Protection cybersecurity is not an IT overlay. Controls must preserve dependable tripping, deterministic messaging, forensic evidence and recoverability. A secure relay that cannot be engineered during an outage, or a patch process that changes protection behaviour without regression testing, is not an acceptable design.
Start with consequence and trust boundaries
Identify functions whose loss, delay or unauthorised operation can trip equipment, block protection, falsify measurements or hide alarms. Draw boundaries between station bus, process bus, engineering workstation, remote access, gateway and enterprise networks. List every path that can change settings, logic, firmware, certificates or time.
Identity and least privilege
Replace shared default credentials. Define separate roles for viewing, operations, protection engineering, firmware administration and security administration where the product supports them. Record who can issue controls, change settings, retrieve disturbance records and manage cryptographic material. Access design must also cover local front ports and maintenance laptops.
Secure communications deliberately
IEC 62351 is a series, not a single switch. Different parts address TCP/IP profiles, IEC 61850 security, network management, role-based access and key management. Select applicable mechanisms per protocol and device capability. Do not claim that “IEC 62351 compliant” proves the entire substation architecture is secure.
Firmware and configuration lifecycle
Require an authoritative software bill or at least a controlled inventory of IED type, firmware, communication modules and engineering tools. Verify update authenticity, rollback method, configuration compatibility and vendor security advisories. Every change that could affect protection or communications needs impact assessment and a defined regression-test set.
Logging without losing the event
Synchronise time, protect log integrity and centralise the events needed to reconstruct setting changes, failed logins, communication-state changes, control operations and firmware actions. Preserve relay event records and oscillography independently of general security logs. Confirm storage limits and what happens when memory is full.
Design for recovery
Keep offline, version-controlled copies of approved settings, logic, SCL files, certificates and vendor tools. Define how a replacement IED is securely commissioned when the normal engineering network is unavailable. Test backup restoration and certificate renewal before an emergency. Cyber resilience is demonstrated by recovery exercises, not only prevention controls.
Procurement questions
- How are vulnerabilities disclosed and supported through the product lifecycle?
- Are firmware packages cryptographically signed and verifiable offline?
- Which protocols and services can be disabled?
- How are roles, passwords, certificates and keys provisioned and replaced?
- Can security logging be exported without weakening protection performance?
- What regression testing is required after firmware or security configuration changes?
Official sources and revision control
- IEC 62351:2026 series official record
- IEC 62351-3:2023 official record
- IEC 62351-6:2020 official record
- IEC 62351-9:2023 official record
- ABB REX615 official product page
Technical review date: 16 August 2026. Standards and product capabilities can change; confirm the project-specific edition, firmware, options and ordered configuration before engineering or procurement.