Cybersecurity zoning separates assets with similar consequence and trust requirements; conduits permit only the communications needed between them. A VLAN is not a zone by itself, and a firewall rule list is not a risk assessment. For MV switchgear, the architecture must preserve protection and local control while containing compromise of SCADA, engineering access, vendors or enterprise services.
This guide applies the IEC 62443-3-2 zone/conduit method with IEC 62351 protocol security to a practical substation, from process/bay IEDs to station HMI, gateway, remote access and control center.
1. Define the system under consideration
- List protection/control IEDs, merging units/process I/O, station HMI/servers, RTUs/gateways, network/time devices and engineering workstations.
- Include physical primary equipment interfaces, DC supplies, serial links, wireless/cellular services and removable media paths.
- Identify control center, corporate/asset systems, vendor support and cloud services outside the boundary.
- Record every data flow, protocol, direction, client/server/publisher role, performance and availability need.
- Define safety/reliability consequences of loss, manipulation, disclosure and delayed recovery.
- State lifecycle owners and trust boundaries, including temporary commissioning connections.
2. Partition by function, consequence and trust
| Candidate zone | Typical assets | Dominant requirement |
|---|---|---|
| Process/bay protection | MUs, PIUs, relays, bay controllers | Deterministic trip/control availability and integrity |
| Station operations | HMI, station controller, RTU/gateway | Trusted monitoring/control and event continuity |
| Network/time management | Switches, clocks, management servers | Restricted administration and configuration integrity |
| Engineering/maintenance | IED tools, setting files, portable service host | High privilege, controlled sessions and malware defense |
| Substation DMZ | Jump host, proxy, update/log relay | Broker north/south services without direct trust |
| External/control center | WAN routers, master SCADA, SOC/enterprise | Authenticated, monitored conduits across sites |
Assets may share a physical switch yet belong to different security zones only if enforcement, management and failure analysis justify it. High-consequence protection traffic should not inherit the exposure of an HMI or maintenance laptop.
3. Define conduits from approved data flows
- IED-to-HMI/gateway MMS reports and controls.
- GOOSE/SV/PTP multicast confined to the exact required station/process scope.
- Gateway-to-control-center IEC 104/DNP3 sessions through approved WAN/security devices.
- Engineering access only through a managed path, not from enterprise directly to an IED.
- Clock, directory, logging, update and backup flows with explicit direction and destination.
- Vendor remote support as time-limited, approved and recorded access via jump host.
- Deny all undocumented paths and maintain a machine-readable flow/rule matrix.
4. Zones are not just VLANs
- VLANs separate broadcast domains but do not authenticate endpoints or inspect every relevant protocol.
- Use physical separation where independence, latency or consequence requires it.
- Firewalls/ACLs enforce routed conduits; Layer-2 multicast needs switch-port/VLAN controls and monitoring.
- Separate management plane from operational traffic and restrict administrative origins.
- PRP/HSR A/B networks improve availability but must not become alternate paths around security enforcement.
- Document how failure of a firewall, switch or authentication service affects protection/local control.
5. Apply IEC 62351 by protocol
- IEC 62351-4 addresses security profiles including MMS and derivatives.
- IEC 62351-6 covers security for IEC 61850 profiles such as GOOSE/SV as applicable.
- IEC 62351-5:2023 and IEC TS 60870-5-7:2025 support security for IEC 60870-5 derivatives.
- IEC 62351-3 provides transport-layer security profiles used by relevant TCP/IP communications.
- IEC 62351-8 addresses role-based access control; implementation and mapping must be verified.
- IEC 62351-9 covers key management considerations.
- A protocol-security feature does not replace zoning, least privilege, hardening, monitoring or recovery.
6. Engineering and remote access
- Use a managed engineering workstation/jump host with unique users and strong authentication.
- Separate view/diagnostic, settings, firmware and protection-logic privileges.
- Approve sessions by asset/task/time; disable standing vendor tunnels.
