What it asks for. CIP-010 is a NERC Critical Infrastructure Protection standard for the North American bulk electric system. It requires responsible entities to maintain baseline configurations for in-scope BES Cyber Systems, authorise and document changes, monitor for unauthorised changes on higher impact systems, perform periodic vulnerability assessments and protect transient cyber assets and removable media.
In practice. Entities keep baselines covering operating systems, software, ports and patches, verify security controls before and after changes, and run vulnerability assessments at the required intervals with documented remediation plans. Laptops and USB devices used in the environment are managed under defined controls. Evidence includes baseline records, change tickets, monitoring results, assessment reports and transient device procedures.
Common gaps. Baselines drift from reality when changes are made outside the process. Transient devices brought in by vendors are a recurring source of findings.