IEEE 1686
The IEEE standard for the cybersecurity capabilities an intelligent electronic device (protective relay, RTU, controller) must provide so a utility's cybersecurity program is not compromised: identification and authentication, authorization by level or role over seven main security functions, data integrity and confidentiality, a stored record of twelve event types and seven alarms reported to SCADA, resiliency and firmware quality control, and a per-subclause table of conformance for procurement.
IEEE 1686 is a compliance framework from International (power sector) with 5 domains and 14 controls that map to 92 other frameworks. The largest domains are Identification, authentication, authorization and access (5.1, 5.2) – IEEE 1686 (7 controls), Data integrity and data confidentiality (5.3, 5.4) – IEEE 1686 (2 controls), Resiliency and firmware quality (5.6, 5.7) – IEEE 1686 (2 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Data integrity and data confidentiality (5.3, 5.4) – IEEE 1686
| Code | Title |
|---|---|
| ieee-1686::5.3 | Data integrity |
| ieee-1686::5.4 | Data confidentiality, including encrypted serial communications |
Framework, scope and conformance (clauses 1 to 4, Annex A) – IEEE 1686
| Code | Title |
|---|---|
| ieee-1686::A | Table of conformance for the IED |
Identification, authentication, authorization and access (5.1, 5.2) – IEEE 1686
| Code | Title |
|---|---|
| ieee-1686::5.1.2.1 | User identification and authentication for local and remote access |
| ieee-1686::5.1.2.2 | Password construction and display |
| ieee-1686::5.1.2.3 | Access timeout |
| ieee-1686::5.1.2.4 | Password defeat mechanisms |
| ieee-1686::5.1.2.5 | Number of individual users |
| ieee-1686::5.2.2 | Authorization levels and role-based access control |
| ieee-1686::5.2.3 | IED main security functions subject to authorization |
Resiliency and firmware quality (5.6, 5.7) – IEEE 1686
| Code | Title |
|---|---|
| ieee-1686::5.6 | Resiliency: communications port access, functionality compromise and protocol security |
| ieee-1686::5.7 | Firmware quality control |
Response to cybersecurity events (5.5) – IEEE 1686
| Code | Title |
|---|---|
| ieee-1686::5.5.2 | Event record storage capability and record content |
| ieee-1686::5.5.3 | Cybersecurity event types, alarms and reporting |
Your Compliance Coverage
If you comply with IEEE 1686, you already cover:
ISO/IEC 27010:2015
29%
6 controls mapped
Compare →API 1164
29%
6 controls mapped
Compare →IEC 62443
29%
6 controls mapped
Compare →+ 89 more: CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 (29%), OWASP ASVS (24%)
See all 92 mapped frameworks ↓Maps to 92 other frameworks
Coverage is not the same as your position
This page shows what IEEE 1686 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is IEEE 1686 and who does it apply to?
IEEE 1686 is a compliance framework from International (power sector) with 5 domains and 14 controls. The IEEE standard for the cybersecurity capabilities an intelligent electronic device (protective relay, RTU, controller) must provide so a utility's cybersecurity program is not compromised: identification and authentication, authorization by level or role over seven main security functions, data integrity and confidentiality, a stored record of twelve event types and seven alarms reported to SCADA, resiliency and firmware quality control, and a per-subclause table of conformance for procurement. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does IEEE 1686 actually require?
IEEE 1686 has 14 controls organised across 5 domains. The largest domains are Identification, authentication, authorization and access (5.1, 5.2) – IEEE 1686 (7 controls), Data integrity and data confidentiality (5.3, 5.4) – IEEE 1686 (2 controls), Resiliency and firmware quality (5.6, 5.7) – IEEE 1686 (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of IEEE 1686 do I already cover?
IEEE 1686 maps to 92 other compliance frameworks. The top mapping partners are ISO/IEC 27010:2015 (29% coverage), API 1164 (29% coverage), IEC 62443 (29% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement IEEE 1686?
Start your IEEE 1686 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about IEEE 1686 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 14 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required