- Scan/control portable media and transferred files while preserving required offline recovery.
- Record session, commands/files, configuration before/after and responsible approver.
- Prevent engineering access from becoming a low-latency path that disrupts GOOSE/SV/MMS.
- Maintain an emergency local method that is controlled, documented and audited afterward.
7. Identity, certificates and keys
- Inventory device/user/application identities and certificate/key ownership.
- Plan enrollment, trust anchors, renewal, revocation, replacement and clock dependency.
- Use role-based least privilege; remove shared default and departed-user accounts.
- Protect private keys and configuration backups; define recovery on device replacement.
- Test expiry/revocation/unavailable directory behavior without compromising local protection.
- Monitor authentication failures and unexpected identity/certificate changes.
8. Monitoring without harming real-time operation
- Collect switch/firewall/IED/gateway/clock authentication, configuration and health events.
- Monitor new/rogue IEC 61850 publishers, unexpected multicast, disabled reports and repeated controls.
- Baseline protocol peers/rates and alert on anomalies with operational context.
- Prefer passive monitoring for deterministic protection networks; qualify any active scan.
- Preserve synchronized logs and packet evidence with known time quality.
- Rate-limit/log export so an event storm or SOC outage cannot starve protection/SCADA.
- Define who responds and how cyber isolation affects station control.
9. Availability and fail-safe design
- Protection trips and essential local interlocks should remain autonomous during DMZ/WAN/security-service loss.
- Do not place one firewall/authentication server in every fast protection path.
- Engineer redundant enforcement devices without split-brain or alternate bypass routing.
- Block remote close on stale/invalid state or uncertain authority after security/session failure.
- Define manual/local operations during cyber isolation.
- Back up signed/verified configurations and prove restore to spare hardware.
- Test degraded operation, not only normal secure connectivity.
10. Security-level and requirements process
- Define the system and zone/conduit boundaries.
- Identify threats/vulnerabilities and consequence for each zone/conduit.
- Assess unmitigated risk using the organization’s method.
- Establish target security level/requirements per zone and conduit.
- Select architectural and component controls to reduce risk.
- Record residual risk, dependencies and operational compensating controls.
- Verify implementation and reassess after major change or threat evolution.
11. FAT/SAT security verification
- Compare live topology, assets, ports/services and rules with the approved flow matrix.
- Test every permitted flow and representative denied source/destination/protocol/direction.
- Verify roles, default-account removal, lockout, audit and privileged workflow.
- Test certificates/keys, renewal/revocation/expiry and time loss.
- Fail firewall, DMZ, directory, log server, WAN and one redundant path.
- Verify local protection/control and safe remote-control degradation.
- Attempt rogue GOOSE/MMS/time/telecontrol peers in a controlled test.
- Test backup restore, incident isolation and recovery to the approved baseline.
- Measure worst-case performance with security/logging and event storms active.
- At SAT, validate physical ports, cabinets, remote links and as-built rules.
12. Required design dossier
- System/asset and zone/conduit diagrams with trust/consequence rationale.
- Data-flow, port/service, identity and certificate/key matrices.
- Risk assessment, target requirements and residual-risk approvals.
- Hardening, remote-access, monitoring and incident-response procedures.
- Backup/restore, patch/vulnerability and lifecycle plans.
- FAT/SAT evidence and as-built configuration hashes.
References and further reading
- IEC 62443-3-2:2020 — Risk assessment, zones and conduits
- IEC 62443-3-3:2013 — System security requirements
- IEC TR 62351-10:2012 — Power-system security architecture
- IEC 62351-4 consolidated edition — MMS security
- IEC 62351-5:2023 — IEC 60870-5 derivative security
- IEC 62351-6:2020 — IEC 61850 profile security
- IEC TS 60870-5-7:2025 — Secure IEC 101/104 extensions
Engineering note: The best zone boundary is one that limits consequence and remains operable during failure—not merely the easiest VLAN boundary to draw.