CIP-003-9 R1 Cyber security policies
The documented cyber security policies, reviewed and approved by the CIP Senior Manager every 15 calendar months, covering nine topics for high and medium impact systems and seven for low impact assets.
CIP-003 Security management controls
CIP-003-9: cyber security policies, the CIP Senior Manager and delegations, and the cyber security plan that is the main control set for low impact BES Cyber Systems.
CIP-003-9 R2 Low impact cyber security plan
The cyber security plan for assets containing low impact BES Cyber Systems, built from the six Attachment 1 sections, including the vendor electronic remote access controls added in CIP-003-9.
CIP-003-9 R3 CIP Senior Manager and R4 delegation of authority
Naming the single CIP Senior Manager accountable for the CIP program and documenting any delegations of that manager's approval authority, with 30-day update windows for both.
