CIP-010-4

R1 · Configuration change management

What it means. For medium impact BES Cyber Systems and their associated EACMS, PACS and Protected Cyber Assets: develop a baseline configuration, individually or by group, listing the operating system or firmware, intentionally installed commercial or open-source application software, custom software, logical network accessible ports, and security patches applied (Part 1.1); authorize and document changes that deviate from the baseline (Part 1.2); update the baseline within 30 calendar days of completing such a change (Part 1.3); and, for each such change, determine beforehand which CIP-005 and CIP-007 controls could be affected, verify afterwards that they were not adversely affected, and document the result (Part 1.4). For the BES Cyber Systems and their associated EACMS and PACS, before a baseline change to operating system or firmware, application software or security patches, verify the identity of the software source and the integrity of the software when the source makes a method available (Part 1.6). Testing in a test environment (Part 1.5) applies only to high impact.

Evidence an auditor expects. Baseline records in a spreadsheet or asset management system; change requests with electronic authorization; updated baselines dated within 30 days of each change; lists of controls verified with dated results; and change records or a documented automatic mechanism showing software source and integrity were verified.

R2 · Configuration monitoring

What it means. Monitoring for baseline changes at least every 35 calendar days applies only to high impact BES Cyber Systems and their associated EACMS and Protected Cyber Assets. It does not apply at the medium impact level.

Evidence an auditor expects. Not applicable at medium impact.

R3 · Vulnerability assessments

What it means. For medium impact BES Cyber Systems and their associated EACMS, PACS and Protected Cyber Assets, conduct a paper or active vulnerability assessment at least once every 15 calendar months (Part 3.1), and document the results with an action plan to remediate or mitigate the vulnerabilities found, its planned completion date and the status of each action item (Part 3.4). The 36-month active assessment (Part 3.2) and the assessment before adding a new Cyber Asset (Part 3.3) apply only to high impact.

Evidence an auditor expects. Documents listing each assessment date, the controls assessed and the method or tool output, and the action plan with proposed completion dates and status records such as meeting minutes, work orders or a tracking spreadsheet.

R4 · Transient Cyber Assets and Removable Media

What it means. For high and medium impact BES Cyber Systems and associated Protected Cyber Assets, implement, except under CIP Exceptional Circumstances, documented plans covering Attachment 1: for Transient Cyber Assets the entity manages, management approach, authorized users, locations and uses, software vulnerability mitigation, malicious code mitigation and unauthorized use mitigation; for Transient Cyber Assets managed by another party, software vulnerability and malicious code mitigation, such as reviewing that party's patching or antivirus practices, and a decision on whether additional mitigation is needed before connecting; and for Removable Media, authorized users and locations, detection of malicious code using a Cyber Asset other than a BES Cyber System or Protected Cyber Asset, and mitigation of any threat found before connecting.

Evidence an auditor expects. The documented plans with evidence of implementation per Attachment 2, or, if the entity uses no Transient Cyber Assets or Removable Media, a statement, policy or other document saying so.

For inverter-based plants

An inverter-based plant whose BES Cyber Systems are all low impact under CIP-002 is exempt from CIP-010-4 under Section 4.2.3.5; laptops and USB media used at such a site fall under CIP-003 Attachment 1 Section 5 instead.