1.2 High Impact BES Cyber Systems Medium Impact BES Systems One or more processes to determine if an identified Security Incident is a Reportable Cyber Security Incident and notify the Electricity Sector Information Sharing and Analysis Center (ES-ISAC), unless prohibited by law. Initial notification to the ES-ISAC, which may be only a preliminary notice, shall not exceed one hour from the determination of a Reportable Cyber Security Incident. Examples of evidence may include, but are not limited to, dated documentation of Cyber Security Incident response plan(s) that provide guidance or thresholds for determining which Cyber Security Incidents are also Reportable Cyber Security Incidents and documentation of initial notices to the Electricity Sector Information Sharing and Analysis Center (ES-ISAC). Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-008-5, R1, Part 1.2 This section to be completed by the Compliance Enforcement Authority Verify the Responsible Entity has documented one or more Cyber Security Incident response plans which include one or more processes to determine if an identified Cyber Security Incident is a Reportable Cyber Security Incident and notify the Electricity Sector Information Sharing and Analysis Center (ES-ISAC), unless prohibited by law. Initial notification to the ES-ISAC, which may be only a preliminary notice, shall not exceed one hour from the determination of a Reportable Cyber Security Incident.
The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-008-5, R3, Part 3.1 This section to be completed by the Compliance Enforcement Authority Verify that no later than 90 calendar days after completion of a Cyber Security Incident response plan(s) test or actual Reportable Cyber Security Incident response, the Responsible Entity has: Documented any lessons learned or documented the absence of any lessons learned; updated the Cyber Security Incident response plan based on any documented lessons learned associated with the plan; and notified each person or group with a defined role in the Cyber Security Incident response plan of the updates to the Cyber Security Incident response plan based on any documented lessons learned. Auditor Notes: R3 Part 3.2 CIP-008-5 Table R3 – Cyber Security Incident Response Plan Review, Update, and Communication Part Applicable Systems Requirements Measures
DRAFT2v0 09/17/2014 CIP RSAW Development Team Address comments received in response to DRAFT1v0. DRAFT3v0 12/10/2014 CIP RSAW Development Team Address comments received in response to DRAFT2v0. DRAFT4v0 02/06/2015 CIP RSAW Development Team Address comments from V5R SDT and address comments in response to DRAFT3v0. DRAFT4v1 03/10/2015 CIP RSAW Development Team Address comments from V5R SDT meeting on March 3-4, 2015. FINALv1 05/08/2015 CIP RSAW Development Team Address comments from posting; review and address comments of V5R SDT.