{"text_format":"1","workbook":"xlsx","n_sheets":5,"sheets":["Instructions","Leadsheet","Files reviewed","Table A from Sampling Handbook","LS-Drop Down Values"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":2,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Instructions","index":0,"n_rows":26,"n_cols":4,"rows_kept":26,"cut":false,"hidden":false,"merged":[]}
["Instructions",null,null,"Version History"]
[]
["1) Fill out data in column 5 of the LS-SPCP tab"]
["2) enter entity data in rows 3-5"]
["3) use the drop down menu in row 6 for the audit type"]
["4) enter engagement info in rows 7-12"]
["5) Line 20: The type of records that are collected to review. Database/files/ special tools/etc. Notes for any issues in collecting the population."]
["6) Line 22: Types of attributes being sampled"]
["7) Line 24: Do the records meet the audit period or objective periods?"]
["8) Line 26: Was the population validated, if so how?"]
["9) enter population and data info in rows 15-26"]
["10) After you select the standard and requirement in row 30, press the Populate Objective button to add the objectives."]
["11) enter objectives and considerations in rows 32/35. "]
["12) use the drop down menu in row 36 to enter the sampling type"]
["13) Line 41: Some documents may be older than the audit period and still be the most current document. Therefore a note may be required.  Are you sampling a shorter time period than the audit period, if so note the reasoning. There are often logical reasons for this and it just needs to be noted."]
["14) enter sampling data in rows 36-50"]
["15) use the drop down menu in row 54 for the results"]
["16) use the drop down menu in row 55 if expansion of sampling is required"]
["17) enter the expanded sampling ionformation in rows 56/57"]
["18) enter the results and dertermination in rows 58-60"]
[]
[]
[]
["Update History:"]
["Version","Date updated",null,"Reason"]
["Version: 1"," 7/01/2015",null,"original"]

{"sheet":"Leadsheet","index":1,"n_rows":61,"n_cols":3,"rows_kept":61,"cut":false,"hidden":false,"merged":[]}
["Preparation Inputs (PI):","Auditor / Analyst Commentary"]
["Engagement Data"]
["Registered Entity:"]
["Entity Acronym:"]
["Entity NCR Number:"]
["Audit Review Type:  "]
["Review / Engagement Date:"]
["Preparer:"]
["Date:"]
["Workpaper - RSAW Cross-Reference:"]
["Reviewer/Approval:"]
["Date:"]
[]
["Source Population Type:  "]
["Primary"]
["Dependent / Secondary"]
["Independent"]
["Other"]
[]
["Obtain & Review Source Population(s) Record Layout:"]
[]
["Identify Data Points, Field Values & Elements for Selection & Testing:"]
[]
["Determine Alignment of Records History & Sampling Time Period:"]
[]
["Validate Source Population(s) for Data Integrity & Completeness:"]
[]
["Process Activities (PA):"]
[]
["Standard"]
["Document the Sampling Testing Objective(s):  [If applicable, Select the Testing Objective from the Requirements Menu] ",null,"Choose the Standard/Requirement then press Macro Button to populate the objective and retention period"]
["[If Applicable] - Other Testing Objective(s):  "]
[]
["Identify & Describe Impactful Risk [IRA] & Internal Control [ICE] Considerations:"]
[]
["Select & Document Sampling Approach & Rationale:  [If applicable, select Sampling Approach from the Menu]"]
["Comments and Rationale"]
[]
["Determine the Initial Sampling & Size:"]
["Retention period noted in Standard:"]
["Document Relevant Time Periods Considered:"]
["Population Size"]
["Select Sample Size Based on Sampling Handbook Specifications, (Tables A),  or Sampling Tool, (e.g., RAT-STATS) "]
["Document Statistical Sampling Metrics: "]
["(Table A Default Values)"]
