What must changes to the existing baseline configuration be?

Changes to the existing baseline configuration must be documented and justified to ensure that any modifications are recorded and can be traced back to their origins and purposes. This requirement is essential in maintaining the integrity and security of critical infrastructure systems, as it allows for accountability and transparency in managing configurations.

By documenting changes, organizations can provide a clear historical record of what changes were made, why they were necessary, and who approved them. This process helps facilitate audits, assessments, and responses to any incidents that may arise due to configuration changes. Justification is equally important; it ensures that any updates or modifications are not arbitrary and are made based on evaluated risks, operational needs, or security requirements. This practice aligns with the overall goals of the NERC CIP standards, which emphasize the importance of maintaining robust security and managing risks effectively within the energy sector.