Several families of standards cover the cybersecurity of a power system. NERC CIP is the mandatory requirement set for North America and a model for regional guides elsewhere. IEC 62443 gives the zones, conduits and security levels method for any industrial system. IEC 62351 protects the power-sector protocols. NIST adds management frameworks and an OT security guide. They do not compete: each answers a different question.
Why there are so many standards
The cybersecurity of a power system is spread over several standards because each was written for a different purpose. Some are mandatory requirements from a regulator, others are methods for design, others protect specific protocols, and others are management frameworks for the organization. Mixing them up leads to asking one standard for something it does not offer, or to paying for the same work twice.
This guide sorts them by the question each one answers. The detail of each family is in dedicated guides on this site, linked in each section.
| Standard | Nature | Question it answers |
|---|---|---|
| NERC CIP | Mandatory requirements for the North American bulk power system | What must an operator comply with and prove? |
| Regional or utility cybersecurity rules | Mandatory requirements set by a local regulator or the grid operator, often modeled on NERC CIP | What does the local regulator or utility require today? |
| IEC 62443 | Series of standards for industrial automation and control systems | How do I design, build and maintain a secure system? |
| IEC 62351 | Series of standards for power system protocols | How do I protect IEC 61850, IEC 60870-5-104, DNP3 and their keys? |
| NIST | Security frameworks and guides (management and OT) | How do I organize and improve the security program? |
NERC CIP: from CIP-002 to CIP-014
NERC (North American Electric Reliability Corporation) publishes the reliability standards of the North American power system. The Critical Infrastructure Protection (CIP) standards are a numbered set, each with requirements identified as R1, R2 and so on. Many regional guides take this structure as their model. By topic, the series from CIP-002 to CIP-014 is this:
| Standard | Topic | Main idea |
|---|---|---|
| CIP-002 | BES cyber system categorization | Identify which cyber systems you have and classify them by impact (high, medium, low) |
| CIP-003 | Security management controls | Approved policies, a designated senior manager and delegation of authority |
| CIP-004 | Personnel and training | Awareness, training, personnel risk assessment, access management and revocation |
| CIP-005 | Electronic security perimeter | A defined perimeter, with controlled interactive remote access |
| CIP-006 | Physical security of cyber systems | Physical security plan, visitor control and maintenance of physical access control systems |
| CIP-007 | System security management | Ports and services, patches, malicious code, security event monitoring and system access control |
| CIP-008 | Incident reporting and response planning | Response plan, testing and review |
| CIP-009 | Recovery plans | Recovery plan, testing and review |
| CIP-010 | Configuration change management and vulnerability assessments | Configuration baseline, monitoring, vulnerability assessment and a plan for transient devices |
| CIP-011 | Information protection | Information protection program and secure reuse or disposal of equipment |
| CIP-012 | Communications between control centers | Plan to mitigate risks of data exchanged between control centers |
| CIP-013 | Supply chain risk management | Vendor risk plan, its implementation and approval |
| CIP-014 | Physical security | Risk assessment of transmission facilities, third-party verification, threat evaluation and physical security plan |
Other grid operators have adopted this structure in their own standards, with a requirements table per standard and an impact level. NERC CIP itself keeps growing: NERC CIP requirements explains developments such as CIP-015 (internal network security monitoring) and the changes for low impact systems.
When to use it: as a list of measurable requirements and of auditable evidence. It is the most concrete reference for what must be documented and tested.
Regional and utility rules
Outside North America the obligation usually comes from a local regulator, a grid code or the utility’s own specification. Most of them take the CIP standards as a reference, adapt them to the local case and add a risk-based approach. Our design and settings work is adapted to the local code and to the requirements of the utility that the client gives us.
IEC 62443: the design method
IEC 62443, developed from the work of ISA, is a series of standards for the security of industrial automation and control systems. It is not specific to the power sector, but it fits it very well. Its distinctive contribution:
- Zones and conduits: divide the system into zones of equal criticality and control what crosses between them.
- Security levels: define how much protection each zone needs and verify that the components deliver it.
- Roles: different requirements for the asset owner, the integrator and the product supplier.
The guides introduction to IEC 62443, IEC 62443 in substations, zone and conduit risk assessment and service provider requirements cover its most used parts.
