NERC CIP CIP-003 R2 Att1 S5: CIP-003-9 R2 Att1 S5: Low impact plan Section 5: Transient Cyber Asset and Removable Media malicious code mitigation

Except under CIP Exceptional Circumstances, implement plans to mitigate the introduction of malicious code to low impact BES Cyber Systems through Transient Cyber Assets or Removable Media: for entity-managed Transient Cyber Assets use antivirus, application whitelisting or another method, ongoing or on demand; for third-party-managed Transient Cyber Assets review the party's antivirus level or process, whitelisting, live read-only operating systems, hardening or another method before connection and decide on and apply any additional mitigation; for Removable Media detect malicious code using a Cyber Asset other than a BES Cyber System and mitigate detected code before connection.