence to demonstrate implementation of the plan or plans as described in the Measures column of the table. CIP-006-6 R1 – Physical Security Plan Part Applicable Systems Requirements Measures 1.1 Medium Impact BES Systems without External Routable Connectivity Physical Access Control Systems (PACS) associated with: High Impact BES Systems, or Medium Impact BES Cyber Systems with External Routable Connectivity Define operational or procedural controls to restrict physical access. An example of evidence may include, but is not limited to, documentation that operational or procedural controls exist. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement.
CIP-006-6 R1 – Physical Security Plan Part Applicable Systems Requirements Measures 1.5 High Impact BES Cyber Systems and their associated: EACMS; and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: EACMS; and PCA Issue an alarm or alert in response to detected unauthorized access through a physical access point into a Physical Security Perimeter to the personnel identified in the BES Cyber Security Incident response plan within 15 minutes of detection. An example of evidence may include, but is not limited to, language in the physical security plan that describes the issuance of an alarm or alert in response to unauthorized access through a physical access control into a Physical Security Perimeter and additional evidence that the alarm or alert was issued and communicated as identified in the BES Cyber Security Incident Response Plan, such as manual or electronic alarm or alert logs, cell phone or pager logs, or other evidence that documents that the alarm or alert was generated and communicated. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 1.5 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more physical security plans to issue an alarm or alert in response to detected unauthorized access through a physical access point into a Physical Security Perimeter to the personnel identified in the BES Cyber Security Incident response plan within 15 minutes of detection. Verify that an alarm or alert is issued in response to detected unauthorized access through a physical access point into a Physical Security Perimeter to the personnel identified in the BES Cyber Security Incident response plan within 15 minutes of detection.
CIP-006-6 Table R1 – Physical Security Plan Part Applicable Systems Requirements Measures 1.7 Physical Access Control Systems (PACS) associated with: High Impact BES Cyber Systems, or Medium Impact BES Cyber Systems with External Routable Connectivity Issue an alarm or alert in response to detected unauthorized physical access to a Physical Access Control System to the personnel identified in the BES Cyber Security Incident response plan within 15 minutes of the detection. An example of evidence may include, but is not limited to, language in the physical security plan that describes the issuance of an alarm or alert in response to unauthorized physical access to Physical Access Control Systems and additional evidence that the alarm or alerts was issued and communicated as identified in the BES Cyber Security Incident Response Plan, such as alarm or alert logs, cell phone or pager logs, or other evidence that the alarm or alert was generated and communicated. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 1.7 This section to be completed by the Compliance Monitor Administrator
Auditor Notes: R2 Supporting Evidence and Documentation R2. Each Responsible Entity shall implement one or more documented visitor control program(s) that include each of the applicable requirement parts in CIP-006-6 Table R2 – Visitor Control Program. [Violation Risk Factor: Medium] [Time Horizon: Same Day Operations.] M2. Evidence must include one or more documented visitor control programs that collectively include each of the applicable requirement parts in CIP-006-6 Table R2 – Visitor Control Program and additional evidence to demonstrate implementation as described in the Measures column of the table. CIP-006-6 Table R2 – Visitor Control Program Part Applicable Systems Requirements Measures 2.1 High Impact BES Cyber Systems and their associated: EACMS; and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: EACMS; and PCA Require continuous escorted access of visitors (individuals who are provided access but are not authorized for unescorted physical access) within each Physical Security Perimeter, except during CIP Exceptional Circumstances. An example of evidence may include, but is not limited to, language in a visitor control program that requires continuous escorted access of visitors within Physical Security Perimeters and additional evidence to demonstrate that the process was implemented, such as visitor logs. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document