NERC CIP CIP-003 R2 Att1 S4: CIP-003-9 R2 Att1 S4: Low impact plan Section 4: Cyber Security Incident response

Maintain Cyber Security Incident response plans by asset or group covering: identification, classification and response; determining whether an incident is reportable and notifying the E-ISAC unless prohibited by law; roles and responsibilities; incident handling; testing at least every 36 calendar months by an actual reportable incident, a drill or tabletop, or an operational exercise; and updating the plan if needed within 180 calendar days after a test or actual reportable incident.