Key takeaways
- IEC 62351 — narrower and protocol-specific: it secures the bits on the wire for the power-sector protocol families TC 57 maintains.
- Start with Part 1 as orientation, not Part 3 as a checklist.
IEC 62351, "Power systems management and associated information exchange — Data and communications security," is the IEC TC 57 series that secures the actual communication protocols power utilities run between control centres, substations and field equipment — IEC 61850 inside substations, IEC 60870-5 and DNP3-family telecontrol protocols, and the TCP/IP transport those and other TC 57 protocols ride on. It is a protocol security series, not a device, network-architecture or organizational-program standard: it defines how to authenticate, sign, encrypt or otherwise protect the messages themselves.
Scope: securing TC 57's own protocols
Per IEC TS 62351-1:2007's own scope text, the series' purpose is "the development of standards for security of the communication protocols defined by IEC TC 57, specifically the IEC 60870-5 series, the IEC 60870-6 series, the IEC 61850 series, the IEC 61970 series, and the IEC 61968 series" — covering EMS (Energy Management Systems), SCADA, substation automation, distribution automation and tele-protection. IEC's own current "ALL PARTS" bundle (IEC 62351:2026 SER) lists 20 published documents spanning Technical Specifications, International Standards and Technical Reports published between 2007 and 2026 — the series has been under continuous revision for close to two decades as the underlying protocols and threat landscape evolved.
The parts that matter most, part by part
| Part | Title (per IEC) | Current edition / year | What it secures |
|---|---|---|---|
| 1 | Introduction to security issues | TS, 2007 | Introduces the rest of the series — not a technical control itself |
| 2 | Glossary of terms | TS, 2008 | Shared vocabulary across the series |
| 3 | Communication network and system security — Profiles including TCP/IP | 2023 (Ed. 2.0) | TLS v1.2/v1.3 profile for any TC 57 protocol riding over TCP/IP; per its own scope, excludes "bump-in-the-wire" external security devices |
| 4 | Profiles including MMS | 2018+AMD1:2020 CSV | Security profiles for Manufacturing Message Specification traffic |
| 5 | Security for IEC 60870-5 and derivatives | 2023 (Ed. 1.0) | Application-layer secure communication mechanism for telecontrol/SCADA protocols derived from IEC 60870-5; explicitly "cancels and replaces" the 2013 Technical Specification |
| 6 | Security for IEC 61850 | 2020 (Ed. 1.0) | Protects substation protocols — MMS, GOOSE, Sampled Values — including the 61850-8-1, 61850-8-2, 61850-9-2 and 61850-6 mappings |
| 7 | Network and System Management (NSM) data object models | 2025 | Security-relevant monitoring data objects specific to power system operations |
| 8 | Role-based access control (RBAC) for power system management | 2020 (Ed. 1.0); 2026 edition also listed | Defines mandatory roles and an access-token exchange format for local/remote human and automated-agent access |
| 9 | Cyber security key management for power system equipment | 2023 (Ed. 2.0, 296 pages) | Asymmetric key/certificate management, plus symmetric group-key management (GDOI) for the session keys Parts 3, 5 and 6 rely on |
| 10 | Security architecture guidelines | 2012 (TR) | Informative guidance on essential security controls for a power system architecture |
| 11 | Security for XML documents | 2016 | Confidentiality, signing and access control for XML-based data exchange |
| 90-1 to 90-3 | Technical Reports | 2018-2021 | Guidance on deep packet inspection of encrypted 62351 traffic and integration across parts |
| 100-series | Conformance test specifications | 2018-2023 (TS) | Interoperability/conformance test profiles for the normative parts above |
Part 6 in practice: why GOOSE and SMV aren't simply encrypted
Per IEC's catalogue record, Part 6 (2020) "specifies messages, procedures and algorithms for securing the operation of all protocols based on or derived from the IEC 61850 series," applying to at least the 61850-8-1 (MMS mapping), 61850-8-2 (XMPP mapping), 61850-9-2 (sampled values) and 61850-6 (configuration description language) protocols. Widely corroborated secondary technical analysis of the published standard describes why GOOSE and Sampled Value (SV) messages are treated differently from client-server MMS traffic: both carry strict sub-4-millisecond delivery deadlines for protection and control functions, so full encryption — which adds processing latency — would jeopardize the real-time guarantee the protocols exist to provide. The 2020 edition instead relies on message authentication (HMAC-SHA256 or AES-GMAC, over a pre-shared group key) to protect the integrity and authenticity of GOOSE/SV multicast traffic without encrypting its payload. This guide has not purchased or independently verified the full Part 6 text, so treat the specific cryptographic mechanism as to be confirmed against the standard itself before relying on it for an implementation decision.
