I've seen many substations delivered with flawless hardware and forgotten software.
Relay firmware, configuration tools, SCD files, logic, gateway and firewall settings. All of it is software. It has versions, dependencies, vulnerabilities and an end-of-support date.
What I've learned: the problem rarely shows up at handover. It shows up years later, when nobody knows which version is running in the field, the backup does not restore, and the new tool silently converts the old file.
What works:
→ a living inventory of firmware and configurations, with the approved version next to the installed one
→ every update treated as a design change, with impact analysis, bench testing and a rollback plan
→ security built in from the start, required at procurement, in line with what IEC 62443-4-1 defines for secure product development
Power sector cybersecurity standards such as NERC CIP-010 and CIP-007 already treat baselines, change management and patch evaluation as requirements, with evidence.
A transformer lasts 40 years. The software protecting it, maybe five. If we don't manage that lifecycle, we end up managing the failure.