CIP-010-R1.5-L2-05: for the range of dates in SS-DATE-04, provide the following evidence for each change that deviated from the then-existing baseline configuration: 1. The date the change was implemented in a production environment. 2. Evidence that: a) The change was tested in a test environment, or b) The change was tested in a production environment, or c) An approved TFE covers this Cyber Asset. 3. If the change was tested, provide evidence of the date testing was performed. 4. If the change is tested in a production environment, provide evidence of how adverse impacts on the production system were minimized. 5. If the change was tested, provide evidence that the testing ensured that the required security controls from CIP-005 and CIP-007 were not adversely affected. 6. If the change was tested, provide evidence that the test results were documented. 7. If the change was tested in a test environment, provide: a) Evidence that the systems used for testing modeled the baseline configuration of the target production system. b) Evidence that the differences between the test and the production environments were documented, and c) Documentation of the measures used to account for any differences in operation between the test and production environments.
Made with FlippingBook - Online magazine maker