["Confidence Level (95%)",0.95]
["Margin of Error (10%)",0.1]
["Random Seed Number "]
["Desired Precision Range  (10%)",0.1]
["Rate of Occurrence (0.5%)",5.0000000000000001E-3]
["Comments for changes from default values"]
[]
["Test Results Output (TRO)"]
[]
["Assess & Document Test Sampling Results in Line with Stated Testing Objectives:"]
["Document if Sampling Approach Requires Expansion or Modification"]
["Document Basis for Expanded Sampling"]
["Document Basis for Deviations in Sampling or Planned Testing Procedures"]
["Determination/ Findings"]
["Area of Concerns"]
["Recommendation"]

{"sheet":"Files reviewed","index":2,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"Table A from Sampling Handbook","index":3,"n_rows":36,"n_cols":2,"rows_kept":36,"cut":false,"hidden":false,"merged":[[29,1,33,1],[0,0,0,1],[1,0,1,1],[2,0,2,1],[6,1,7,1],[10,1,11,1],[19,1,20,1]]}
["                   "]
["                    Sample Table A"]
[]
["Population Description","Sample Selection"]
[]
["Statistical Sampling"]
["Primary  Population  ","Using Statistical Sampling "]
["(Examples: Substations, Generating Stations, ESPs, PSPs, CCAs)"]
["2015-01-08","Entire population"]
["9 +","8 Samples"]
["Dependent Population of Elements: ","Using Statistical Sampling"]
["(Examples: Relays, CCAs, Routers, Firewalls & Other)"]
["2015-01-09","All Elements"]
["2015-10-19","9 Samples"]
["20-40","16 Samples"]
["41-100","23 Samples"]
["101-1000","29 Samples"]
["1001 +","33 Samples"]
[]
["Independent Population of Elements:","Using Statistical or Judgmental Sampling"]
["(Examples: Transmission Segments, Blackstart units, Outages, Mis-operations, Daily Operations reports, Line Ratings, others)"]
["2015-01-09","All Elements"]
["2015-10-19","9 Samples"]
["20-40","16 Samples"]
["41-100","23 Samples"]
["101-1000","29 Samples"]
["1001 +","33 Samples"]
[]
["Non-Statistical Sampling"]
["Physical Visits :","Non-Statistical "]
["Due to geographic limitations and/or time constraints, the team may choose"]
["  to sample less than 4 physical sites."]
[]
["(Examples:  Control Centers, Substations, Generating Stations) "]
["2015-01-04","Entire population"]
["5+","4 Samples"]

{"sheet":"LS-Drop Down Values","index":4,"n_rows":47,"n_cols":11,"rows_kept":47,"cut":false,"hidden":false,"merged":[]}
["O&P Audit",null,"COM-002-2a R2",null,"The objective is to verify  each RC, TOP, and BA has issued directives in a clear, concise, and definitive manner such that the recipient of the directive can repeat the information back correctly and the sender shall acknowledge it as correct or repeated again until both parties clearly understand the directive.",null,"Statistical [Random]",null,"Yes",null,"Each Balancing Authority, Transmission Operator and Generator Operator shall keep evidence of compliance for the previous two calendar years plus the current year. (Measure 1)\n\nEach Balancing Authority and Transmission Operator shall keep 90 days of historical data. (Measure 2)."]
["O&P Spot-Check",null,"FAC-003-3 R2",null,"The objective is to verify a reliable electric transmission system is maintained by using a defense-in-depth strategy to manage vegetation located on transmission rights of way (ROW) and minimize encroachments from vegetation located adjacent to the ROW, thus preventing the risk of those vegetation-related outages that could lead to Cascading.",null,"Statistical Stratified [Random]",null,"No",null,"The applicable Transmission Owner and applicable Generator Owner retains data or evidence to show compliance with Requirements R1, R2, R3, R5, R6 and R7, Measures M1, M2, M3, M5, M6 and M7 for three calendar years."]
