IEEE 1547.3-2023 is the IEEE guide for the cybersecurity of distributed energy resources (DER) connected to the grid: solar, wind, storage and other sources at medium and low distribution voltage. It complements IEEE 1547-2018, which defines the resource's communication interface, and takes an end-to-end view of security, from the inverter to the utility and the platforms that manage it. These are recommendations, not requirements; they help specify and operate self-generation and distributed generation.
What IEEE 1547.3 is
IEEE 1547.3-2023, IEEE Guide for Cybersecurity of Distributed Energy Resources Interconnected with Electric Power Systems, is the IEEE guide for the cybersecurity of distributed energy resources (DER) connected to electric power systems. The IEEE standards board approved it on June 5, 2023 and it was published on December 11, 2023. It replaced IEEE 1547.3-2007, which covered a different topic: monitoring, information exchange and control of distributed resources.
It is part of the IEEE 1547 family, on interconnection of distributed resources, developed by the IEEE SCC21 coordinating committee.
Scope
The guide covers DER connected at typical primary or secondary distribution levels: fuel cells, photovoltaic, wind, microturbines, other distributed sources and storage systems. Its limits are explicit:
- They are guidelines and recommendations, not requirements, and may not include everything needed. Each user is responsible for reviewing how they apply to their case.
- It goes beyond the DER interface defined by IEEE 1547-2018, because security has to be end to end and work for very different architectures.
- Outside the formal scope are transmission-connected systems, microgrids, electric vehicle charging stations and islanded systems, although the guide states they can benefit from its recommendations.
Why distributed generation needs its own guide
A large solar plant has an operator, a control center and a designed communications network. Distributed generation is different: thousands of small inverters on rooftops and in factories, connected to the customer’s network, to the manufacturer’s cloud, sometimes to an aggregator and, more and more, to the grid operator to receive setpoints. No single inverter affects the system on its own, but many at once do.
That idea appears in several recent sources. SolarPower Europe warned in April 2025 that small systems, when connected to the clouds of manufacturers, installers or service providers, add up to true virtual power plants of significant scale. NIST IR 8498, from December 2024, says that compromising a single residential inverter would today have a minimal impact on the grid, but that an attack on many could have significant effects as the grid depends more on them.
The interface defined by IEEE 1547-2018
IEEE 1547-2018 requires the distributed resource to have a local communication interface with a standardized protocol. The three protocols it recognizes are IEEE 2030.5, IEEE 1815 (DNP3) and SunSpec Modbus. Through that interface, measurements and statuses are read and settings and setpoints are sent: power limits, voltage and reactive control modes, connection and disconnection.
Each protocol comes with different security capabilities:
| Protocol | Typical use | Built-in security |
|---|---|---|
| IEEE 2030.5 | Communication between the utility or aggregator and the resource, often over the internet | Designed over TLS with digital certificates |
| IEEE 1815 (DNP3) | Link to the operator’s control center | Secure authentication and the DNP3-SL layer, if the device implements them; see DNP3 |
| SunSpec Modbus | Local communication with the inverter | Modbus has no authentication or encryption; see Modbus RTU and TCP |
The practical consequence: the IEEE 1547-2018 interface opens the resource to external commands, and the security of that channel depends on the protocol, how it is configured and the network it travels over. That is where IEEE 1547.3 comes in. A Modbus port open to the internet, for example, lets anyone who reaches it read and write inverter registers; that is why this protocol is reserved for separate, protected local networks.
How to think about end-to-end security
- Inverter or DER controller. Own credentials, roles, logging and managed firmware
- Local interface. Standardized protocol; Modbus only on an isolated local network
- Gateway or data logger. Single exit point, firewall and controlled updates
- Public or private network. Encryption and mutual authentication with digital certificates
- Utility, aggregator or manufacturer. Accounts, permissions and a record of every command sent
Without going into the text of the guide, which is paid, the chain shows where decisions have to be made: who can send a command, how they authenticate, what path it travels and who records what was done. The NIST IR 8498 guidelines for inverters (credentials, roles, logging, update, backup, disabled functions, protected communications) cover the first link. The IEC 62351 standards and the IEC 62443 series provide the tools for the others, as explained in IEC 62351 and in IEC 62443 in substations.
How to apply it
Grid operators and regulators increasingly publish their own cybersecurity requirements for generation, usually with thresholds by plant size and criticality. A good share of self-generation and distributed generation falls below those thresholds, so its cybersecurity depends on design, contract and good practices such as those in IEEE 1547.3. We adapt the approach to the local code and the utility requirements you give us.
Three concrete uses:
- In the specification of inverters and controllers: require role-based accounts, strong authentication, exportable logs, signed firmware and the ability to disable unused interfaces.
- In the connection design: keep the inverter on a network separate from the customer’s, with a single controlled exit toward the cloud and the utility.
- In operation: keep the inventory, change factory credentials, review who has access and manage updates.
Connection procedures and requirements are covered in small-scale self-generation, in large-scale self-generation and distributed generation and, for protection, in protection for self-generation and DG.
We help with your installation
At Tiza Group we design and configure the communications network, firewall and remote access of solar and self-generation plants. We also leave control equipment without factory credentials and with logging active. All of this is part of our substation and plant cybersecurity service. We configure the connection protection relays remotely with remote relay configuration. Write to us with your project data.
Related guides
- Solar plant communications
- Protection for self-generation and DG: requirements and study
- DNP3 (IEEE 1815): what it is, how it works and how it is tested
- IEC 62351: cybersecurity for IEC 61850, 104 and DNP3
- The inverter disconnects from the grid
- NIST IR 8498: smart inverter cybersecurity
- Solar plant cybersecurity: risks and controls
- Substation and plant cybersecurity: standards and map
References
- IEEE 1547.3-2023, IEEE Guide for Cybersecurity of Distributed Energy Resources Interconnected with Electric Power Systems (approved June 5, 2023, published December 11, 2023).
- IEEE 1547-2018, Standard for Interconnection and Interoperability of Distributed Energy Resources with Associated Electric Power Systems Interfaces.
- NIST IR 8498, Cybersecurity for Smart Inverters, December 2024.
- SolarPower Europe and DNV, Solutions for PV Cyber Risks to Grid Stability, 29 April 2025.
Frequently asked questions
Is IEEE 1547.3 mandatory?
No. The standard itself clarifies that its security items are guidelines and recommendations, and that each user must review how they apply to their implementation. It becomes enforceable only if a regulation, a grid operator or a contract adopts it.
What is the difference between IEEE 1547 and IEEE 1547.3?
IEEE 1547-2018 is the interconnection and interoperability standard: it says how the resource must behave toward the grid and what communication interface it must offer. IEEE 1547.3-2023 is a cybersecurity guide that goes beyond that interface and addresses end-to-end security.
Does it apply to plants connected at transmission level?
They are not within its formal scope, which is resources connected at distribution levels. The guide states that transmission-connected systems, microgrids, electric vehicle charging stations and islanded systems can benefit from its recommendations.