NERC CIP CIP-008 R2.2: CIP-008-6 R2.2: Use the plan and document deviations

Use the plans when responding to a Reportable Cyber Security Incident, to an incident that attempted to compromise an applicable system, or when performing an exercise, and document deviations from the plans taken during the response or exercise.