1.1 High Impact BES Cyber Systems Develop a baseline configuration, Examples of evidence may include, but and their associated: individually or by group, which are not limited to: shall include the following items: A spreadsheet identifying the PACS; and Operating system(s) required items of the baseline PCA configuration for each Cyber (including version) or firmware where no Asset, individually or by group; Medium Impact BES or independent operating Systems and their associated: system exists; A record in an asset EACMS; Any commercially available or management system that PACS; and open-source application identifies the required items of software (including the baseline configuration for PCA version) intentionally each Cyber Asset, individually installed; or by group. Any custom software installed; Any logical network accessible ports; and Any security patches applied. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. Relevant Revision Page(s) Description of or Document or Applicability of File Name Document Title Version Date Section(s) Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-010-2, R1, Part 1.1 This section to be completed by the Compliance Enforcement Authority Verify that the Responsible Entity has documented one or more processes that include the
1.1 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Systems and their associated: EACMS; PACS; and PCA Develop a baseline configuration, individually or by group, which shall include the following items: Operating system(s) (including version) or firmware where no independent operating system exists; Any commercially available or open-source application software (including version) intentionally installed; Any custom software installed; Any logical network accessible ports; and Any security patches applied. Examples of evidence may include, but are not limited to: A spreadsheet identifying the required items of the baseline configuration for each Cyber Asset, individually or by group; or A record in an asset management system that identifies the required items of the baseline configuration for each Cyber Asset, individually or by group. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-010-2, R1, Part 1.1 This section to be completed by the Compliance Enforcement Authority Verify that the Responsible Entity has documented one or more processes that include the
RSAW%20CIP-010-2_2015_v1.docx