By providing a secure EEPROM (Electrically Erasable Programmable Read Only Memory) device or other non-volatile memory (NVM) in an arrangement of a master key system operation key (SOK) plus any subsequently installed SOK to control the configurable machine option attributes, various problems associated with machine option configuration and updates may be accommodated. At the initial install of either SOK type the identity of the machine is written to the NVM, i.e. the machine serial number. This is performed during the initial machine power up or reboot sequence. If the SOK type is a subsequently installed SOK, the option code(s) from the subsequently installed SOK are written to the master key SOK. As part of the power on or reboot routine the machine will check to ensure no tampering has taken place and that the machine identity and the NVM serial number location data match. A new swapped in SOK can be installed so long as the NVM serial number location has not been previously written to with a conflicting identification number. The machine will then write the serial number to the new SOK thereby protecting it.