measures identified by the approved Technical Feasibility Exception are implemented. Part 1.2 in Table R1 – Ports and Services Applicable Systems High Impact BES cyber systems Medium Impact BES systems at control centres Requirements Protect against the use of unnecessary physical ports used for network connectivity, console commands, or removable media. Measures An example of evidence may include, but is not limited to, documentation showing of protection of physical input/output ports, either logically through system configuration or physically using a port lock or signage. AR1. Part 1.2 Please provide: One or more documented processes pertaining to requirement R1 Part 1.2. Verify the Responsible Entity has documented one or more processes that protect against the use of unnecessary physical input/output ports used for network connectivity, console commands, or removable media. Evidence that the processes pertaining to requirement R1 Part 1.2 have been implemented. For each asset of an Applicable System, verify that the unnecessary physical input/output ports used for network connectivity, console commands, or removable media are protected against use. Findings
Part 2.2 in Table R2 – Security Patch Management Applicable Systems High Impact BES cyber systems and their associated: electronic access control or monitoring systems; physical access control systems; and protected cyber assets Medium Impact BES systems and their associated: electronic access control or monitoring systems; physical access control systems; and protected assets Requirements At least once every 35 days, evaluate security patches for applicability that have been released since the last evaluation from the source or sources identified in Part 2.1. Measures An example of evidence may include, but is not limited to, an evaluation conducted by, referenced by, or on behalf of a Responsible Entity of security‐related patches released by the documented sources at least once every 35 days. AR2. Part 2.2 Please provide: One or more documented processes pertaining to requirement R2 Part 2.2. Verify the Responsible Entity has documented one or more processes to evaluate security patches for applicability that have been released since the last evaluation from the source or sources identified in Part 2.1, at least once every 35 days. Evidence that the processes pertaining to requirement R2 Part 2.2 have been implemented; including the date when the evaluation was completed and the results of the evaluation during the audit period. For each identified patch source, verify that security patches have been evaluated for applicability at least once every 35 days. For each identified patch source, verify the results of the evaluations for applicability.
R3 Requirement & Measure Evidence Submission Evidence Description Evidence Assessment Approach Auditor Notes R3. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented processes that collectively include each of the applicable requirement Parts in CIP‐007-AB‐5 Table R3 – Malicious Code Prevention. M3. Evidence must include each of the documented processes that collectively include each of the applicable requirement Parts in CIP‐007-AB‐5 Table R3 – Malicious Code Prevention and additional evidence to demonstrate implementation as described in the Measures column of the table. Part 3.1 in R3 – Malicious Code Prevention Applicable Systems High Impact BES cyber systems and their associated: 1. electronic access control or monitoring systems; 2. physical access control systems; and 3. protected cyber assets Medium Impact BES cyber systems and their associated: 1. electronic access control or monitoring systems; 2. physical access control systems; and 3. protected cyber assets Requirements Deploy method(s) to deter, detect, or prevent malicious code. Measures An example of evidence may include, but is not limited to, records of the Responsible Entity’s performance of these processes (e.g., through traditional antivirus, system hardening, policies, etc.). AR3 Part 3.1 Please provide: One or more documented processes pertaining to requirement R3 Part 3.1 Verify the Responsible Entity has documented one or more processes to deploy method(s) to detect, or prevent malicious code. Evidence that the processes pertaining to requirement R3 Part 3.1 have been implemented Verify that each Applicable System has one or more documented methods deployed to detect, or prevent malicious code.
Part 5.2 in Table R5 – System Access Controls Applicable Systems High Impact BES cyber systems and their associated: electronic access control or monitoring systems; physical access control systems; and protected assets Medium Impact BES cyber systems and their associated: electronic access control or monitoring systems; physical access control systems; and protected assets Requirements Identify and inventory all known enabled default or other generic account types, either by system, by groups of systems, by location, or by system type(s). Measures An example of evidence may include, but is not limited to, a listing of accounts by account showing the enabled or generic account types in use for the BES cyber system. AR 5 Part 5.2 Please provide: One or more documented processes pertaining to requirement R5 Part 5.2. Verify the Responsible Entity has documented one or more processes to identify and inventory all known enabled default or other generic account types, either by system, by groups of systems, by location, or by system type(s). Evidence that the processes pertaining to requirement R5 Part 5.2 have been implemented. For each asset of an Applicable System, verify the Responsible Entity has identified and inventoried all known enabled default or other generic account types. These account types may be identified by system, by groups of systems, by location, or by system type.