SIST EN IEC 62351-8:2026
(Main)Power systems management and associated information exchange - Data and communications security - Part 8: Role-based access control for power system management (IEC 62351-8:2026)
- Abstract
The scope of this part of IEC 62351 is to facilitate role-based access control (RBAC) for power system management. RBAC assigns human users, automated systems, and software applications (collectively called "subjects" in this document) to specified "roles", and restricts their access to only those resources, which the security policies identify as necessary for their roles.
As electric power systems become more automated and cyber security concerns become more prominent, it is becoming increasingly critical to ensure that access to data (read, write, control, etc.) is restricted. As in many aspects of security, RBAC is not just a technology; it is a way of running a business. RBAC is not a new concept; in fact, it is used by many operating systems to control access to system resources. Specifically, RBAC provides an alternative to the all-ornothing super-user model in which all subjects have access to all data, including control commands.
RBAC is a primary method to meet the security principle of least privilege, which states that no subject should be authorized more permissions than necessary for performing that subject’s task. With RBAC, authorization is separated from authentication. RBAC enables an organization to subdivide super-user capabilities and package them into special user accounts' termed roles for assignment to specific individuals according to their associated duties. This subdivision enables security policies to determine who or what systems are permitted access to which data in other systems. RBAC thus provides a means of reallocating system controls as defined by the organization policy. In particular, RBAC can protect sensitive system operations from inadvertent (or deliberate) actions by unauthorized users. Clearly RBAC is not confined to human users though; it applies equally well to automated systems and software applications, i.e., software parts operating independent of user interactions.
The following interactions are in scope:
– local (direct wired) access to the object by a human user, a local and automated computer agent, or a built-in human machine interface (HMI) or panel;
– remote (via dial-up or wireless media) access to the object by a human user;
– remote (via dial-up or wireless media) access to the object by a remote automated computer agent, e.g., another object at another substation, a distributed energy resource at an enduser’s facility, or a control centre application.
While this document defines a set of mandatory roles to be supported, the exchange format for defined specific or custom roles is also in scope of this document. This is achieved by defining two different encoding approaches to handle the definition of custom roles, either based on specific permissions or based on constraints to existing permissions. The definition on handling custom based roles was started in IEC 62351-90-1 and taken over into the IEC 62351-8:2020. Moreover, additionally to the definition of custom roles based on associated permissions, this document also includes options how to assign permissions to objects in a general way. Referencing documents will provide a mapping to a concrete data model to ensure an interoperability for standard roles used in different data models as well as for custom defined roles. Referencing documents might be standards such as IEC PAS 61850-90-19 or IEC 60870-5-7:2025 or also definitions by an operator.
Out of scope for this document are all topics which are not directly related to the definition of roles and access tokens for local and remote access, especially administrative or organizational tasks, such as:
– definition of usernames and password definitions/policies;
– management of keys and/or key exchange;
– engineering process of roles;
– assignment of roles;
– selection of trusted certification authorities issuing credentials (access tokens);
– defining the tasks of a security officer;
– integrating local policies in RBAC.
NOTE Specifically, the manage
- Status
- Published
- Public Enquiry End Date
- 29-May-2025
- Publication Date
- 08-Nov-2026
- Technical Committee
- PSE - Power systems management
- Current Stage
- 6060 - National Implementation/Publication (Adopted Project)
- Start Date
- 03-Nov-2026
- Due Date
- 08-Jan-2027
- Completion Date
- 09-Nov-2026
Buy Documents
SIST EN IEC 62351-8:2026 - BARVE. Del standarda IEC je tudi datoteka "IEC_62351_8_Software_Supplement" (.zip).
SIST EN IEC 62351-8:2026 is the Slovenian adoption of IEC 62351-8, published by SIST for power systems management and associated information exchange. It specifies role-based access control (RBAC) for power system management: how subjects, roles, permissions, access tokens, and verification are used to restrict access to data and control functions. The document is aimed at utilities, equipment vendors, and system integrators that need interoperable access control across power-system data models and protocols.
What does SIST EN IEC 62351-8:2026 specify?