RBAC (Part 8) and key management (Part 9) underpin the rest
Part 8 defines role-based access control across four access patterns IEC's own catalogue record lists explicitly: local wired human access, local automated-agent/HMI access, remote human access, and remote automated-agent access — plus a mandatory-role set and a custom-role exchange format, while excluding administrative/organizational tasks not tied to role or token definition from its scope. Part 9 (2023, Edition 2.0) supplies the cryptographic key management both Part 8's access tokens and Parts 3/5/6's session protections depend on: per its own scope, it covers asymmetric key and certificate management generally, and symmetric group-key management specifically for the pre-shared keys Part 6 uses to protect GOOSE and SV traffic, using GDOI (an IETF-specified group key management protocol) extended to carry the security parameters those power-system protocols need.
How IEC 62351 relates to IEC 62443 and NERC CIP-013
These three sit at different layers and carry different legal force:
- NERC CIP-013-2 — mandatory, FERC-enforced reliability standard for North American bulk power system entities, governing supply chain risk management processes (vendor incident notification, software integrity verification, remote-access coordination). It does not specify protocol-level cryptography.
- IEC 62443 — voluntary, cross-sector industrial automation and control systems security series covering organizational programs (62443-2-x), system requirements (62443-3-x) and component requirements (62443-4-x) generically, across every OT sector, not just power.
- IEC 62351 — narrower and protocol-specific: it secures the bits on the wire for the power-sector protocol families TC 57 maintains. It does not by itself secure a device, a network architecture, or an organization's processes.
A utility's full security posture typically draws on all three together: CIP-013 or 62443-2-x for program and process obligations, 62443-3-x/4-x for system- and component-level requirements, and IEC 62351 layered on top to secure the actual SCADA and substation protocol traffic those systems and components exchange.
A workable starting point
Start with Part 1 as orientation, not Part 3 as a checklistThe series assumes a reader understands which TC 57 protocol families (61850, 60870-5, 60870-6, 61970, 61968) are actually in use at a given site before picking which parts apply. Map your protocol inventory to specific parts before procuring anythingTLS-capable TCP/IP links need Part 3; 61850 substation traffic needs Part 6; 60870-5/DNP3-family telecontrol links need Part 5 — a single site commonly needs several parts simultaneously, not one. Treat Part 9 as a prerequisite, not an afterthoughtParts 3, 5 and 6 all depend on key material Part 9 defines how to manage; deploying protocol security without a Part 9-conformant key management plan creates an operational gap the protocol-level controls can't close on their own. Don't expect IEC 62351 to replace a supply chain or component security programIt secures protocol traffic specifically — pair it with NERC CIP-013 (where applicable) or IEC 62443 for process and component-level obligations. Verify edition currency before specifying compliance in a contract, especially for Parts 7, 8 and 9, which have all been revised or re-edited within the last few years; cite the exact year/edition, not just "IEC 62351," in procurement language.
SoftWSP's OT Snapshot builds a passive asset and protocol inventory — including which TC 57 protocol families are actually running on a network — without requiring agent installation on live control systems, which is the groundwork a utility or machine builder needs before scoping which IEC 62351 parts actually apply: see OT Snapshot.
This guide summarises IEC's own catalogue and abstract text for the IEC 62351 series' published parts and widely corroborated independent secondary technical analysis of Part 6's authentication mechanism; it is not a substitute for the purchased IEC text of each part and does not constitute compliance or engineering advice.
Sources
- IEC: IEC 62351:2026 SER — Power systems management and associated information exchange — Data and communications security — ALL PARTS (bundled catalogue record listing all 20 published parts with edition/year)
- IEC: IEC TS 62351-1:2007 — Part 1: Communication network and system security — Introduction to security issues (catalogue record and scope, Edition 1.0, 35 pages, stability date 2026)
- IEC: IEC 62351-3:2023 — Part 3: Communication network and system security — Profiles including TCP/IP (catalogue record and scope, Edition 2.0, published 2023-06-06)
- IEC: IEC 62351-5:2023 — Part 5: Security for IEC 60870-5 and derivatives (catalogue record and scope, Edition 1.0, published 2023-01-13, cancels and replaces the 2013 Technical Specification)
- IEC: IEC 62351-6:2020 — Part 6: Security for IEC 61850 (catalogue record and scope, Edition 1.0, published 2020-10-20, 33 pages, TC 57)
- IEC: IEC 62351-8:2020 — Part 8: Role-based access control for power system management (catalogue record and scope, Edition 1.0, published 2020-04-28, TC 57)
- IEC: IEC 62351-9:2023 — Part 9: Cyber security key management for power system equipment (catalogue record and scope, Edition 2.0, 296 pages, supersedes the 2017 edition)
Frequently asked questions
What is IEC 62351?
