For each Applicable System, verify inbound and outbound access permissions are implemented. For each Applicable System, verify each inbound and each outbound access permission includes the reason for granting access. For each Applicable System, verify inbound and outbound access is denied by default. Note to Auditor: Some vendor firewalls contain an implicit “deny” statement in the Access Control List (ACL). Vendor documentation of that configuration is a form of evidence to demonstrate the deny by default requirement within this Part. Auditor Notes: R1 Part 1.4 CIP-005-5 Table R1 – Electronic Security Perimeter Part Applicable Systems Requirements Measures 1.4 High Impact BES Cyber Systems with Dial-up Connectivity and their associated: PCA Medium Impact BES Cyber Systems with Dial-up Connectivity and their associated: PCA technically feasible, perform authentication when establishing Dial-up Connectivity with applicable Cyber Assets. An example of evidence may include, but is not limited to, a documented process that describes how the Responsible Entity is providing authenticated access through each dial-up connection. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document
The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-005-5, R1, Part 1.5 This section to be completed by the Compliance Enforcement Authority Verify the Responsible Entity has documented one or more processes which include one or more methods for detecting known or suspected malicious communications for both inbound and outbound communications. For each Applicable System, verify the Responsible Entity has implemented one or more methods for detecting known or suspected malicious communications for both inbound and outbound communications. Auditor Notes: R2 Supporting Evidence and Documentation R2. Each Responsible Entity allowing Interactive Remote Access to BES Systems shall implement one or more documented processes that collectively include the applicable requirement parts, where technically feasible, in CIP-005-5 Table R2 – Interactive Remote Access Management. [Violation Risk Factor: Medium] [Time Horizon: Operations Planning and Same Day Operations]. M2. Evidence must include the documented processes that collectively address each of the applicable requirement parts in CIP-005-5 Table R2 – Interactive Remote Access Management and additional evidence to demonstrate implementation as described in the Measures column of the table. R2 Part 2.1 CIP-005-5 Table R2 – Interactive Remote Access Management Part Applicable Systems Requirements Measures