For GOOSE and Sampled Values requiring 3 ms response, multicast and little CPU load, encryption is not advised and confidentiality comes from restricting layer 2 GOOSE and SV to the substation LAN, though a confidentiality mechanism is defined where 3 ms delivery is not a concern; without encryption the mechanism counters tampering through message-level authentication, with encryption unauthorized access and disclosure as well, and it counters man-in-the-middle through a message authentication code, tamper detection through the authentication algorithm and replay through specialised processing state; secure and non-secure PDUs co-exist except for confidentiality.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.