IEC 62351

IEC 62351
Name	IEC 62351
Status	Published
Started	2003
Organization	International Electrotechnical Commission
Domain	Power systems, Information security

IEC 62351 IEC 62351 is a suite of international standards addressing information security for electrical power systems, focusing on protocols and data exchange used in transmission and distribution networks. The suite provides technical controls, authentication, encryption, and operational guidance to protect supervisory control and data acquisition systems, energy management systems, and distributed energy resources. IEC 62351 is developed within the International Electrotechnical Commission framework and aligns with broader cybersecurity and communications standards adopted by utilities, vendors, and regulators.

Overview

IEC 62351 was initiated to secure communications and data models used in power system operations and to mitigate risks identified by incidents affecting North American Electric Reliability Corporation regions, European Network of Transmission System Operators for Electricity, and national system operators such as National Grid (Great Britain). The work draws on expertise from committees including IEC Technical Committee 57, collaborates with organizations like Institute of Electrical and Electronics Engineers working groups, and considers requirements from standards bodies such as International Organization for Standardization and International Telecommunication Union. Stakeholders include vendors represented by EPRI members, system integrators contracted by ENEL, and transmission operators like Amprion.

Scope and Objectives

The standard suite targets operational technology environments in power generation, transmission, distribution, and distributed energy resources managed by entities such as California Independent System Operator, PJM Interconnection, and RTE (Réseau de Transport d'Électricité). Objectives include confidentiality, integrity, authentication, and secure logging for protocols used by systems produced by vendors such as Schneider Electric, Siemens, ABB (company), and GE Vernova. It addresses threats highlighted in investigations by agencies like United States Department of Energy and advisory bodies including National Institute of Standards and Technology. The standard supports interoperability goals sought by consortia like OpenADR and market frameworks run by exchanges including EPEX SPOT.

Structure and Parts

IEC 62351 is organized into multiple parts, each addressing specific protocol families, cryptographic profiles, or operational requirements. Parts map to technologies used by standards such as IEC 61850, IEC 60870-5-104, DNP3, and protocols deployed in control centers like those from Schweitzer Engineering Laboratories. The committee structure resembles processes used by ISO/IEC JTC 1 and incorporates liaison inputs from CEN and ETSI. The parts include technical specifications for TLS profiles, role-based access similar to frameworks from SANS Institute, and logging formats comparable to schemas used by MITRE.

Security Mechanisms and Technical Requirements

Technical requirements prescribe use of cryptographic mechanisms including profiles of Transport Layer Security and recommendations for key management inspired by RFC 5246 and guidance from IETF. Authentication relies on X.509 certificate handling consistent with ITU-T X.509 practice and public key infrastructures comparable to deployments by European Union Agency for Cybersecurity. Integrity protections reference message authentication approaches found in AES cipher suites and standards promoted by National Institute of Standards and Technology including algorithms from FIPS 140-2. Access controls and role definitions align with models used by NERC CIP and identity federations like those in eduGAIN for trusted credential exchange.

Implementation and Compliance Considerations

Implementers such as utilities under regulators like Ofgem, Federal Energy Regulatory Commission, and Bundesnetzagentur evaluate compliance through audits, conformance testing, and security incident playbooks influenced by CERT Coordination Center practices. Practical deployment challenges include retrofitting legacy systems from vendors like Hitachi Energy and Toshiba to support secure transports, certificate lifecycle management used by grid operators such as TransGrid, and ensuring interoperability across SCADA implementations from Rockwell Automation. Testbeds and interoperability events mirror activities conducted by organizations like GridWise Alliance and research programs at universities such as Massachusetts Institute of Technology and ETH Zurich.

Industry Adoption and Use Cases

Adoption spans transmission system operators, distribution system operators, and aggregators in markets run by entities such as Nord Pool and CAISO. Use cases include secure telemetry for substations operated by Exelon, distributed energy resource coordination for utilities like Iberdrola, and secure market communication between trading platforms including Nasdaq Commodities. Vendors embed parts of the standard into relays, gateway devices, and energy management systems sold by SEL, ABB, and Schneider Electric. Regional initiatives such as projects funded by the European Commission and national research by US Department of Energy demonstrate pilot implementations.

Related Standards and Interoperability

IEC 62351 interacts with protocol standards and regulatory frameworks including IEC 61850 for substation automation, IEC 60870 series for telecontrol, and IEEE 1815 (DNP3) for distribution communications. It complements security frameworks like NIST Cybersecurity Framework and compliance regimes such as NERC Reliability Standards. Interoperability testing follows patterns from conformance efforts by ETSI Cyber and certification approaches similar to those of Underwriters Laboratories. The suite also aligns with cross-sector standards referenced by agencies like European Commission directives and international initiatives including programs led by the World Bank for resilient infrastructure.

Category:Industrial communication standards