Section 5.1 establishes electronic access account management capabilities required of IEDs. Per public IEEE 1686 + IEEE Std abstract + vendor capability statements (full IEEE text NOT reproduced): individual user accounts with unique identification (5.1) + no shared accounts where supported by IED capability; passwords + password complexity + minimum length + composition + aging + history per Section 5.1.1; role-based permissions (5.1.2) with predefined roles (Viewer + Operator + Engineer + Administrator + Auditor) + permission matrix; failed login handling (5.1.3) including account lockout + delay between attempts + audit trail of failures; session inactivity timeout (5.1.4) automatic logout + configurable timeout. Beyond Section 5.1 directly: electronic access perimeter management (mapped to coordination with IEC 62443-3-3 SR 5.1-5.4 zones and conduits + NERC CIP-005 Electronic Security Perimeter ESP); interactive remote access security including VPN + jump host + 2FA + recorded sessions (NERC CIP-005-7 R2 Interactive Remote Access); revocation of access on personnel change + termination + role change; personnel risk assessment via background check + ongoing review for personnel with access to BES Cyber Systems (NERC CIP-004). Physical access control coordinated with Section 5 + tamper detection per Compliance Table. Coordinates with IEC 62443-3-3 SR 1.1-1.13 (Identification and Authentication Control) + IEC 62443-4-2 CR 1.1-1.13 + NERC CIP-004 (Personnel and Training) + NERC CIP-005 (Electronic Security Perimeters) + NIST SP 800-53 AC + IA families.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.