["O&P Self-Report",null,"FAC-008-3 R6",null,"The objective is to verify  each TO and GO  has Facility Ratings for its solely and jointly owned Facilities that are consistent with the associated Facility Ratings methodology or documentation for determining its Facility Ratings.",null,"Non-Statistical",null,null,null,"The Generator Owner shall keep its current documentation (for R1) and any modifications to the documentation that were in force since last compliance audit period for Measure M1 and Measure M6.\n\nThe Generator Owner shall keep its current, in force Facility Ratings methodology (for R2) and any modifications to the methodology that were in force since last compliance audit period for Measure M2 and Measure M6.\n\nThe Transmission Owner shall keep its current, in force Facility Ratings methodology (for R3) and any modifications to the methodology that were in force since the last compliance audit for Measure M3 and Measure M6.\n\nThe Transmission Owner and Generator Owner shall keep its current, in force Facility Ratings and any changes to those ratings for three calendar years for Measure M6."]
["O&P Certification",null,"FAC-014-2 R2",null,"The objective is to verify each TOP  establishes SOLs (as directed by its RC) for its portion of the RC area that are consistent with\nits RC’s SOL Methodology.",null,"Judgmental",null,null,null,"The Reliability Coordinator, Planning Authority, Transmission Operator, and Transmission Planner shall each keep documentation for 12 months."]
["O&P Complaint",null,"FAC-014-2 R4",null,"The objective is to verify the TP established SOLs, including IROLs, for its Transmission Planning Area that are consistent with its PA’s SOL Methodology.",null,"Other",null,null,null,"The Reliability Coordinator, Planning Authority, Transmission Operator, and Transmission Planner shall each keep documentation for 12 months."]
["O&P Investigation",null,"MOD-001-1a R2",null,"The objective is to verify  calculations are performed by Transmission Service Providers to maintain awareness of available transmission system capability and future flows on their own systems as well as those of their neighbors. The ATC or AFC calculations shall be calculated at least as often as listed in Requirement 2. ",null,null,null,null,null,"The Transmission Service Provider shall maintain evidence to show compliance with R2, R4, R6, R7, and R8 for the most recent calendar year plus the current year."]
["O&P Enforcement",null,"MOD-001-1a R8",null,"The objective is to verify  calculations are performed by Transmission Service Providers to maintain awareness of available transmission system capability and future flows on their own systems as well as those of their neighbors. The ATC  shall be updated at least as often as listed in Requirement 8 for the hourly, daily and monthly values. ",null,null,null,null,null,"The Transmission Service Provider shall maintain evidence to show compliance with R2, R4, R6, R7, and R8 for the most recent calendar year plus the current year."]
["CIP Audit",null,"MOD-004-1 R6",null,"The objective is to verify the consistent and reliable calculation, verification, preservation, and use of Capacity Benefit Margin (CBM) to support analysis and system operations.",null,null,null,null,null,"The Transmission Service Provider that maintains CBM shall maintain its current, in force CBMID and any prior versions of the CBMID that were in force during the past three calendar years plus the current year to show compliance with R1.\n-\nThe Transmission Service Provider that maintains CBM shall maintain evidence to show compliance with R2, R5, R7, R9, and R12 for the most recent three calendar years plus the current year.\n-\nThe Load-Serving Entity shall each maintain evidence to show compliance with R3 and R10 for the most recent three calendar years plus the current year.\n-\nThe Resource Planner shall each maintain evidence to show compliance with R4 for the most recent three calendar years plus the current year.\n-\nThe Transmission Planner shall maintain evidence to show compliance with R6, R8, and R9 for the most recent three calendar years plus the current year.\n-\nThe Balancing Authority shall maintain evidence to show compliance with R10 and R11 for the most recent three calendar years plus the current year.\n-\nThe Transmission Service Provider shall maintain evidence to show compliance with R11 for the most recent three calendar years plus the current year."]