When to use it: to design the architecture, to set requirements for vendors and to speak a common language with them.
IEC 62351: protecting the protocols
IEC 62351 is the series from IEC TC 57 that secures power system protocols. Each part addresses a protocol or a function: TLS, MMS, IEC 60870-5 and DNP3, GOOSE and sampled values, monitoring, role-based access control and key management. The overview is in IEC 62351: cybersecurity for IEC 61850, 104 and DNP3; part 10 deals with the security architecture. The domains and the placement of security controls are explained in IEC TR 62351-10.
When to use it: when you specify or configure the protocols of the equipment, and when you buy a relay, a gateway or a switch.
NIST: frameworks and OT guidance
The US National Institute of Standards and Technology (NIST) publishes two widely used references:
- NIST SP 800-82 (revision 3): guide to operational technology (OT) security. It describes the risks, architecture and controls specific to control systems, and maps them to the NIST control catalog.
- Cybersecurity Framework (CSF 2.0): organizes an organization’s security program into functions: govern, identify, protect, detect, respond and recover.
NIST also publishes guidance on specific topics, such as the one on inverter cybersecurity.
When to use it: to structure the company’s security program and to measure its maturity. They are not mandatory requirements in most countries outside the United States, but they are a good basis for comparison.
How they combine in a project
The standards complement each other in layers:
- The regulator or utility (and NERC CIP where it applies) sets what must be met and what evidence must be kept.
- IEC 62443 gives the method to design zones, conduits and vendor requirements.
- IEC 62351 gives the protocol controls inside that architecture.
- NIST organizes the organization’s program and its continuous improvement.
An example with the perimeter: CIP-005 and most regional guides ask for a perimeter with controlled remote access; IEC 62443 shows how to define it with zones and conduits; IEC 62351 and the hardening guides show how to protect what crosses it (for example, secure remote access to substations); and the NIST framework places it inside the “protect” function.
How to choose where to start
- Operator under a mandatory regime: the applicable rules, with a gap assessment against them.
- New installation: IEC 62443 as the method and IEC 62351 for the equipment.
- Buying equipment or hiring an integrator: IEC 62443 and IEC 62351 requirements in the specifications, and FAT and SAT cybersecurity tests to verify them.
- Company with international operations: ask which standard the tender requires and compare it with the rules of each country.
When it pays to bring in a specialist
Choosing the standards is the easy part; the hard part is turning them into equipment configuration and proving it is done. We support the gap assessment, the engineering of zones and access, the secure configuration of relays, switches and gateways, and the acceptance tests. See our substation and plant cybersecurity service and write to us for a quote. The remote parts of this work can be delivered worldwide; on-site work is available in Colombia, or elsewhere on request.
Related guides
- NERC CIP requirements
- IEC 62443 in substations
- IEC 62351: cybersecurity for IEC 61850, 104 and DNP3
- OT cybersecurity gap assessment
- IED Settings Backup and Recovery: What to Keep and Test
- IEC TR 62351-10: Security Architecture Guidelines
References
- NERC, standards CIP-002 to CIP-014 (Critical Infrastructure Protection).
- IEC 62443 (series): Security for industrial automation and control systems.
- IEC 62351 (series): Power systems management and associated information exchange. Data and communications security.
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security.
- NIST Cybersecurity Framework 2.0.
Frequently asked questions
Which standard should I follow for a substation?
Start with what binds you: the mandatory rules of your region or your utility (NERC CIP in North America, or the local requirements and the utility's own specification). Use IEC 62443 as the design method and as a common language with vendors, and apply IEC 62351 to protect the protocols of the equipment. NIST is a frequent reference in tenders of companies with international operations.
Is NERC CIP compliance the same as IEC 62443 compliance?
No. They differ in origin and in form: NERC CIP is a set of mandatory, audited requirements for one region; IEC 62443 is a series of standards with security levels and requirements for asset owners, integrators and product suppliers. Many controls overlap, and whoever implements one has a good part of the work done for the other, but each must be demonstrated separately.
Where do I start if nothing has been done yet?
With the asset inventory and the classification by impact. Every standard asks for it first, because you cannot protect what you do not know. Next come network separation, remote access control and configuration backups. A gap assessment against the chosen standard orders the rest.