NERC CIP-010: configuration change management and vulnerability assessments, explained

Section 4.1 names seven "Responsible Entity" functional types: Balancing Authority, a Distribution Provider that owns specific load-shedding, Remedial Action Scheme, protection or blackstart facilities, Generator Operator, Generator Owner, Reliability Coordinator, Transmission Operator and Transmission Owner. Depending on the specific requirement part, the standard applies to each entity's BES Cyber Systems categorized as high or medium impact under the separate CIP-002 identification process, together with their associated Electronic Access Control or Monitoring Systems (EACMS), Physical Access Control Systems (PACS) and Protected Cyber Assets (PCA) — the standard's own examples of EACMS include "firewalls, authentication servers, and log monitoring and alerting systems."

Five exemption categories (Section 4.2.3) take Cyber Assets out of scope entirely: facilities regulated by the Canadian Nuclear Safety Commission; communication networks and data links between discrete Electronic Security Perimeters; systems regulated by the US Nuclear Regulatory Commission under 10 C.F.R. § 73.54; for Distribution Providers, systems and equipment outside the standard's Section 4.2.1 scope; and any Responsible Entity that identifies it has no high- or medium-impact BES Cyber Systems under CIP-002 at all.

Requirement R1 (Violation Risk Factor: Medium) requires one or more documented processes covering six table parts:

Part 1.6's own note confirms it doesn't require renegotiating existing vendor contracts, and excludes contract terms and vendor performance from its scope — the same carve-out CIP-013's supply chain standard uses (see NERC CIP-013-2).

Requirement R2 (Medium VRF) is narrower in scope than R1 — it applies only to high-impact BES Cyber Systems and their associated EACMS and PCA, not PACS and not medium-impact systems. Its single table part, 2.1, requires monitoring "at least once every 35 calendar days for changes to the baseline configuration," with any detected unauthorized change documented and investigated. Where R1 governs changes made through the authorized process, R2 is the control that is meant to catch changes that happened outside it.

Requirement R3 (Medium VRF) sets concrete, numeric cadences rather than a general "regularly" obligation:

• Part 3.1 — a paper or active vulnerability assessment "at least once every 15 calendar months," for high- and medium-impact systems and their associated EACMS, PACS and PCA.
• Part 3.2 — for high-impact systems only, where technically feasible, an active vulnerability assessment "at least once every 36 calendar months," performed in a test environment (or a production test run in a way that minimizes adverse effects) that models the production baseline.
• Part 3.3 — before adding a new applicable Cyber Asset to production, an active vulnerability assessment of that asset, with exceptions for CIP Exceptional Circumstances and like-for-like replacements modeling an existing baseline.
• Part 3.4 — documenting assessment results and an action plan to remediate or mitigate identified vulnerabilities, including a planned completion date and execution status.

The standard's own Violation Severity Level table shows how closely these deadlines are enforced: a Part 3.1 assessment more than 15 but less than 18 months since the last one is a Lower violation; 18-21 months is Moderate; 21-24 months is High; and beyond 24 months is Severe. Part 3.2's 36-month active assessment cadence escalates on the same pattern, at 36-39, 39-42, 42-45 and beyond-45-month bands.

Requirement R4 (Medium VRF) requires a documented plan, built from Attachment 1, for every Transient Cyber Asset and piece of Removable Media connected to high- or medium-impact BES Cyber Systems and associated PCA — laptops, diagnostic tools and USB media a vendor or technician brings on-site, not systems permanently part of the environment:

• Section 1 (assets the Responsible Entity manages): authorize users, locations and uses; mitigate software vulnerabilities (patching, read-only boot media, hardening, or another method); mitigate introduction of malicious code (antivirus, application whitelisting, or another method); and mitigate unauthorized use (physical access restriction, full-disk encryption, multi-factor authentication, or another method).
• Section 2 (assets a third party manages): a lighter, review-based version of the same two mitigation objectives — reviewing the other party's patching and anti-malware practices rather than directly controlling the asset — plus a requirement to determine and implement any additional mitigations needed before connecting it.
• Section 3 (Removable Media): authorize users and locations, and detect and mitigate malicious code on the media using a Cyber Asset other than a BES Cyber System or PCA, before connecting it to one.

Evidence for every R1-R4 requirement must be retained for three calendar years, per the standard's Compliance section, and the standard carries no Regional Variances.

CIP-010-4 is the standard enforced today, but a successor is already locked in. On 19 March 2026 the Federal Energy Regulatory Commission issued Order No. 919 (Docket No. RM24-8-000), stating it "approves 11 modified Critical Infrastructure Protection (CIP) Reliability Standards" and explicitly listing "CIP-010-5 (Cyber Security — Configuration Change Management and Vulnerability Assessments)" alongside CIP-002-7, CIP-003-10, CIP-004-8, CIP-005-8, CIP-006-7.1, CIP-007-7.1, CIP-008-7.1, CIP-009-7.1, CIP-011-4.1 and CIP-013-3 — published in the Federal Register on 24 March 2026 at 91 FR 13957, with the order stating "this final rule is effective May 26, 2026." The package also approves four new NERC Glossary definitions — Cyber System, Management Interface, Shared Cyber Infrastructure and Virtual Cyber Asset — needed to let the CIP suite apply cleanly to virtualized infrastructure, plus 18 revised definitions. Order No. 919 separately approved replacing most "technical feasibility exception" language with a self-implementing "per system capability" standard, after NERC reported a significant decrease in submitted technical feasibility exceptions under the prior wording.

Per NERC's own implementation plan, quoted directly in the order, the revised standards "will become effective on the later of April 1, 2026, or the first day of the first calendar quarter that is 24 months after the effective date of the applicable governmental authority's order" — which, from the order's 26 May 2026 effective date, computes to 1 July 2028. Responsible entities may elect early adoption at six, 12 or 18 months after that date instead of waiting for the mandatory date. NERC's final draft of CIP-010-5 (April 2024) extends Applicability and exemption language from discrete "Cyber Assets" to the broader "Cyber Systems" concept, to accommodate Shared Cyber Infrastructure hosting virtual machines for multiple BES Cyber Systems — this guide has not independently reviewed every redlined Requirement part, so treat the exact wording changes to R1-R4 as something to confirm against NERC's and FERC's own published CIP-010-5 text before compliance planning.