IEC 62351, "Power systems management and associated information exchange — Data and communications security," is a multi-part series from IEC Technical Committee 57 (TC 57). Per IEC TS 62351-1:2007's own scope, the series' primary objective is "the development of standards for security of the communication protocols defined by IEC TC 57," specifically the IEC 60870-5 series, IEC 60870-6 series, IEC 61850 series, IEC 61970 series and IEC 61968 series — the protocol families used for SCADA, substation automation, energy management systems and distribution automation. IEC's bundled "ALL PARTS" catalogue listing (IEC 62351:2026 SER) counts 20 individually published parts, spanning Technical Specifications, International Standards and Technical Reports, published between 2007 and 2026.
Which specific protocols does each main part secure?
Per IEC's own catalogue records: Part 3 (Edition 2.0, 2023) specifies Transport Layer Security (TLS v1.2/v1.3) profiles for protocols running over TCP/IP. Part 4 covers security profiles including MMS (Manufacturing Message Specification). Part 5 (2023) specifies an application-layer secure communication mechanism for "all protocols based on or derived from IEC 60870-5" — telecontrol/SCADA protocols — and per its own text "cancels and replaces" the 2013 Technical Specification as a technical revision. Part 6 (2020) specifies messages, procedures and algorithms for securing protocols "based on or derived from the IEC 61850 series," applying to at least IEC 61850-8-1 (MMS mapping), 61850-8-2 (XMPP mapping), 61850-9-2 (sampled values) and 61850-6 (configuration description language) — this is the part that covers GOOSE and Sampled Value (SV) message protection inside a substation.
Does IEC 62351-6 require encrypting GOOSE and Sampled Value messages?
No — per widely corroborated secondary technical analysis of the published standard (not independently re-verified against the full paywalled Part 6 text for this guide), GOOSE and SV messages carry strict sub-4-millisecond delivery requirements that full encryption would jeopardize, so the standard instead relies on message authentication — HMAC-SHA256 or AES-GMAC over a pre-shared group key in the 2020 edition — to protect integrity and authenticity rather than confidentiality for these two multicast protocols. Treat this operational detail as **to be confirmed** against the purchased Part 6 text before building an implementation on it.
What does IEC 62351-8 (RBAC) actually require?
Per IEC's own catalogue record for IEC 62351-8:2020, the part facilitates **role-based access control** for power system management, covering four access scenarios: local (direct wired) access by a human user; local automated-agent or built-in HMI/panel access; remote (dial-up or wireless) access by a human user; and remote access by an automated agent. It defines a set of mandatory roles plus an exchange format for vendor-defined custom roles. Explicitly out of scope: administrative or organizational tasks not directly tied to defining roles and access tokens. A newer edition, IEC 62351-8:2026, is listed in IEC's current "ALL PARTS" bundle; this guide has not purchased or reviewed that 2026 text, so treat any specific 2026 changes as **to be confirmed** against that edition directly.
How does IEC 62351 relate to NERC CIP-013 and IEC 62443?
They operate at different layers and have different legal force. [NERC CIP-013-2](/guides/nerc-cip-013-supply-chain-risk-management/) is a mandatory, FERC-enforced reliability standard governing supply chain risk management processes for North American bulk power system entities — it does not specify communication protocol security mechanisms. [IEC 62443](/guides/iec-62443-1-1-concepts-and-models/) is a voluntary, cross-sector industrial automation and control systems security series covering organizational programs, system requirements and component requirements generically across all OT sectors. IEC 62351 is narrower and protocol-specific: it secures the actual bits on the wire for the power-sector protocol families TC 57 maintains (IEC 61850, IEC 60870-5 and related), and does not by itself secure a device, a network architecture, or an organization's processes the way IEC 62443 or CIP-013 do. A power utility's full security posture typically draws on all three: CIP-013 or 62443-2-x for program/process, 62443-3-x/4-x for system and component requirements, and IEC 62351 for the protocol-level cryptography layered onto SCADA and substation traffic itself.
In this cluster