SIST EN IEC 62351-8:2026 specifies how RBAC is applied to power system management for local and remote access. It covers human users, automated systems, and software applications, and it restricts them to the resources needed for their roles.
The standard is built around the least privilege principle. In practice, that means authorization is separated from authentication, and access decisions are based on role information rather than on a broad super-user model.
The document is organized into clauses 1 to 13 and informative annexes A to E.
| Annex | What it covers |
|---|---|
| Annex A | Mapping of security events to IEC 62351-14 |
| Annex B | Role definitions from previous revisions and editions of IEC 62351-8 |
| Annex C | Informative XACML example for a specific role definition |
| Annex D | LDAP interaction examples |
| Annex E | General application of the RBAC access token |
The scope includes local wired access, remote human access, and remote automated access. It also includes the exchange format for defined and custom roles, plus options for assigning permissions to objects in a general way. Topics such as usernames and password policy, key management, role engineering, role assignment, certification authority selection, security officer duties, and local policy integration are outside the document’s focus.
What are the key requirements of SIST EN IEC 62351-8:2026?
SIST EN IEC 62351-8:2026 defines the RBAC model, the access token structure, several token profiles, and the checks needed before access is granted. It also sets out how tokens are distributed and how implementations show conformance.
RBAC model and role assignment
The standard separates the main RBAC functions into subject-to-role mapping and role-to-permission mapping. Subject assignment is stored outside the entity in a repository, while role-to-permission assignment is stored inside the entity and depends on the data model in use.
This matters because subject roles change more often than the underlying permissions. Keeping the faster-changing information in the repository and the stable permissions in the device or service reduces administration effort and helps keep different implementations aligned.
Clause 5 also introduces operationSet, which combines a role and a permission for a specific object. That allows finer control when a role should only be able to perform certain actions on certain objects.
Pre-defined roles and custom roles
Clause 6 defines mandatory pre-defined roles and also allows custom-based roles. The pre-defined roles listed for support are VIEWER, OPERATOR, ENGINEER, INSTALLER, SECADM, SECAUD, and RBACMNT, with reserved values for future IEC use.
This is important for interoperability. A buyer or integrator can expect a common baseline role set, while still allowing an operator or vendor to define additional roles when a project needs them.
The standard also gives two ways to encode custom roles - one based on specific permissions and one based on constraints on existing permissions. It further covers operational states and security events that affect the engineering of roles and permissions.
Access token content and profiles
Clause 8 defines access tokens and supports five profiles: X.509 public-key certificate, X.509 attribute certificate, JSON Web Token (JWT), RADIUS provided access token information, and LDAP provided RBAC information. Common information is shared across profiles so that a migration from one profile to another is possible.
The required token content includes roleID, revision, roleDefinition, and Area of Responsibility (AoR). Additional meta information such as token holder, validity period, issuer, serial number, and signature data is defined by profile.
This matters in practice because the chosen profile affects how the token is carried, verified, and distributed. It also determines whether the token is self-contained or depends on a repository, which affects whether local verification is possible.
Verification before access is granted
Clause 9 defines what the relying party checks before accepting a token. These checks include subject authentication, token availability, validity period, integrity, issuer, roleID, revision number, AoR, role definition, revocation state, operation, and sequence number.
The practical effect is that access is not granted just because a token exists. The implementation must verify that the token belongs to the authenticated subject, is still valid, matches the expected role definition, and has not been altered or revoked.
Distribution and backend services
Clause 10 defines PUSH and PULL token distribution models. In PUSH, the subject fetches the token before access; in PULL, the controlled entity fetches token information from the repository when the subject connects.
Clause 11 then explains how RBAC token services interact with backend systems such as LDAP, OAuth, and RADIUS. That matters because many deployments will use directory services or AAA services rather than local storage only.
The standard also defines secure communication expectations for these backend interactions. In other words, the token service and the access-controlled entity must communicate in a protected way.
Transport and conformance
Clause 12 covers access token transport in Ethernet-based protocols, non-Ethernet-based protocols, and in the context of the application protocol. Clause 13 then states what a conforming implementation must support.
