R3 - Cyber Security Incident Response Plan Review and Update

The R3 requirement in NERC CIP-008 mandates that each registered entity maintain a cyber security incident response plan and conduct a formal review and update at least annually or after any significant incident. The review must incorporate lessons learned, changes in technology or threat landscape, and be approved by designated management.