["CIP Spot-Check",null,"PER-003-1 R1",null,"The objective is to verify each RC staffs its Real-time operating positions performing RC reliability-related tasks with System Operators who are competent and maintain a valid NERC Reliability Operator certificate.",null,null,null,null,null,"Each Reliability Coordinator, Balancing Authority and Transmission Operator shall keep\ndata or evidence to show compliance for three years or since its last compliance audit,\nwhichever time frame is the greatest."]
["CIP Self-Report",null,"PER-003-1 R2",null,"The objective is to verify each TOP staffs its Real-time operating positions performing TOP reliability-related tasks with System Operators who are competent and maintain a valid NERC Reliability Operator certificate.",null,null,null,null,null,"Each Reliability Coordinator, Balancing Authority and Transmission Operator shall keep\ndata or evidence to show compliance for three years or since its last compliance audit,\nwhichever time frame is the greatest."]
["CIP Certification",null,"PER-003-1 R3",null,"The objective is to verify each BA staffs its Real-time operating positions performing BA reliability-related tasks with System Operators who are competent and maintain a valid NERC Reliability Operator certificate.",null,null,null,null,null,"Each Reliability Coordinator, Balancing Authority and Transmission Operator shall keep\ndata or evidence to show compliance for three years or since its last compliance audit,\nwhichever time frame is the greatest."]
["CIP Complaint",null,"PER-005-1 R2",null,"The objective is to verify that System Operators performing real-time, reliability-related tasks on the North American Bulk Electric System (BES) are competent to perform those reliability-related tasks. The competency of System Operators is critical to the reliability of the North American Bulk Electric System.",null,null,null,null,null,"Each Reliability Coordinator, Balancing Authority and Transmission Operator shall keep\ndata or evidence to show compliance for three years or since its last compliance audit,\nwhichever time frame is the greatest."]
["CIP Investigation",null,"PRC 005-1b R2",null,"The objective is to verify documentation and implement programs for the maintenance of all Protection Systems affecting the reliability of the Bulk Electric System (BES) so that these Protection Systems are kept in working order.",null,null,null,null,null,"Shall retain evidence of the implementation of its Protection System maintenance and testing program for three years. For instances where the evidence retention period specified below is shorter than the time since the last audit, the Compliance Enforcement Authority may ask an entity to provide other evidence to show that it was compliant for the full time period since the last audit. "]
["CIP Enforcement",null,"PRC 005-2 R2",null,"The objective is to verify documentation and implement programs for the maintenance of all Protection Systems affecting the reliability of the Bulk Electric System (BES) so that these Protection Systems are kept in working order. Each TO, GO and DP that use performance-based maintenance programs shall follow the proceedure indentified in Attachment A to establish  the maintenance intervals for their Protection System Components. ",null,null,null,null,null,"\nFor Requirement R2, Requirement R3, Requirement R4, and Requirement R5, the\nTransmission Owner, Generator Owner, and Distribution Provider shall each keep\ndocumentation of the two most recent performances of each distinct maintenance activity\nfor the Protection System Component, or all performances of each distinct maintenance\nactivity for the Protection System Component since the previous scheduled audit date,\nwhichever is longer."]
[null,null,"PRC 005-2 R3",null,"The objective is to verify documentation and implement programs for the maintenance of all Protection Systems affecting the reliability of the Bulk Electric System (BES) so that these Protection Systems are kept in working order. Each TO, GO and DP that use time-based maintenance programs shall maintain their equipment within the minimum maintainance activities identified in Tables for this standard.",null,null,null,null,null,"\nFor Requirement R2, Requirement R3, Requirement R4, and Requirement R5, the\nTransmission Owner, Generator Owner, and Distribution Provider shall each keep\ndocumentation of the two most recent performances of each distinct maintenance activity\nfor the Protection System Component, or all performances of each distinct maintenance\nactivity for the Protection System Component since the previous scheduled audit date,\nwhichever is longer."]
