NERC CIP CIP-003 R1.1: CIP-003-9 R1.1: Cyber security policies for high and medium impact systems

Review and obtain CIP Senior Manager approval at least every 15 calendar months of documented cyber security policies that together cover, for high and medium impact BES Cyber Systems: personnel and training (CIP-004), Electronic Security Perimeters including Interactive Remote Access (CIP-005), physical security (CIP-006), system security management (CIP-007), incident reporting and response planning (CIP-008), recovery plans (CIP-009), configuration change management and vulnerability assessments (CIP-010), information protection (CIP-011), and declaring and responding to CIP Exceptional Circumstances.