What vulnerability management do auditors accept at energy utilities?

For North American bulk electric system assets, auditors accept vulnerability management that follows a documented process and leaves dated records. NERC CIP-007 sets a 35-day evaluate-then-act cycle for security patches, and CIP-010 sets assessment cadences. A dated mitigation plan counts as an action when you cannot patch.

What does CIP-007 say about patching?

Requirement R2 asks each responsible entity for documented processes covering security patch management. The parts, for high and medium impact BES Cyber Systems and their associated systems, work like this:

• Part 2.1: a patch management process for tracking, evaluating and installing patches, including identifying the source or sources you track for patch releases.
• Part 2.2: at least once every 35 calendar days, evaluate security patches released since the last evaluation for applicability.
• Part 2.3: within 35 calendar days of completing that evaluation, do one of three things: apply the patch, create a dated mitigation plan, or revise an existing mitigation plan.

Mitigation plans must include the planned actions to mitigate the vulnerabilities and a timeframe to complete them.

Notice what the standard does not say. It does not demand every patch be installed in 35 days. It demands that you decide, within a window, and write the decision down.

What evidence do the measures suggest?

The measures column gives examples, not a closed list. For 2.1: the documented process and lists of the sources you monitor. For 2.2: an evaluation conducted at least once every 35 days against those sources. For 2.3: installation records such as exports from patch tools showing install dates, or a dated plan with actions and a completion timeframe.

Constructed example. A utility keeps a monthly evaluation worksheet. Each row lists the source (vendor advisory feed), the patch, the applicability decision, the decision date and the outcome: applied with a change ticket, or mitigated with a plan ID. The 35-day clock for each row runs from the evaluation completion date, so the worksheet records both dates.

What does CIP-010 add?

CIP-010 Table R3 covers vulnerability assessments:

• Part 3.1: at least once every 15 calendar months, conduct a paper or active vulnerability assessment, for high and medium impact systems.
• Part 3.2: for high impact systems, where technically feasible, at least once every 36 calendar months, perform an active assessment in a test environment, or in production if done in a way that minimizes adverse effects and models the baseline configuration. Document the results and, if a test environment was used, the differences from production and how they were accounted for.

CIP-010 Table R2, Part 2.1 adds configuration monitoring at least once every 35 calendar days against the baseline for high impact systems, with unauthorized changes documented and investigated.

Where does software supply chain data fit?

Your patch sources should include the open-source and vendor components inside the software you run, not only operating systems. A component inventory lets you answer applicability quickly: you can say whether a flawed library is present, and in which system. Without an inventory, the 35-day evaluation becomes guesswork.

What do auditors dislike?

Gaps in cadence, evaluations with no source list, mitigation plans with no date, and measures that cannot be traced to a system. They also dislike dashboards that cannot be reproduced for a past date. Keep exports, not screenshots.

What to do

1. List the sources you monitor for patches and review the list each quarter.
2. Calendar the 35-day evaluation and record the completion date every time.
3. For each applicable patch, record apply, mitigate or revise, with dates.
4. Require a dated plan with actions and a completion date for every deferral.
5. Run and document the 15-month assessment, and the 36-month active assessment where feasible for high impact systems.
6. Keep a component inventory per system so applicability decisions are fast.
7. Store exports from patch and scan tools, with timestamps, in a retrievable archive.
8. Rehearse an evidence request: pick a past month and rebuild the story in an hour.

Safeguard's SBOM and dependency scanning can supply the component inventory for step 6. The standard, scoping and evidence rules remain yours to apply.

Quick check

Sources

• NERC CIP-007-6, Systems Security Management
• NERC CIP-010-4, Configuration Change Management and Vulnerability Assessments

Last reviewed: 18 October 2026.