Development and Implementation of Practical Processes for NERC CIP-010 Compliance Evaluation

This paper presents the considerations, challenges, and solutions in the development and implementation of practical processes to enable compliance with CIP-010-4 for Protection and Control departments. The aspects to meeting these requirements, such as strategies for baseline establishment, approaches to obtaining device configuration data, and configuration comparison methodologies, are explored using the real-world experiences of two organizations both faced with significant numbers of BES Cyber Assets that were applicable to the standard. In parallel with the technical and logistical considerations, the actual processes and solutions implemented at these organizations are presented, along with potential future improvements and applications. The real-world experiences of the two utilities discussed in this paper highlight both the aspects that must be considered for the effective development of processes, as well as possible paths for the implementation of solutions to meet CIP-010 requirements.