[null,null,"PRC 005-2 R4",null,"The objective is to verify documentation and implement programs for the maintenance of all Protection Systems affecting the reliability of the Bulk Electric System (BES) so that these Protection Systems are kept in working order. Each TO, GO and DP that use performance-based maintenance programs shall maintain their equipment within the minimum maintainance activities identified in Tables for this standard.",null,null,null,null,null,"\nFor Requirement R2, Requirement R3, Requirement R4, and Requirement R5, the\nTransmission Owner, Generator Owner, and Distribution Provider shall each keep\ndocumentation of the two most recent performances of each distinct maintenance activity\nfor the Protection System Component, or all performances of each distinct maintenance\nactivity for the Protection System Component since the previous scheduled audit date,\nwhichever is longer."]
[null,null,"PRC-008-0 R2",null,"The objective is to verify documentation and implementation of programs for the maintenance of all UFLS relays affecting the reliability of the Bulk Electric System (BES) so that these Protection Systems are kept in working order",null,null,null,null,null,"None specified."]
[null,null,"PRC-023-3 R2",null,"The objective is to verify  Protective relay settings  do not limit transmission loadability; do not  interfere with system operators’ ability to take remedial action to protect system reliability and; be set to reliably detect all fault conditions and protect the electrical network from these faults. The out-of-step blocking shall be set to allow tripping of phase protective relays for faults that occure during the loading conditions.",null,null,null,null,null,"The Transmission Owner, Generator Owner, and Distribution Provider shall each retain\ndocumentation to demonstrate compliance with Requirements R1 through R5 for three\ncalendar years.\n\nThe Planning Coordinator shall retain documentation of the most recent review process\nrequired in Requirement R6. The Planning Coordinator shall retain the most recent list of\ncircuits in its Planning Coordinator area for which applicable entities must comply with the\nstandard, as determined per Requirement R6."]
[null,null,"PRC-025-1 R1",null,"The objective is to verify the setting for load-responsive protective relays associated with generation Facilities are set at a level to prevent unnecessary tripping of generators during a system disturbance for conditions that do not pose a risk of damage to the associated equipment.",null,null,null,null,null,"Shall keep documentation from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation."]
[null,null,"CIP-002-x",null,"The objective is to verify the identification and documentation of the Critical Cyber Assets associated with the Critical Assets that support the reliable operation of the Bulk Electric System. These Critical Assets are to be identified through the application of a risk-based assessment.",null,null,null,null,null,"Shall retain evidence of each requirement in this\nstandard for three calendar years."]
[null,null,"CIP-003-3a R6",null,"The objective it to verify  the responsible Entity has established and documented a process of change control and configuration management for adding, modifying, replacing, or removing Critical Cyber Asset hardware or software, and implement supporting configuration management activities to identify, control and document all entity or vendor-related changes to hardware and software components of Critical Cyber Assets pursuant to the change control process.",null,null,null,null,null,"Entity shall keep all documentation and records from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation."]
[null,null,"CIP-004-x",null,"The objective is to verify  personnel having authorized cyber or authorized unescorted physical access to Critical Cyber Assets, including contractors and service vendors, have an appropriate level of personnel risk assessment, training, and security awareness.",null,null,null,null,null,"Shall retain evidence of each requirement in this\nstandard for three calendar years."]
[null,null,"CIP-005-3a R1",null,"The objective is to verify  the  responsible Entity has ensured that every Critical Cyber Asset resides within an Electronic Security Perimeter and has identified and documented the Electronic Security Perimeter(s) and all access points to the perimeter(s).",null,null,null,null,null,"Entity shall keep logs for a minimum of ninety calendar days, unless: a) longer retention is required pursuant to Standard CIP-008-3, Requirement R2; b) directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation.\n\nEntity shall keep other documents and records  equired by Standard CIP-005-3 from the previous full calendar year."]
[null,null,"CIP-005-3a R2",null,"The objective is to verify the responsible Entity  implemented and documented the organizational processes and technical and procedural mechanisms for control of electronic access at all electronic access points to the Electronic Security Perimeter(s).",null,null,null,null,null,"Entity shall keep logs for a minimum of ninety calendar days, unless: a) longer retention is required pursuant to Standard CIP-008-3, Requirement R2; b) directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation.\n\nEntity shall keep other documents and records  equired by Standard CIP-005-3 from the previous full calendar year."]
