Configuration management is one of the most critical pillars of NERC CIP compliance for electric utilities. NERC CIP-010 sets the standard for how utilities must document, control, and monitor changes to their industrial control systems and associated cyber assets. As we move through 2026, utilities face increasing pressure to demonstrate mature, auditable configuration management programs that go beyond paper compliance and reflect real operational practices.
This guide walks through the key requirements of CIP-010, practical implementation strategies, and how to build a configuration management program that actually works.
Understanding NERC CIP-010: The Baseline Configuration Standard
CIP-010 requires that each Responsible Entity establish and maintain a baseline configuration for all Bulk Electric System (BES) cyber assets and associated cyber assets. A baseline configuration is a documented, approved set of specifications for a system or device—essentially a snapshot of what "correct" looks like.
The baseline must include:
- Hardware and software inventory
- Operating system and application versions
- Security patches and firmware levels
- Configuration settings and parameters
- Network connectivity and access controls
- Approved ports and services
For many utilities, the challenge isn't understanding what a baseline is—it's maintaining one across hundreds or thousands of devices, many of which are decades old and operate in environments where downtime is not an option. The baseline must be documented, but it must also be realistic and achievable within your operational constraints.
Change Management: The Heart of CIP-010 Compliance
A baseline is only useful if you control what changes to it. CIP-010 requires a formal change management process that covers all modifications to BES cyber assets and associated cyber assets. This process must include:
- Change authorization: A documented approval process before any change is made
- Change documentation: Records of what changed, when, why, and who approved it
- Testing and validation: Verification that changes don't introduce vulnerabilities or break systems
- Rollback procedures: Plans to revert changes if something goes wrong
- Emergency change procedures: A defined process for urgent changes that can't wait for normal approval cycles
Many utilities struggle with emergency changes. NERC recognizes that sometimes you need to patch a critical vulnerability or restore a failed system immediately. CIP-010 allows for expedited change procedures, but they must still be documented and reviewed after the fact. The key is having a clear definition of what qualifies as an emergency and a documented process for handling it.
Vulnerability Assessments and Patch Management
CIP-010 requires that utilities perform vulnerability assessments on BES cyber assets and associated cyber assets. These assessments must identify security weaknesses and inform your patching strategy.
A vulnerability assessment program should include:
- Regular scanning of systems for known vulnerabilities
- Review of vendor security advisories and threat intelligence
- Prioritization of vulnerabilities based on severity and exploitability
- A documented patch management process that balances security with operational stability
- Testing of patches in a controlled environment before deployment to production
The tension between security and stability is real in utility