A conforming implementation shall support at least one role, and that role may be pre-defined or custom based. The standard also defines conformance for token format, token content, token distribution, role information, role information exchange, and security events.
What terms does SIST EN IEC 62351-8:2026 define?
SIST EN IEC 62351-8:2026 defines the vocabulary used to describe RBAC in power systems.
- Access token - evidence of a subject’s right to access a resource or perform actions.
- Area of Responsibility (AoR) - the range of authority for a role, often tied to geographic or organizational boundaries.
- Automated agent - a computer program that performs local or remote operations without user input.
- Least privilege - the minimum set of permissions needed for a task.
- OperationSet - a tuple of a role and a permission that can be assigned to specific objects.
- Role - a job function with authority and responsibility that subsumes a set of permissions.
- Subject - a user or automated agent that can hold permissions.
- Session - the period of interaction between a subject and an application or computer.
Who uses SIST EN IEC 62351-8:2026?
SIST EN IEC 62351-8:2026 is used by utilities, substation automation teams, control-centre operators, equipment manufacturers, and system integrators. It is also relevant to identity management teams and cybersecurity engineers who design access control for power-system environments.
In practice, users apply it to define roles, map permissions to data models, set up access tokens, integrate LDAP, RADIUS, or OAuth services, and verify access at the controlled device or application. It is especially relevant where human operators and automated systems both need controlled access to SCADA, EMS, IEDs, substations, or related services.
What changed in SIST EN IEC 62351-8:2026 from the previous edition?
The document history records these changes during preparation of this edition:
- Clause 6 was restructured to distinguish common roles from their mapping to different protocols and data models.
- PULL and PUSH distribution models were introduced for access token handling.
- Permission-set work from IEC 61850-90-19 was prepared for inclusion.
- Role revision information from earlier versions was added.
- Profile C was updated, including its backend interaction.
- Profile E was added and completed with LDAP-based handling.
- LDAP interaction was updated so that LDAPS is mandatory and startTLS is optional.
- Generic permission mapping was added to simplify administration across data models.
- The roleID reserved range was adjusted to 255.
- Annex F was removed.
Annex B preserves earlier role-to-permission assignments from IEC/TS 62351-8:2011 and IEC/IS 62351-8:2020 for reference.
Which standards are used with SIST EN IEC 62351-8:2026?
| Reference | What it contributes |
|---|---|
| IANA Private Enterprise Numbers Registry | Enterprise number identifiers |
| IEC TS 62351-2 | Glossary of terms |
| IEC 62351-3:2023 | TCP/IP profiles |
| ISO/IEC 9594-8:2020/Cor.2:2023 / ITU-T X.509 | Public-key and attribute certificate frameworks |
| ISO/IEC 9594-11:2020 / ITU-T X.510 | Secure directory operations |
| RFC 2865 | RADIUS |
| RFC 4513 | LDAP authentication methods and security mechanisms |
| RFC 5755 | Attribute certificates for authorization |
| RFC 6614 | TLS encryption for RADIUS |
| RFC 6749 | OAuth 2.0 authorization framework |
| RFC 7519 | JWT |
| XACML-RBAC | Hierarchical RBAC policy profile |
The text also references IEC 62351-7 for monitoring objects, IEC 62351-9 for certificates and related management, and IEC 62351-14 for cyber security events. It mentions IEC/PAS 61850-90-19 and IEC 60870-5-7 as examples of standards that define data-model-specific role and permission mappings.
What does the SIST EN IEC 62351-8:2026 document contain?
The document contains an RBAC process model, role and permission definitions, access token formats, verification rules, distribution models, backend service interactions, transport guidance, and conformance statements. It includes figures for the generic access-control framework, separation of duty, role-permission relationships, PUSH and PULL models, OAuth-based token flow, and a session-based application model.
It also contains tables for pre-defined roles, role-to-permission mapping, access-token fields, conformance, and security-event mappings. Annex C gives an XACML example for defining roles and permissions, Annex D gives LDAP schema examples in LDIF form, and Annex E shows how the access token is applied in general use cases.