[null,null,"CIP-005-3a R3",null,"The objective is to verify the responsible Entity implemented and documented an electronic or manual process(es) for monitoring and logging access at access points to the Electronic Security Perimeter(s) twenty-four hours a day, seven days a week.",null,null,null,null,null,"Entity shall keep logs for a minimum of ninety calendar days, unless: a) longer retention is required pursuant to Standard CIP-008-3, Requirement R2; b) directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation.\n\nEntity shall keep other documents and records  equired by Standard CIP-005-3 from the previous full calendar year."]
[null,null,"CIP-005-3a R4",null,"The objective is to verify the responsible Entity performed a cyber vulnerability assessment, which includes R4.1- R4.5, of the electronic access points to the Electronic Security Perimeter(s) at least annually . ",null,null,null,null,null,"Entity shall keep logs for a minimum of ninety calendar days, unless: a) longer retention is required pursuant to Standard CIP-008-3, Requirement R2; b) directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation.\n\nEntity shall keep other documents and records  equired by Standard CIP-005-3 from the previous full calendar year."]
[null,null,"CIP-006-3c R1",null,"The objective is to verify the responsible Entity documented, implemented, and maintained a physical security plan, approved by the senior manager or delegate(s).",null,null,null,null,null,"All documentation and records from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation."]
[null,null,"CIP-006-3c R2",null,"The objective is to verify the Cyber Assets that authorize and/or log access to the Physical Security Perimeter(s), exclusive of hardware at the Physical Security Perimeter access point such as electronic lock control mechanisms and badge readers, be protected from unauthorized physical access and meet R2.2.",null,null,null,null,null,"All documentation and records from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation."]
[null,null,"CIP-006-3c R4",null,"The objective is to verify the responsible Entity documented and implemented the operational and procedural controls to manage physical access at all access points to the Physical Security Perimeter(s) twenty-four hours a day, seven days a week. ",null,null,null,null,null,"All documentation and records from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation."]
[null,null,"CIP-006-3c R5",null,"The objective is to verify the responsible Entity documented and implemented the technical and procedural controls for monitoring physical access at all access points to the Physical Security Perimeter(s) twenty-four hours a day, seven days a week, and unauthorized access attempts were reviewed immediately and handled in accordance with the procedures specified in Requirement CIP-008-3.",null,null,null,null,null,"All documentation and records from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation."]
[null,null,"CIP-006-3c R6",null,"The objective is to verify logging  recorded sufficient information to uniquely identify individuals and the time of access twenty-four hours a day, seven days a week. Also, the Responsible Entity  implemenedt and documented the technical and procedural mechanisms for logging physical entry at all access points to the Physical Security Perimeter(s).",null,null,null,null,null,"All documentation and records from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation."]
[null,null,"CIP-007-3a R1",null,"The objective is  to ensured that new Cyber Assets and significant changes to existing Cyber Assets within the Electronic Security Perimeter did not adversely affect existing cyber security controls. ",null,null,null,null,null,"All documentation and records from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation."]
[null,null,"CIP-007-3a R2",null,"The objective is to verify that processes are documented and implemented to ensure that only those ports and services required for normal and emergency operations are enabled.",null,null,null,null,null,"All documentation and records from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation."]
[null,null,"CIP-007-3a R3",null,"The objective is to verify that that a formal documented and implemented security patch management program exists to track, evaluate, test and install applicable cyber security software patches for all ESP cyber assets",null,null,null,null,null,"All documentation and records from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation."]
