Case Study

How a North American Utilities Company Automated NERC-CIP Compliance Across 12,000+ Devices with Itential

A Field Area Network refresh across 12,000+ devices, ahead of NERC-CIP regulatory deadlines and without adding headcount – orchestrated through Itential’s Golden Configuration, source-of-truth integration, and automated drift remediation.

Challenge

A Field Area Network refresh on the horizon – 12,000+ devices to decommission, provision, and configure – against NERC-CIP regulatory requirements where fines can total over $1M per day, with manual change processes that already couldn’t keep pace.

Solution

Itential as the orchestration foundation – Golden Configuration across every device, automated remediation in minutes, and orchestrated workflows that keep every source of truth accurate from onboarding through retirement.

Why Itential

A flexible Golden Configuration model, no-code integration with any source of truth, low-code workflow building, and remediation in minutes – letting the team take on the FAN refresh without adding headcount or working hours.

The Challenge

Inefficient Network Change Processes Brings Looming Regulatory Fines

With a Field Area Network refresh project ahead, this North American utility realized their manual change processes would not cut it. They needed to avoid a long list of network-related NERC-CIP regulatory compliance requirements – and the fines that can total over $1M per day when those requirements slip. That meant better network inventory management plus standardized, tracked, and maintained configurations across over 12,000 devices.

The work spanned a full lifecycle refresh: decommissioning legacy routers, switches, and firewalls, and provisioning and configuring their replacements. Every step had to happen without disrupting the rest of the network – and without expanding the team to absorb the additional workload.

One of the biggest challenges in that process was manually updating multiple sources of truth where inventory data lived. Network and IT engineers were swivel-chairing between different systems for every device onboarded and configured – delaying network changes, creating opportunities for human error, and degrading data integrity exactly where the team most needed it accurate.

Three Forces Stalling a Compliance-Critical Refresh

Each one made the Field Area Network refresh slower, riskier, and more expensive – and pushed NERC-CIP compliance further out of reach.

Regulatory Stakes Climbing Daily

Network-related NERC-CIP non-compliance fines can total over $1M per day. Without a reliable way to back up, audit, and maintain configurations across 12,000+ devices, the team faced rising regulatory exposure with every incremental change.

Sources of Truth Drifting Out of Sync

IPAM, CMDB, Infoblox, and other inventory systems all needed updates for every device onboarded and configured. Manual swivel-chairing between them slowed every change and let inventory data drift away from network reality.

Refresh Without Adding Headcount

A full lifecycle FAN refresh – decommissioning legacy gear, provisioning new gear, configuring everything – had to happen without expanding the team or extending working hours. Capacity had to come from the operating model itself.

We eventually found ourselves unable to maintain accuracy with many different sources of truth to manually go and update. Any automation solution we adopted had to also solve for this problem.

Network Engineer

North American Utilities Company

The team didn’t just need to automate configurations. They needed every source of truth to stay accurate as those configurations changed – without anyone manually keeping the systems in sync.

Why Itential

Why They Chose Itential for the FAN Refresh

The team needed to manage the full lifecycle of their Field Area Network refresh while keeping the lights on across the rest of the network – and increase their existing capacity without adding headcount or working hours. Itential’s integration and automation capabilities let them connect current and future disparate systems, orchestrate updates to sources of truth like Infoblox, and automate activities they had previously coordinated by hand. Six capabilities anchored the decision.

A Platform That Keeps Compliance & Sources of Truth in Lockstep

Six capabilities sat at the center of the decision – together turning a high-risk regulatory refresh into a governed, repeatable, source-of-truth-accurate operating model.

Explore the Platform

Flexible Golden Configuration Templates

Reusable Golden Configuration templates for managing any device and service across the entire network – keeping every device aligned to the standard that the regulator expects, refresh cycle after refresh cycle.

One App for Backups, Inventory & Changes

A single application to efficiently manage device backups, federate inventory, and automate configuration changes across CLI-based physical devices and API-based cloud networking services – any vendor, any OS.

Automated Remediation in Minutes

Automated remediation of out-of-compliance devices in minutes instead of hours or days – closing the loop on config drift before it grows into the next compliance event.

No-Code Source-of-Truth Integration

No-code integration with any source of truth – IPAM, CMDB, Infoblox, and beyond – so accurate inventory data feeds every network automation instead of trailing behind it.

Low-Code Workflow Builder

A low-code workflow builder for coordinating multiple automated steps into a single end-to-end orchestrated outcome – so the FAN refresh runs as one governed process, not a chain of manual handoffs.

Expanded Automation Participation

Enables non-developers to build network automations – so automation capacity grows with the team’s existing skill mix, without forcing every change through a small group of script writers.

The Solution

Field Area Network Refresh, Orchestrated End-to-End

Instead of stacking automation on top of manual coordination, the team rebuilt the operating model itself – Golden Configuration applied from device onboarding through retirement, sources of truth updated inside the same orchestrated workflow that changes the device.

Full Lifecycle Refresh

Decommissioning legacy routers, switches, and firewalls – and provisioning, configuring, and onboarding their replacements – orchestrated end to end through Itential workflows that span the full lifecycle of every device in the refresh.

Golden Configuration Across 12,000+ Devices

From the moment a device is onboarded, it’s configured to the intended standard and never falls out of compliance – Golden Configuration applied uniformly across the entire estate, replacing per-device manual updates with a single governed model.

Sources of Truth Always Accurate

Updates to IPAM, CMDB, Infoblox, and other sources of truth happen inside the same workflow that changes the device – eliminating swivel-chair updates and “rogue” changes that used to leave inventory data trailing reality.

NERC-CIP Confidence

Continuous backup, audit, and maintenance of configurations across 12,000+ devices – turning regulatory exposure into a manageable operating discipline rather than a recurring fire drill.

Historically, network-related compliance requirements were difficult to manage across our large disparate network because we didn’t have a good way of backing up, auditing, and maintaining configurations. Itential’s automation capabilities give our team the guardrails we need to sleep better at night as well as the ability to do more than we ever anticipated.

Sr. Director, IT Engineering

North American Utilities Company

The Outcome

Improved Cost & Speed of Deployment by 30%+

With the operating model rebuilt around Golden Configuration and source-of-truth orchestration, the FAN refresh is now on track for cost and speed improvements that the manual-process baseline could never have delivered.

12K+

Devices Under Configuration Automation

Configuration updates and backups orchestrated across the full network – from legacy routers, switches, and firewalls being decommissioned to new replacements being provisioned and configured.

30%+

Cost & Speed Improvement

On track for over 30% cost and speed improvement on Field Area Network refresh projects compared to original estimates based on previously manual processes.

$1M

Per-Day NERC-CIP Exposure Now Manageable

NERC-CIP non-compliance fines can total over $1M per day. The team now backs up, audits, and maintains configurations to stay confidently compliant as the FAN refresh scales.

Mins

Drift Remediation Time

Automated remediation of out-of-compliance devices in minutes instead of hours or days – closing the loop on config drift before it becomes a compliance event.

From Manual Swivel-Chair to Source-of-Truth Accuracy

Updates to sources of truth are now incorporated into orchestrated workflows – eliminating “rogue” changes, restoring data integrity across IPAM, CMDB, and Infoblox, and giving the team capacity to handle the Field Area Network refresh without adding headcount.