CIP-003-7 Supplemental Material
1.1.5 Incident reporting and response planning (CIP-008) • Recognition of Cyber Security Incidents
• Appropriate notifications upon discovery of an incident • Obligations to report Cyber Security Incidents
1.1.6 Recovery plans for BES Cyber Systems (CIP-009) • Availability of spare components • Availability of system backups 1.1.7 Configuration change management and vulnerability assessments (CIP-010) • Initiation of change requests
• Approval of changes • Break-fix processes 1.1.8 Information protection (CIP-011)
• Information access control methods • Notification of unauthorized information disclosure • Information access on a need-to-know basis 1.1.9 Declaring and responding to CIP Exceptional Circumstances • Processes to invoke special procedures in the event of a CIP Exceptional Circumstance • Processes to allow for exceptions to policy that do not violate CIP requirements For Part 1.2, the Responsible Entity may consider the following for each of the required topics in its one or more cyber security policies for assets containing low impact BES Cyber Systems, if any: 1.2.1 Cyber security awareness • Method(s) for delivery of security awareness • Identification of groups to receive cyber security awareness 1.2.2 Physical security controls • Acceptable approach(es) for selection of physical security control(s) 1.2.3 Electronic access controls • Acceptable approach(es) for selection of electronic access control(s) 1.2.4 Cyber Security Incident response • Recognition of Cyber Security Incidents
Page 30 of 57
Made with FlippingBook - Online magazine maker