Patch and Firmware Management for Relays and IEDs

Short answer

Managing patches and firmware in relays and IEDs means deciding, for each vendor security advisory, whether it applies to the installed equipment, how much risk it carries and how to fix it: with an update tested first on the bench, installed in a maintenance window, with a prior backup and a check afterwards, or with a compensating control when updating is not possible. Cybersecurity rules and good practice ask for a documented procedure and evidence of the patch cycles.

Why a relay is not patched like a computer

On an office computer, an update is installed, the machine restarts and work goes on. In a protective relay, a firmware update is a change to critical equipment. While it loads, the bay is left without that protection. Afterwards, the relay must behave exactly as before in a fault. So patch management in a substation is more a maintenance procedure than an IT routine.

At the same time, never updating is not an option either. Manufacturers publish security advisories for their relays, controllers, switches and gateways when they find vulnerabilities, and a device running ten-year-old firmware may have exposed services that are already known to be exploitable.

What regulation and standards ask

Grid cybersecurity guidelines usually cover this in their section on managing the security of critical cyber assets. Colombia’s CNO guide (Agreement 1960 of 2025) is one example, and it asks for:

A documented and implemented update and patch procedure, with periodic installation according to it. Where an update is not technically feasible, compensating controls that reduce the risk.
Vulnerability assessment of critical cyber assets and perimeter access points at least every two years. It is also done before a new critical cyber asset goes into production and at scheduled replacements. What is found is fixed or mitigated with dated action plans.
Change control and configuration management for any hardware or software change to a critical cyber asset, making sure it does not affect the existing security controls.

As a reference for a more detailed regime, NERC CIP-007-6 requires assessing security patches at least every 35 calendar days and, within the following 35 days, applying them or creating a dated mitigation plan. Many national guidelines do not fix a number of days; the procedure of each operator defines it. How to interpret a manufacturer’s NERC CIP matrix, and what you still have to demonstrate, is in NERC CIP Compliance Matrix.

Supporting standards

IEC TR 62443-2-3:2015, Patch management in the IACS environment, is the technical report of the IEC 62443 series on patch management in automation systems: how the asset owner and the vendor organize themselves so that patches arrive tested and documented.
IEEE 1686-2022 includes firmware review among the security capabilities of an IED: change control and integrity of the firmware and configuration files, with an audit log.
IEC 62443-4-2:2019 includes, among the capabilities of a component at security level SL 2, authenticity checks of code and updates.

The patch cycle

Handling a security advisory for relays and IEDs

Manufacturer security advisory
Assessment. Which models and firmware in the inventory does it affect, and with what risk?
Can it be updated within a reasonable time? Yes: continue; No: Compensating control and modernization plan.
Bench test. Same hardware version, real settings and functional tests
Backup. Settings, configuration, logs and previous firmware version
Installation. Maintenance window with the bay in a safe condition
Verification. Settings comparison, tests of the functions and of the communications
Inventory and change log updated

Assessment. The starting point is the equipment inventory with each version, which configuration management keeps up to date. Without knowing which firmware each device runs, an advisory cannot be matched to the installation. The assessment looks at whether the vulnerability can be reached on your network (a vulnerable web service is not the same if the port is disabled and the device is in a zone with no outside access), what the consequence would be and what else changes in the new version. Having that service disabled beforehand is part of hardening the device.

Bench test. The update is tested first on a device identical to the installed one, with the real settings. Check that the settings file loads without unexpected conversions and that the protection functions operate the same. Also check that the communications keep working, including GOOSE and the IEC 61850 data model used by the SCD (substation configuration description).

Backup. Before touching the device, save the settings, the communications configuration, any event logs and waveform records not yet downloaded and, if the manufacturer allows it, the previous firmware version so you can roll back.

Installation. In a maintenance window, with the bay in a safe condition according to the utility’s procedure and with backup protection available. The laptops and memory sticks used to load firmware are transient cyber assets and removable media, and good practice is to control them with their own procedure.

Verification. Compare the loaded settings with the backed-up ones, test the protection and control functions with secondary injection following the relay test plan, and verify the communications. Update the inventory and the change log with the new version.

When it cannot be updated

Many substations have relays that the manufacturer no longer updates, or whose update requires a hardware change. For them, cybersecurity guidelines do not give an exemption. They ask you to document that updating is not technically feasible and to apply compensating controls. In general:

Disable the services and ports that are not used, especially those named in the advisory, and review the access levels and passwords.
Place the device in a zone with no direct access from external networks, with a conduit that lets through only what is needed.
Allow engineering access only through a controlled, logged path.
Watch its traffic with intrusion detection.
Include it in the modernization plan with a date.

Common mistakes

Updating without a backup and finding out later that the settings did not convert correctly.
Updating in the field without a bench test a model that was never tested with that version.
Not updating the inventory, so the next advisory is assessed with old data.
Using an uncontrolled laptop to load firmware in several substations.
Forgetting switches, clocks and gateways, which also have firmware and advisories.

We configure your relays before and after the change

Around each update there is configuration work: backing up settings and communications, loading and comparing them on the new version, and leaving unused services disabled and accounts as they should be. Our team does this on relays, reclosers and controllers remotely with remote relay configuration, in sessions you authorize and that are logged, or on site with our substation and plant cybersecurity service (in Colombia, or elsewhere on request). Tell us the make, model and version through contact.

References

Consejo Nacional de Operación (Colombia), Agreement 1960 of 2025, Annex 1, sections 7.1, 7.3, 7.4 and 7.5, and the deadlines article.
IEC TR 62443-2-3:2015, Security for industrial automation and control systems – Part 2-3: Patch management in the IACS environment.
IEEE 1686-2022, Standard for Intelligent Electronic Devices Cybersecurity Capabilities.
IEC 62443-4-2:2019, technical security requirements for IACS components.
NERC CIP-007-6, Cyber Security – System Security Management, requirement R2.

Frequently asked questions

Should relay firmware be updated as soon as a new version is released?

No. First assess whether the version fixes something that affects your installation, with what risk, and what else changes in the device. An update in a protective relay is a change to critical equipment: it is tested first, planned in a maintenance window and verified afterwards. If the risk is low or the device is well protected by the network, it can be scheduled with routine maintenance.

What if the manufacturer no longer publishes firmware for a relay?

Document that updating is not technically feasible and apply compensating controls: stricter segmentation, disabling vulnerable services, limiting access to one controlled path and monitoring traffic. The device goes into the modernization plan. This is what grid cybersecurity guidelines ask for existing cyber assets.

Can a firmware update change the protection settings?

It can affect them. Depending on the manufacturer and version, the settings file may need conversion, a function may change behavior, or the device's IEC 61850 data model may differ. That is why everything is backed up first, the release notes are reviewed and the settings are compared before and after.