IEEE 1686-2022 Standard for Intelligent Electronic Devices Cyber Security Capabilities
International standard defining minimum cybersecurity capabilities required in Intelligent Electronic Devices (IEDs) used in power substations — protective relays, bay controllers, merging units, and phasor measurement units. 10 capability areas covering electronic access control, audit trail, firmware integrity, configuration management, communication security, network filtering, password management, session management, physical port security, and secure development practices. Used for procurement specifications and NERC CIP compliance.
AC Access Control
| Control | Name | IEEE 1686-2022 References |
|---|---|---|
| AC-02 | Account Management | 5.1 |
| AC-03 | Access Enforcement | 5.15.9 |
| AC-04 | Information Flow Enforcement | 5.6 |
| AC-05 | Separation of Duties | 5.1 |
| AC-06 | Least Privilege | 5.1 |
| AC-07 | Unsuccessful Logon Attempts | 5.7 |
| AC-10 | Concurrent Session Control | 5.8 |
| AC-11 | Device Lock | 5.8 |
| AC-12 | Session Termination | 5.8 |
AU Audit and Accountability
CM Configuration Management
IA Identification and Authentication
MP Media Protection
| Control | Name | IEEE 1686-2022 References |
|---|---|---|
| MP-07 | Media Use | 5.9 |
PE Physical and Environmental Protection
| Control | Name | IEEE 1686-2022 References |
|---|---|---|
| PE-04 | Access Control for Transmission | 5.9 |