[null,null,"CIP-007-3a R4",null,"The objective is to verify that anti-virus software and other malicious software (“malware”) prevention tools to detect, prevent, deter, and mitigate the introduction, exposure, and propagation of malware on all Cyber Assets within the Electronic Security Perimeter(s) are implemented.",null,null,null,null,null,"All documentation and records from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation.\n\nR5.1.2 - Retain security–related system event logs for ninety\ncalendar days, unless longer retention is required pursuant to Standard CIP-008-3\nRequirement R2."]
[null,null,"CIP-007-3a R5",null,"The objective is to verify that unauthorized system access is minimized by implemented, and documented technical and procedural controls that enforce access authentication and accountability for all user activity. ",null,null,null,null,null,"All documentation and records from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation.\n\nR6.4 - Retain security–related system event logs for ninety\ncalendar days, unless longer retention is required pursuant to Standard CIP-008-3\nRequirement R2."]
[null,null,"CIP-007-3a R6",null,"The objective is to verify  that all Cyber Assets within the Electronic Security Perimeter implemented automated tools or\norganizational process controls to monitor, review, and document system events that are related to cyber security and retain the logs for a minimum of 90 days.",null,null,null,null,null,"All documentation and records from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation."]
[null,null,"CIP-007-3a R8",null,"The objective is to verify the responsible Entity performed a cyber vulnerability assessment of all Cyber Assets within the Electronic Security Perimeter at least annually. ",null,null,null,null,null,"R1.1 - Shall keep relevant documentation related to Cyber Security Incidents reportable per Requirement R1.1 for three calendar years.\n\nAll other documentation and records shall be retained from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation."]
[null,null,"CIP-008-3 R1",null,"The objective is to verify the responsible Entity developed and maintained a Cyber Security Incident response plan and implemented the plan in response to Cyber Security Incidents. ",null,null,null,null,null,"Shall keep documentation from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation."]
[null,null,"CIP-009-3 R1",null,"The objective is to verify the responsible Entity created and annually reviewed the recovery plan(s) for Critical Cyber Assets.",null,null,null,null,null,"Shall retain evidence of each requirement in this\nstandard for three calendar years."]
[null,null,"CIP-010-1 R1",null,"The objective is  to ensured that new Cyber Assets and significant changes to existing Cyber Assets within the Electronic Security Perimeter did not adversely affect existing cyber security controls. ",null,null,null,null,null,"Shall retain evidence of each requirement in this\nstandard for three calendar years."]
[null,null,"CIP-007-5 R1",null,"The objective is to verify that processes are documented and implemented to ensure that only those ports and services required for normal and emergency operations are enabled.",null,null,null,null,null,"Shall retain evidence of each requirement in this\nstandard for three calendar years."]
[null,null,"CIP-007-5 R2",null,"The objective is to verify that that a formal documented and implemented security patch management program exists to track, evaluate, test and install applicable cyber security software patches for all ESP cyber assets",null,null,null,null,null,"Shall retain evidence of each requirement in this\nstandard for three calendar years."]
[null,null,"CIP-007-5 R3",null,"The objective is to verify that anti-virus software and other malicious software (“malware”) prevention tools to detect, prevent, deter, and mitigate the introduction, exposure, and propagation of malware on all Cyber Assets within the Electronic Security Perimeter(s) are implemented.",null,null,null,null,null,"Shall retain evidence of each requirement in this\nstandard for three calendar years."]
[null,null,"CIP-007-5 R4",null,"The objective is to verify  that all Cyber Assets within the Electronic Security Perimeter implemented automated tools or\norganizational process controls to monitor, review, and document system events that are related to cyber security and retain the logs for a minimum of 90 days.",null,null,null,null,null,"Shall retain evidence of each requirement in this\nstandard for three calendar years."]
[null,null,"CIP-007-5 R5",null,"The objective is to verify that unauthorized system access is minimized by implemented, and documented technical and procedural controls that enforce access authentication and accountability for all user activity. ",null,null,null,null,null,"Shall retain evidence of each requirement in this\nstandard for three calendar years."]
[null,null,"Other",null,"Text",null,null,null,null,null,"Text"]