CIP-010-4: baseline configurations and change control, software source and integrity verification, 35-day configuration monitoring, vulnerability assessments, and Transient Cyber Assets and Removable Media.
Baseline configurations with five required items, authorized and documented changes, baseline updates within 30 days, security control verification, test-environment testing for high impact, and software source and integrity checks.
Monitoring high impact systems at least every 35 calendar days for changes to the baseline configuration and investigating unauthorized changes.
Paper or active vulnerability assessments every 15 calendar months, active assessments every 36 months for high impact systems, assessment of new Cyber Assets before production, and documented remediation plans.
The plan for laptops, test equipment and USB media that connect temporarily to high and medium impact systems, covering entity-managed devices, third-party devices and removable media under Attachment 1.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.