CIP-007-6 R1 Ports and services
Enabling only the logical network ports that are needed, with documented need, and protecting against use of unnecessary physical input and output ports.
CIP-007 Systems security management
CIP-007-6: ports and services, security patch management on a 35-day cycle, malicious code prevention, security event logging and review, and system access control including passwords.
CIP-007-6 R2 Security patch management
The patch management process: identifying patch sources, evaluating patches at least every 35 calendar days, then applying them, or creating or revising a dated mitigation plan within the next 35 days.
CIP-007-6 R3 Malicious code prevention
Methods to deter, detect or prevent malicious code, mitigation of detected malicious code, and a process for keeping signatures or patterns current where those methods use them.
CIP-007-6 R4 Security event monitoring
Logging successful logins, failed access attempts and detected malicious code, alerting on malicious code and logging failures, keeping 90 days of logs, and reviewing log samples every 15 days for high impact systems.
CIP-007-6 R5 System access control
Authentication enforcement, generic and shared account inventories, default password changes, password length and complexity, 15-month password changes, and limits or alerts on failed logins.
