R1 - Configuration Change Management

CIP-010 R1 mandates that bulk power owners and operators establish a formal configuration-change management program for all cyber-security-relevant assets. The rule requires documented procedures for planning, approving, testing, implementing, and recording changes, as well as maintaining a current baseline of system configurations and ensuring that any deviation is promptly identified and corrected.