What does the command `csrutil clear` do?
From System Integrity Protection – Adding another layer to Apple’s security model:


  When csrutil clear is run, SIP goes back to its factory-default settings. That means SIP is enabled if it was disabled previously and any custom configuration is cleared out.


The custom configuration consists of a list of IP addresses of allowed NetBoot sources.