IEEE C37.240-2014 pdf free.IEEE Standard Cybersecurity Requirements for Substation Automation, Protection,and Control Systems.
This document provides technical requirements for substation cybersecurity. It presents sound engineering practices that can be applied to achieve high levels of cybersecurily of automation. protection, and control systems independent of voltage class or criticality of cyber assets. Cybersecurity includes trust and assurance of data in motion, data at rcst. and incident response.
Modem substation automation, protection, and control systems, while using technology advancements to achieve greater power-system reliability, can be vulnerable to a niultitude of cybersecurity threats. These vulncrabilities and threats can lead to overall power-system integrity issues. With the increasing dependency on communication technology and the growing pressure of a secure utility infrastructure, various standardization bodies are in the process of developing cybersecurity standards where very little effort has gone into the harmonization or rationalization of ihese standards to substation applications. Examples of important standards to the utility community are the following:
一 IEC 62351， Power systems management and associated information exchange- -Data and communication security.
一 IEEE Std 1686TM, IEEE Standard for Itelligent Electronice Devices Cybersecurity Capabilitis.
一 IEEE Std 1711TM， IEEE Trial-Use Standard for a Cryptographic Protocol for Cybersecurity of Substation Serial Links.
NERC CIP, Critical Infrastrucure Protection.
This standard builds on the other work to date to produce a specification for a technically feasible cybersecurity implementation.
The followving referenced documents are indispensable for the application of this document (i.e., they must be understood and used, so each referenced document is cited in text and its relationship to this document is explained). For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments or corrigenda) applies.
Cyhersecurity in substation automation, protection, and control systems is widely recognized as a critical component in overall reliability of electricity supply. The North American Electric Reliability Corporation (NERC) critical infrastructure protection (CIP) standards have addressed a number of objcctivcs that are In be accomplished in a cybersecurity program hut have left the technical details and methods to the individual implementer. It can, however, be deduced that any cybersecurity program for the electric utility substation cnvironmcm must have ccnain characteristics:
— Technical Feasihilit: The cybersecurity of a substation must be technically feasible in a substation environment. There are many aspects of substation operation that may preclude the use of cybersecurity technologies that are employed in other environments, such as commercial, financial, and military aaspccts. Additionally, the program must be able to be deployed in a timely manner. A cybersecurity program that requires the replacement of a massive amourn of automation. protection, and control equipment is not feasible, as the deployment might take many years. leaving the utility vulnerable through the deployment period.
— Economic Feasihiliti’: A cybersecurity program must take into account the size of the deployment and the ability of the utility to accomplish deployment at a cost acceptable to the stakcholdcrs, which includes both shareholders and ratepayers of the utility.
— Operational Feasibility.- Utility substations have specific operational and maintenance requirements that must be considered in the development of the cybcrsccurity program. For example. a cybersecurity program that relies solely on having a local-area/wide-area network (LAN/WAN) connection to the substation may be impractical as loss of communications to the substation is likely under a number of typical fault scenarios. The cybcrsccurity system must not become an undue impediment for the critical functions of substation operation to occur.
This standard presents the minimum requirements for a substation cybersecurity program. keeping in perspective the technical, economical, and operational feasibility of deployment. A utility deploying a cybcrsccurity program that meets the requirements of this standard will have developed a program that considers all of the above elements and represents the best practices as employed by the industry.IEEE C37.240 pdf download.