Cybersecurity tests in FAT and SAT check that the substation automation system is delivered with the security functions the specification asks for: individual accounts and roles, factory passwords changed, only the necessary ports and services, event logging, a firewall with documented rules, remote access through the intended path and complete backups. There is no standardized procedure: the requirements come from IEC 62443-3-3, IEEE 1686 and the tender, and the protocol is agreed between owner and integrator.
What these tests are for
A substation automation system can pass all its functional tests and still be delivered insecure. For example: factory passwords on the relays, a web server enabled on every switch, a shared engineering account known to the whole integrator team, or a firewall with an “allow all” rule left in place for commissioning. None of that shows up in a trip or control test.
Cybersecurity tests in FAT and SAT verify that what is delivered matches what the specification asked for on security, and leave a documented baseline of how each device ended up.
Why there is no standardized procedure
As explained in commissioning standards, there is no single FAT and SAT standard for substations, nor one for its cybersecurity part. The references are split like this:
| Reference | What it brings to the test |
|---|---|
| IEC 62443-3-3:2013 | System security requirements, grouped into seven foundational requirements: identification and authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events and resource availability |
| IEEE 1686-2022 | Cybersecurity capabilities of each IED: access control, audit, alarms, configuration and firmware |
| IEC 62443-2-4:2023 | Processes the integrator must apply during integration and delivery |
| IEC 62351 | Protocol security, when the project includes it |
| Project specification | Which requirements apply, at what level and with what evidence |
The test protocol is agreed in the tender. If the tender only says “the system shall comply with IEC 62443”, there is nothing concrete to test; if it says which 62443-3-3 requirements apply to each zone and with what evidence, each one becomes a line of the protocol. The relation between system requirements and zones is in IEC 62443 in substations.
What is verified, by topic
| Topic | What is verified |
|---|---|
| Accounts and roles | Individual accounts, roles with the specified permissions, factory passwords changed, lockout after failed attempts where the device supports it, test accounts removed at the end |
| Ports and services | On each IED, switch, gateway and server, only the necessary services and ports enabled; unused physical ports disabled |
| Firewall and conduits | Rules equal to the documented flow matrix; no generic rules left over from commissioning |
| Remote access | Entry only through the defined path (jump server, intermediate system), with multi-factor authentication and logging |
| Event logging | Security events (login, authentication failure, configuration change) are generated and reach the central server with the correct time |
| Secure protocols | If the project includes them: TLS sessions, GOOSE authentication, valid certificates and rejection of invalid ones |
| Firmware | Installed versions equal to the approved ones, with no known open vulnerabilities or with their mitigation documented |
| Backups | Settings, SCD, network and firewall configurations backed up, and a tested restore |
| Documentation | Equipment inventory, zone and conduit diagram, flow matrix, list of accounts and roles |
FAT and SAT: what is tested in each
- Specification with security requirements
- Agreed test protocol. 62443-3-3 and tender requirements turned into checks
- FAT. Configuration of each device, accounts, services, rules and logs on the integrator's bench
- Factory baseline. Configurations and versions as shipped
- SAT. External links, real remote access, other contractors' equipment and temporary accounts removed
- Delivery baseline approved by the owner
In the FAT what depends on the integrator is verified: configuration of each device, accounts and roles, services, substation firewall rules, event logging and backup. It is done in a controlled environment, where correcting is easy. The list of controls reviewed on each device is in hardening of relays, switches and IEDs.
In the SAT what only exists on site is verified: the real link to the control center, remote access through the owner’s infrastructure and integration with equipment from other contractors. It also verifies that the temporary accounts, rules and access used during commissioning were removed. It is also the moment to compare the final configuration with the factory baseline and document each difference.
What cybersecurity programs and grid rules ask for
Many utility and grid cybersecurity programs turn several of these checks into obligations. For example, NERC CIP-010 in North America requires a baseline configuration and vulnerability assessments before putting changes or new critical cyber assets into production. Typical requirements are:
- a vulnerability assessment before adding a new critical cyber asset to the production environment and in scheduled replacements;
- only the ports and services necessary for normal and emergency operation enabled at the perimeter access points, with a baseline document for that equipment;
- new equipment and changes that do not affect existing controls, with approval from the cybersecurity officer or a delegate;
- every new critical cyber asset incorporating the program’s controls from the start.
The cybersecurity tests in the SAT are the natural way to leave that evidence. We adapt them to the local rules and to the requirements of the utility or operator.
What is not done in a FAT or SAT
- Attack tools on equipment in operation. A penetration test is another job, with its own scope, authorization and window.
- Aggressive scans without knowing the equipment. Some cyber assets cannot be scanned safely, and compensating controls are required for them.
- Approving with open exceptions that have no owner. Each unmet requirement keeps its justification, its compensating control and its date.
Common mistakes
- Vague security requirements in the tender, which cannot be turned into a verification.
- Temporary accounts and rules that are never removed after commissioning.
- A baseline that is not saved, so nobody knows later what changed.
- Testing only the firewall and not the configuration of each IED.
We configure and prepare your system for the tests
At Tiza Group we configure relays, controllers, gateways and switches with the accounts, roles, services and logs your specification asks for, within our substation and plant cybersecurity service, and we help you plan and run the FAT and SAT tests of your system, in Colombia, or elsewhere on request. For relays we also work remotely, even during FAT and SAT, with remote relay configuration. Write to us with the scope of your project. The rules for service laptops, third-party equipment and USB drives connected to relays and switches are in Service Laptops and USB in Substations.
Related guides
- Commissioning standards: FAT and SAT
- IEEE 1686: IED cybersecurity requirements
- IEC 62443 in substations: zones, conduits and SL levels
- Industrial substation router and firewall
- Substation commissioning: stages and tests
- Substation and plant cybersecurity: standards and map
- IEC 62443-2-4: requirements for integrators and contractors
- Configuration management: settings and SCD versions
- IED Hardening: Ports, Services and Accounts
- Service Laptops and USB in Substations: Rules
References
- IEC 62443-3-3:2013, System security requirements and security levels.
- IEC 62443-2-4:2023, Security program requirements for IACS service providers.
- IEEE 1686-2022, Standard for Intelligent Electronic Devices Cybersecurity Capabilities.
- IEC 62351 (series), security of power system communication protocols.
- NERC CIP-010, Configuration Change Management and Vulnerability Assessments.
Frequently asked questions
Which standard defines the cybersecurity tests of a substation FAT?
None defines a single procedure. IEC 62443-3-3 gives the system security requirements, IEEE 1686 the capabilities of each IED and IEC 62443-2-4 what the integrator must do. From those and the project specification, owner and integrator agree on the test protocol.
Why repeat in the SAT what was already tested in the FAT?
Because things change between the factory and the site: external links are connected, equipment from other contractors is added, rules are adjusted and temporary accounts are created for commissioning. The SAT verifies the system as it ends up in operation, and many cybersecurity programs require assessing vulnerabilities before putting a new critical cyber asset into production.
Do cybersecurity tests include trying to attack the system?
In a normal FAT or SAT, no. The configuration is verified against the specification with checklists, configuration reviews and inventory and service verification tools. A penetration test is a different job, planned separately, with explicit scope and authorization and without putting equipment in operation at risk.