The IED records security events and raises security alarms, and reports both to SCADA or another security management system (the 2013 alarm point change detect, now under 5.5; 2013's event and alarm grouping is left to the reporting protocol and supervisory permissive control is dropped). The 2013 audit trail event types, now 5.5.3 and 5.5.3.1, are: log in, manual log out, timed log out, value forcing, configuration access, configuration change, firmware change, ID or password creation or modification, password deletion, audit log access, time or date change, and alarm incident. The 2013 alarms, now 5.5.3.2, are: an unsuccessful login attempt (repeated failures within one attempt recorded as one entry with the count and the time of the last); a reboot by power removal or a reset mechanism; attempted use of configuration software or a computer not registered for the IED; an invalid configuration or firmware download; an unauthorized configuration or firmware file; a time signal out of tolerance with the IED clock; and an improper field hardware change such as a wrong I/O board. Corrigendum 1 clarifies value forcing so that valid control operations are not recorded as forcing events.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.