M1. Evidence must include the documented processes that collectively include each of the applicable requirement in CIP-007-6 Table R1 – Ports and Services and additional evidence to demonstrate implementation as described in the Measures column of the table. R1 Part 1.1 CIP-007-6 Table R1– Ports and Services Part Applicable Systems Requirements Measures 1.1 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Systems with External Routable Connectivity and their associated: PACS; and PCA Where technically feasible, enable only logical network accessible ports that have been determined to be needed by the Responsible Entity, including port ranges or services where needed to handle dynamic ports. If a device has no provision for disabling or restricting logical ports on the device then those ports that are open are deemed needed. Examples of evidence may include, but are not limited to: Documentation of the need for all enabled ports on all applicable Cyber Assets and Electronic Access Points, individually or by group. Listings of the listening ports on the Cyber Assets, individually or by group, from either the device configuration files, command output (such as netstat), or network scans of open ports; or Configuration files of host-based firewalls or other device level mechanisms that only allow needed ports and deny all others. Registered Entity Response (Required): Compliance Narrative: Provide a explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority):
commands, or Removable Media. For each Cyber Asset of an Applicable System, verify that the unnecessary physical input/output ports used for network connectivity, console commands, or Removable Media are protected against use. Auditor Notes: R2 Supporting Evidence and Documentation R2. Each Responsible Entity shall implement one or more documented process(es) that collectively include each of the applicable requirement parts in CIP-007-6 Table R2 – Security Patch Management. [Violation Risk Factor: Medium] [Time Horizon: Operations Planning]. M2. Evidence must include each of the applicable documented processes that collectively include each of the applicable requirement parts in CIP-007-6 Table R2 – Security Patch Management and additional evidence to demonstrate implementation as described in the Measures column of the table. R2 Part 2.1 CIP-007-6 Table R2 – Security Patch Management Part Applicable Systems Requirements Measures 2.1 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Systems and their associated: EACMS; PACS; and PCA A patch management process for tracking, evaluating, and installing cyber security patches for applicable Cyber Assets. The tracking portion shall include the identification of a source or sources that the Responsible Entity tracks for the release of cyber security patches for applicable Cyber Assets that are updateable and for which a patching source exists. An example of evidence may include, but is not limited to, documentation of a patch management process and documentation or lists of sources that are monitored, whether on an individual BES Cyber System or Cyber Asset basis. Registered Entity Response (Required): Compliance Narrative: Provide a explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found.
For each identified patch source, verify the results of the evaluations for applicability. Auditor Notes: R2 Part 2.3 CIP-007-6 Table R2 – Security Patch Management Part Applicable Systems Requirements Measures 2.3 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Cyber Systems and their associated: PACS; and PCA For applicable patches identified in Part 2.2, within 35 calendar days of the evaluation completion, take one of the following actions: the applicable patches; or Create a dated mitigation plan; or Revise an existing mitigation plan. Mitigation plans shall include the Responsible Entity’s planned actions to mitigate the vulnerabilities addressed by each security patch and a timeframe to complete these mitigations. Examples of evidence may include, but are not limited to: Records of the installation of the patch (e.g., exports from automated patch management tools that provide installation date, verification of BES Cyber System Component software revision, or registry exports that show software has been installed); or A dated plan showing when and how the vulnerability will be addressed, to include documentation of the actions to be taken by the Responsible Entity to mitigate the vulnerabilities addressed by the security patch and a timeframe for the completion of these mitigations. Registered Entity Response (Required): Compliance Narrative: Provide a explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) Description of Applicability of Document
2.4 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA For each mitigation plan created or revised in Part 2.3, implement the plan within the timeframe specified in the plan, unless a revision to the plan or an extension to the timeframe specified in Part 2.3 is approved by the CIP Senior Manager or delegate. An example of evidence may include, but is not limited to, records of implementation of mitigations. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-007-6, R2, Part 2.4 This section to be completed by the Compliance Enforcement Authority Verify the Responsible Entity has documented one or more processes that, for each mitigation plan created or revised in Part 2.3, require implementation of the plan within the timeframe specified in the plan, unless a revision to the plan or an extension to the timeframe specified in Part 2.3 is approved by the CIP Senior Manager or delegate. For each completed mitigation plan: Verify the mitigation plan was completed by implementing all provisions of the mitigation
5.3 High Impact BES Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Systems with External Routable Connectivity and their associated: PACS; and PCA Identify individuals who have authorized access to shared accounts. An example of evidence may include, but is not limited to, listing of shared accounts and the individuals who have authorized access to each shared account. Registered Entity Response (Required): Compliance Narrative: Provide a explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-007-6, R5, Part 5.3 This section to be completed by the Compliance Enforcement Authority Verify the Responsible Entity has documented one or more processes to identify individuals who have authorized access to shared accounts. For each Cyber Asset of an Applicable System, verify the Responsible Entity has identified individuals with authorized access to shared accounts. Note to Auditor:
Part Applicable Systems Requirements Measures 5.6 High Impact BES Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: PACS; and PCA Where technically feasible, for password-only authentication for interactive user access, either technically or procedurally enforce password changes or an obligation to change the password at least once every 15 calendar months. Examples of evidence may include, but are not limited to: System-generated reports or screen-shots of the periodicity of changing passwords; or Attestations that include a reference to the documented procedures that were followed. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-007-6, R5, Part 5.6 This section to be completed by the Compliance Enforcement Authority For password-only authentication for interactive user access, verify the Responsible Entity has documented one or more processes to either technically or procedurally enforce password changes or an obligation to change the password at least once every 15 calendar months, where technically feasible. For Cyber Assets of Applicable Systems, if a password for password-only authentication for