IEC 62351 - Power Systems Communication Security

Part 5: security for IEC 60870-5 and derivatives – IEC 62351 - Power Systems Communication Security

IEC 62351 - Power Systems Communication Security 5:5.2: Part 5, 5.2: threats addressed (spoofing, tampering, replay, eavesdropping)

The authentication mechanism for IEC 60870-5 and its derivatives (DNP3 among them) addresses only spoofing, tampering, replay and, with the 2023 edition's encryption option, eavesdropping, as defined in part 2; denial of service and traffic analysis are not in its scope.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Part 5: security for IEC 60870-5 and derivatives – IEC 62351 - Power Systems Communication Security

5:5.3 Part 5, 5.3: design issues of the telecontrol environment
5:5.4 Part 5, 5.4: general principles (application layer only, generic definition mapped to protocols, bi-directional, key management, backwards tolerance, upgradeable, multiple connections)
5:6.2 Part 5, 6.2: theory of operation (association ID, authenticating, central authority, role-based access control, cryptographic keys, security statistics and events)
5:7 Part 5, clause 7: functional requirements (procedures, state machines, timers and counters, security statistics thresholds, reporting, event monitoring and logging)
5:8.3 Part 5, 8.3: station association procedure (public-key certificates, configuration of authorized remote stations, verification of certificates, update keys)
5:8.4 Part 5, 8.4: session key change procedure
5:8.5 Part 5, 8.5 and following: authentication of critical messages (challenge-response and aggressive mode), ASDU protection and error handling

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All IEC 62351 - Power Systems Communication Security controls