[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nerc-cip\u002Fcip-010":3},{"item":4,"lessons":16,"controls":46,"related":75},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nerc-cip","cip-010","CIP-010-4","CIP-010: Configuration Change Management and Vulnerability Assessments",7,"North American Electric Reliability Corporation (NERC)","**What it asks for.** CIP-010 is a NERC Critical Infrastructure Protection standard for the North American bulk electric system. It requires responsible entities to maintain baseline configurations for in-scope BES Cyber Systems, authorise and document changes, monitor for unauthorised changes on higher impact systems, perform periodic vulnerability assessments and protect transient cyber assets and removable media.\n\n**In practice.** Entities keep baselines covering operating systems, software, ports and patches, verify security controls before and after changes, and run vulnerability assessments at the required intervals with documented remediation plans. Laptops and USB devices used in the environment are managed under defined controls. Evidence includes baseline records, change tickets, monitoring results, assessment reports and transient device procedures.\n\n**Common gaps.** Baselines drift from reality when changes are made outside the process. Transient devices brought in by vendors are a recurring source of findings.",null,"https:\u002F\u002Fwww.nerc.com\u002Fpa\u002FStand\u002FPages\u002FReliabilityStandards.aspx","See the NERC standards","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42],{"slug":19,"title":20,"published_at":21},"critical-flaws-in-grid-protection-alliance-software-enable-unauthenticated-rce","Critical Flaws in Grid Protection Alliance Software Enable Unauthenticated RCE","2026-10-08T18:21:30.364+00:00",{"slug":23,"title":24,"published_at":25},"abb-pcm600-flaws-enable-privilege-escalation-and-file-overwrite-in-energy-infrastructure","ABB PCM600 Flaws Enable Privilege Escalation and File Overwrite in Energy Infrastructure","2026-10-01T18:22:36.813+00:00",{"slug":27,"title":28,"published_at":29},"third-party-ics-integrator-access-exposes-critical-infrastructure-to-foreign-cyber-threats","Third-Party ICS Integrator Access Exposes Critical Infrastructure to Foreign Cyber Threats","2026-09-23T22:21:34.789+00:00",{"slug":31,"title":32,"published_at":33},"critical-vulnerabilities-in-hitachi-energy-fcp-threaten-industrial-control-systems","Critical Vulnerabilities in Hitachi Energy FCP Threaten Industrial Control Systems","2026-09-17T19:20:57.652+00:00",{"slug":35,"title":36,"published_at":37},"foreign-equipment-in-us-energy-grid-triggers-national-emergency-order","Foreign Equipment in U.S. Energy Grid Triggers National Emergency Order","2026-08-26T22:20:25.836+00:00",{"slug":39,"title":40,"published_at":41},"hard-coded-credentials-expose-schneider-electric-protection-relays-to-unauthorized-access","Hard-Coded Credentials Expose Schneider Electric Protection Relays to Unauthorized Access","2026-07-09T18:22:38.408+00:00",{"slug":43,"title":44,"published_at":45},"siemens-siprotec-5-vulnerable-to-malicious-file-uploads-via-digsi-5-protocol","Siemens SIPROTEC 5 Vulnerable to Malicious File Uploads via DIGSI 5 Protocol","2026-06-23T18:22:23.652+00:00",[47,51,56,61,66,71],{"slug":48,"name":49,"problem":50,"stories":9},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",{"slug":52,"name":53,"problem":54,"stories":55},"patch-management","Automated patch management","Known holes get closed in days, not months.",5,{"slug":57,"name":58,"problem":59,"stories":60},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",3,{"slug":62,"name":63,"problem":64,"stories":65},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",2,{"slug":67,"name":68,"problem":69,"stories":70},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",1,{"slug":72,"name":73,"problem":74,"stories":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[76,81,85,90,96,101,105,109],{"family":77,"item":78,"code":79,"title":80,"together":9},"nist-sp","800-82","SP 800-82","SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security",{"family":5,"item":82,"code":83,"title":84,"together":55},"cip-007","CIP-007-6","CIP-007: Systems Security Management",{"family":86,"item":87,"code":88,"title":89,"together":55},"iec-62443","3-3","62443-3-3","IEC 62443-3-3: System security requirements and security levels",{"family":91,"item":92,"code":93,"title":94,"together":95},"nist-800-53","si-2","SI-2","Flaw Remediation",4,{"family":97,"item":98,"code":99,"title":100,"together":95},"cis","7","Control 7","Continuous Vulnerability Management",{"family":91,"item":102,"code":103,"title":104,"together":60},"ac-6","AC-6","Least Privilege",{"family":97,"item":106,"code":107,"title":108,"together":60},"12","Control 12","Network Infrastructure Management",{"family":91,"item":110,"code":111,"title":112,"together":60},"ac-2","AC-2","Account Management"]