CIP-006-5 Table R1 – Physical Security Plan Part Applicable Systems Requirements Measures 1.3 High Impact BES Cyber Systems and their associated: EACMS; and PCA Where technically feasible, utilize two or more different physical access controls (this does not require two completely independent physical access control systems) to collectively allow unescorted physical access into Physical Security Perimeters to only those individuals who have authorized unescorted physical access. An example of evidence may include, but is not limited to, language in the physical security plan that describes the Physical Security Perimeters and how unescorted physical access is controlled by two or more different methods and proof that unescorted physical access is restricted to only authorized individuals, such as a list of authorized individuals accompanied by access logs. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 1.3 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more physical security plans that utilize two or more different physical access controls (this does not require two completely independent physical access control systems) to collectively allow unescorted physical access into Physical Security Perimeters to only those individuals who have authorized unescorted physical access, where technically feasible. Verify that each Physical Security Perimeter has at least two physical access control. Verify that only individuals with authorized unescorted physical access are allowed authorized unescorted physical access into each applicable Physical Security Perimeter.
CIP-006-5 Table R1 – Physical Security Plan Part Applicable Systems Requirements Measures 1.4 High Impact BES Cyber Systems and their associated: and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: and PCA Monitor for unauthorized access through a physical access point into a Physical Security Perimeter. An example of evidence may include, but is not limited to, documentation of controls that monitor for unauthorized access through a physical access point into a Physical Security Perimeter. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 1.4 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more physical security plans to monitor for unauthorized access through a physical access point into a Physical Security Perimeter. Verify that the Responsible Entity monitors for unauthorized access through a physical access into a Physical Security Perimeter. CIP-006-5 Table R1 – Physical Security Plan
Compliance Summary: Finding Summary: Primary Documents Supporting Findings: Auditor R2 Supporting Evidence and Documentation R2. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented visitor control programs that include each of the applicable requirement parts in CIP-006-5 Table R2 – Visitor Control Program. [Violation Risk Factor: Medium] [Time Horizon: Same Day Operations.] M2. Evidence must include one or more documented visitor control programs that collectively include each of the applicable requirement parts in CIP-006-5 Table R2 – Visitor Control Program and additional evidence to demonstrate implementation as described in the Measures column of the table. CIP-006-5 Table R2 – Visitor Control Program Part Applicable Systems Requirements Measures 2.1 High Impact BES Systems and their associated: EACMS; and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: EACMS; and PCA Require continuous escorted access of visitors (individuals who are provided access but are not authorized for unescorted physical access) within each Physical Security Perimeter, except during CIP Exceptional Circumstances. An example of evidence may include, but is not limited to, language in a visitor control program that requires continuous escorted access of visitors within Physical Security Perimeters and additional evidence to demonstrate that the process was implemented, such as visitor logs. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found.