Protect utility and pipeline servers under NERC CIP.

No. Patch evaluation, mitigation plans and CIP evidence stay with your team and the tools you run today. Mimic Networks adds enforcement on the servers it protects: changes outside a server's known-good profile stop at the point of execution, including on servers with no connection to the management plane. On connected servers, each blocked change lands in DashCam with what was attempted, by which process and when.

Yes. A protected server with no connection to the management plane stays in enforcement. Upgrades, updates and changes to its known-good profile go in from physical media, such as a USB drive or CD. Plan those updates the way you plan any change at a control center or substation: on a schedule, with the media checked before it goes in.

CIP-010-5, approved in FERC Order No. 919, moves the test from deviations against a documented baseline to changes that alter how cyber security controls behave. ReliabilityFirst lists its compliance date as 1 July 2028. Mimic's check doesn't depend on that wording: a change to a protected server that wasn't authorized stops at the point of execution under either version.

The Windows and Linux servers in and around the control center. Start with EMS and SCADA management servers and the historians beside them. Then add EACMS and PACS servers, jump servers, patch servers and corporate servers that touch the control network. Controllers, field devices, workstations and the OT network stay out of scope, and each server needs Windows Server 2016 or later, or Red Hat Enterprise Linux 8 or later.