CIP-003_Workbook_10152019

CIP-003-7 - Cyber Security — Security Management Controls

Violation Severity Levels (CIP-003-7)

Time Horizon

R #

VRF

Lower VSL

Moderate VSL

High VSL

Severe VSL

OR The Responsible

BES Cyber Systems, but did not address three of the six topics required by R1. (R1.2) OR The Responsible Entity did not complete its review of the one or more documented cyber security policies for its assets identified in CIP- complete this review in less than or equal to 18 calendar months of the previous review. (R1.2) OR The Responsible Entity did not complete its approval of the one or more documented cyber security policies for its 002 containing low impact BES Cyber Systems as required by R1 within 17 calendar months but did

OR The Responsible

Entity documented one or more cyber security policies for its assets identified in CIP-002 containing low impact BES Cyber Systems, but did not address one

Entity documented one or more cyber security policies for its assets identified in CIP-002 containing low impact BES Cyber Systems, but did not address two

Entity documented one or more cyber security policies for its assets identified in CIP-002 containing low impact BES Cyber Systems, but did not address four or more of the six topics required by R1. (R1.2) OR The Responsible Entity did not have any documented cyber security policies for its assets identified in CIP-002 containing low impact BES Cyber Systems as required by R1. (R1.2) OR

of the six topics required by R1. (R1.2) OR The Responsible Entity did not

complete its review of the one or more documented cyber security policies for its assets identified in CIP-002 containing low impact BES Cyber Systems as required by Requirement R1 within 15 calendar

complete its review of the one or more documented cyber security policies for its assets identified in CIP-002 containing low impact BES Cyber Systems as required by Requirement R1 within 16 calendar

Page 10 of 57

Made with FlippingBook - Online magazine maker