Operating system(s) (including version) or firmware where no independent operating system exists; any commercially available or open-source application software (including version) intentionally installed; any custom software installed; any logical network accessible ports; and any security patches applied. Verify the Responsible Entity has a baseline configuration for each Applicable System, individually or by group, which includes: Operating system(s) (including version) or firmware where no independent operating system exists; any commercially available or open-source application software (including version) intentionally installed; any custom software installed; any logical network accessible ports; and any security patches applied. CIP-010-1 Table R1 Configuration Change Management – Part Applicable Systems Requirements Measures 1.2 High Impact BES Cyber Systems Authorize and document changes Examples of evidence may include, but and their associated: that deviate from the existing are not limited to: EACMS; baseline configuration. A change request record and PACS; and associated electronic PCA authorization (performed by the individual or group with the Medium Impact BES Cyber authority to authorize the Systems and their associated: change) in a change management system for each PACS; and change; or PCA Documentation that the change was performed in accordance with the requirement. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required):
Operating system(s) (including version) or firmware where no independent operating system exists; any commercially available or open-source application software (including version) intentionally installed; any custom software installed; any logical network accessible ports; and any security patches applied. Verify the Responsible Entity has a baseline configuration for each Applicable System, individually or by group, which includes: Operating system(s) (including version) or firmware where no independent operating system exists; any commercially available or open-source application software (including version) intentionally installed; any custom software installed; any logical network accessible ports; and any security patches applied. CIP-010-1 Table R1 – Configuration Change Management Part Applicable Systems Requirements Measures 1.2 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Cyber Systems and their associated: PACS; and PCA Authorize and document changes that deviate from the existing baseline configuration. Examples of evidence may include, but are not limited to: A change request record and associated electronic authorization (performed by the individual or group with the authority to authorize the change) in a change management system for each change; or Documentation that the change was performed in accordance with the requirement. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required):
RSAW_CIP-010-1_BC.docx