Please answer these simple 10 questions.

This survey will help determine if your security and governance would improve with YouAttest.

Does your enterprise have a system to automate detection of identity risks, such as over-privileged accounts, to support BES cyber system security? NERC CIP Standard CIP-007-7 R5

Yes

System Security Management: Implement logical access controls, including unique user IDs, authentication, and least privilege to prevent unauthorized access to BES Cyber Systems.

Is there an assigned resource to oversee and implement access control policies for BES Cyber Assets? NERC CIP Standard CIP-004-7 R1/R2

Yes

Personnel & Training: Assign roles for access management, including screening, training, and revocation procedures for personnel with BES access.

Does your organization have policies and practices to allocate appropriate access to BES Cyber Systems and Electronic Security Perimeters? NERC CIP Standard CIP-005-7 R1/R2

Yes

Electronic Security Perimeter(s): Establish ESPs with access controls at Electronic Access Points (EAPs), including authentication and monitoring for inbound/outbound traffic.

Does your organization have a quantified access request/approval process for BES resources? CIP-005-7 R2.4/R2.5

Yes

Electronic Security Perimeter(s): Manage and monitor remote access sessions, including vendor access, with approval processes and session termination.

Does your organization have procedures to detect and report major cybersecurity incidents involving unauthorized access to BES systems? NERC CIP Standard CIP-008-6 R1/R2

Yes

Incident Reporting and Response Planning: Develop and test incident response plans, including detection, reporting to authorities, and mitigation for BES compromises.

Does your enterprise have automated methods to review access controls for BES systems in contingency or recovery operations? NERC CIP Standard CIP-009-6 R1

Yes

Recovery Plans for BES Cyber Systems: Establish recovery plans including access controls to restore BES functions post-incident.

Does your enterprise perform periodic evaluations of access controls and configurations for BES Cyber Systems? CIP-010-4 R1/R4

Yes

Configuration Change Management & Vulnerability Assessments: Maintain baselines, authorize changes, and conduct periodic vulnerability scans (every 15 months) including access impacts.

Does your enterprise have the ability to review group/role-based access to physical and electronic controls for BES facilities? NERC CIP Standard CIP-006-7 R4/CIP-005-7 R1

Yes

Physical Security & ESPs: Control physical access to BES facilities and integrate with electronic access monitoring for authorized personnel.

Does your organization ensure individual access to BES systems is granted, reviewed, and revoked appropriately? NERC CIP Standard CIP-007-7 R5.1/R5.3

Yes

System Security Management: Use unique identification for users, disable dormant accounts after 90 days, and enforce password policies.

Does your organization have an established method to generate audit trails and reports for NERC CIP access compliance? NERC CIP Standard CIP-007-7 R6/CIP-010-4 R2

Yes

System Security Management & Config Mgmt: Monitor and log access events; maintain change logs for baseline deviations and unauthorized modifications.

Full Name *

Email *

Phone *

Business *

GRC Partner Email(Optional)