Part 1.3 in Table R1 – Physical Security Plan Applicable systems High Impact BES cyber systems and their associated: 1. electronic access control or monitoring systems; and 2. protected cyber assets Requirements Where technically feasible, utilize two or more different physical access controls (this does not require two completely independent physical access control systems) to collectively allow unescorted physical access into physical security perimeters to only those individuals who have authorized unescorted physical access. Measures An example of evidence may include, but is not limited to, language in the physical security plan that describes the physical security perimeters and how unescorted physical access is controlled by two or more different methods and that unescorted physical access is restricted to only authorized individuals, such as a list of authorized individuals accompanied by access logs. AR1 Part 1.3 Please provide: (i) One or more documented physical security pertaining to requirement R1 Part 1.3. Verify the Responsible Entity has documented one or more physical security that utilize two or more different physical access controls (this does not require two completely independent physical access control systems) to collectively allow unescorted physical access into physical security perimeters to only those individuals who have authorized unescorted physical access, where technically feasible. (ii) Evidence that the physical security pertaining to requirement R1 Part 1.3 have been implemented. Verify that each physical security perimeter has at least two physical access controls, or that an approved Technical Feasibility Exception covers this circumstance. Verify that only those individuals with authorized unescorted physical access are allowed authorized unescorted physical access into each applicable physical security perimeter. If an approved Technical Feasibility Exception is applicable to this Part, verify the compensating measures identified by the approved Technical Feasibility Exception are implemented.
Part 1.5 in Table R1 – Physical Security Plan Applicable Systems High Impact BES cyber systems and their associated: 1. electronic access control or monitoring systems; and 2. protected cyber assets Medium Impact BES cyber systems with external routable connectivity and their associated: 1. electronic access control or monitoring systems; and 2. protected cyber assets Requirements Issue an alarm or alert in response to detected unauthorized access through a physical access point into a physical security perimeter to the personnel identified in the bulk electric system cyber security incident response plan within 15 minutes of detection. Measures An example of evidence may include, but is not limited to, language in the physical security plan that describes the issuance of an alarm or alert in response to unauthorized access through a physical access control into a physical security perimeter and additional evidence that the alarm or alert was issued and communicated as identified in the bulk electric system cyber security incident response plan, such as manual or electronic alarm or alert logs, cell phone or pager logs, or other evidence that documents that the alarm or alert was generated and communicated. AR1 Part 1.5 Please provide: (i) One or more documented physical security plans pertaining to requirement R1 Part 1.5. Verify the Responsible Entity has documented one or more physical security plans to issue an alarm or alert in response to detected unauthorized access through a physical access point into a physical security perimeter to the personnel identified in the BES cyber security Incident response plan within 15 minutes of detection. (ii) Evidence that physical security plans pertaining to requirement R1 Part 1.5 have been implemented. Verify that an alarm or alert is issued in response to detected unauthorized access through a physical access point into a physical security perimeter to the personnel identified in the BES cyber security incident response plan within 15 minutes of detection.
Part 2.2 in Table R2 – Visitor Control Program Applicable Systems High Impact BES cyber systems and their associated: 1. electronic access control or monitoring systems; and 2. protected cyber assets Medium Impact BES cyber systems with external routable connectivity and their associated: 1. electronic access control or monitoring systems; and 2. protected cyber assets Requirements Require manual or automated logging of visitor entry into and exit from the physical security perimeter that includes date and time of the initial entry and last exit, the visitor’s name, and the name of an individual point of contact responsible for the visitor, except during CIP exceptional circumstances. Measures An example of evidence may include, but is not limited to, language in a visitor control program that requires continuous escorted access of visitors within physical security perimeters and additional evidence to demonstrate that the process was implemented, such as dated visitor logs that include the required information. AR2 Part 2.2 Please provide: (i) One or more documented visitor control programs pertaining to requirement R2 Part 2.2. Verify the Responsible Entity has documented one or more visitor control programs to require manual or automated logging of visitor entry into and exit from the physical security perimeter that includes date and time of the initial entry and last exit, the visitor’s name, and the name of an individual point of contact responsible for the visitor, except during CIP exceptional circumstances. (ii) Evidence that visitor control programs pertaining to requirement R2 Part 2.2 have been implemented. Verify that the Responsible Entity performs manual or automated logging of visitor into and exit from the physical security perimeter that includes date and time of the initial entry and last exit, the visitor’s name, and the name of an individual point of contact responsible for the visitor, except during CIP exceptional circumstances. If the Responsible Entity has experienced an exception for CIP exceptional circumstances, verify the Responsible Entity has adhered to any applicable cyber security policies.
Part 2.3 in R2 – Visitor Control Program Applicable systems High Impact BES systems and their associated: 1. electronic access control or monitoring systems; and 2. protected assets Medium Impact BES systems with external routable connectivity and their associated: 1. electronic access control or monitoring systems; and 2. protected cyber assets Requirements Retain visitor logs for at least ninety days. Measures An example of evidence may include, but is not limited to, documentation showing logs have been retained for at ninety days. A2 Part 2.3 Please provide: (i) One or more documented visitor control programs pertaining to requirement R2 Part 2.3. Verify the Responsible Entity has documented one or more visitor control programs to retain visitor logs for at least ninety days. (ii) Evidence that visitor control programs pertaining to requirement R2 Part 2.3 have been implemented. Verify that visitor logs are retained for at least ninety days. Findings