IEEE 1686 Section5.2-5.3-AuditLog-Retention-Export-Monitoring: IEEE 1686 Section 5.2 + 5.3 - Audit Trail Records + Retention + Export + Supervisory Monitoring and Control + Network Security Monitoring

Section 5.2 establishes audit trail records requirements for IEDs. Per public IEEE 1686 abstract + vendor capability statements (full IEEE text NOT reproduced): audit trail of security-relevant events including authentication + authorization + configuration change + privileged operations + system start/stop + failed authentication + access denied; minimum log retention onboard IED (typically 30-90 days depending on storage); audit log export to centralised log server / SIEM via syslog + IEC 61850 + secure protocol; log integrity protection + tamper-evident; accurate time synchronisation per Section 5.7. Section 5.3 Supervisory Monitoring and Control: real-time supervisory monitoring of IED health + status + configuration + cyber events; integration with SCADA + HMI + central monitoring station; alarm generation for security events + threshold violations + integrity failures. Beyond Section 5.2-5.3 - network security monitoring for substation network: passive monitoring of IEC 61850 + DNP3 + Modbus traffic + intrusion detection (Dragos + Claroty + Nozomi + ICS-specific IDS); centralised log management + SIEM with utility / energy sector-specific rules + alerting. Coordinates with IEC 62443-3-3 SR 6.1-6.2 (Timely Response to Events) + NERC CIP-007 (System Security Management) requiring security event monitoring + NERC CIP-008 (Incident Reporting) + NIST SP 800-53 AU (Audit and Accountability) + SI-4 (Information System Monitoring).