Relations
- Effective Date
- 01-Dec-2026
- Effective Date
- 18-Aug-2026
- Effective Date
- 27-Oct-2026
- Effective Date
- 27-Oct-2026
- Effective Date
- 27-Oct-2026
Buy Documents
SIST EN IEC 62351-8:2026 - BARVE. Del standarda IEC je tudi datoteka "IEC_62351_8_Software_Supplement" (.zip).
Get Certified
Connect with accredited certification bodies for this standard
BSI Group
BSI (British Standards Institution) is the business standards company that helps organizations make excellence a habit.
IMQ S.p.A. (Certification)
Italian electrical product certification.
SLG Prüf- und Zertifizierungs GmbH
German testing and certification body.
Sponsored listings
Frequently Asked Questions
SIST EN IEC 62351-8:2026 is a standard published by the Slovenian Institute for Standardization (SIST). Its full title is "Power systems management and associated information exchange - Data and communications security - Part 8: Role-based access control for power system management (IEC 62351-8:2026)". This standard covers: The scope of this part of IEC 62351 is to facilitate role-based access control (RBAC) for power system management. RBAC assigns human users, automated systems, and software applications (collectively called "subjects" in this document) to specified "roles", and restricts their access to only those resources, which the security policies identify as necessary for their roles. As electric power systems become more automated and cyber security concerns become more prominent, it is becoming increasingly critical to ensure that access to data (read, write, control, etc.) is restricted. As in many aspects of security, RBAC is not just a technology; it is a way of running a business. RBAC is not a new concept; in fact, it is used by many operating systems to control access to system resources. Specifically, RBAC provides an alternative to the all-ornothing super-user model in which all subjects have access to all data, including control commands. RBAC is a primary method to meet the security principle of least privilege, which states that no subject should be authorized more permissions than necessary for performing that subject’s task. With RBAC, authorization is separated from authentication. RBAC enables an organization to subdivide super-user capabilities and package them into special user accounts' termed roles for assignment to specific individuals according to their associated duties. This subdivision enables security policies to determine who or what systems are permitted access to which data in other systems. RBAC thus provides a means of reallocating system controls as defined by the organization policy. In particular, RBAC can protect sensitive system operations from inadvertent (or deliberate) actions by unauthorized users. Clearly RBAC is not confined to human users though; it applies equally well to automated systems and software applications, i.e., software parts operating independent of user interactions. The following interactions are in scope: – local (direct wired) access to the object by a human user, a local and automated computer agent, or a built-in human machine interface (HMI) or panel; – remote (via dial-up or wireless media) access to the object by a human user; – remote (via dial-up or wireless media) access to the object by a remote automated computer agent, e.g., another object at another substation, a distributed energy resource at an enduser’s facility, or a control centre application. While this document defines a set of mandatory roles to be supported, the exchange format for defined specific or custom roles is also in scope of this document. This is achieved by defining two different encoding approaches to handle the definition of custom roles, either based on specific permissions or based on constraints to existing permissions. The definition on handling custom based roles was started in IEC 62351-90-1 and taken over into the IEC 62351-8:2020. Moreover, additionally to the definition of custom roles based on associated permissions, this document also includes options how to assign permissions to objects in a general way. Referencing documents will provide a mapping to a concrete data model to ensure an interoperability for standard roles used in different data models as well as for custom defined roles. Referencing documents might be standards such as IEC PAS 61850-90-19 or IEC 60870-5-7:2025 or also definitions by an operator. Out of scope for this document are all topics which are not directly related to the definition of roles and access tokens for local and remote access, especially administrative or organizational tasks, such as: – definition of usernames and password definitions/policies; – management of keys and/or key exchange; – engineering process of roles; – assignment of roles; – selection of trusted certification authorities issuing credentials (access tokens); – defining the tasks of a security officer; – integrating local policies in RBAC. NOTE Specifically, the manage
The scope of this part of IEC 62351 is to facilitate role-based access control (RBAC) for power system management. RBAC assigns human users, automated systems, and software applications (collectively called "subjects" in this document) to specified "roles", and restricts their access to only those resources, which the security policies identify as necessary for their roles. As electric power systems become more automated and cyber security concerns become more prominent, it is becoming increasingly critical to ensure that access to data (read, write, control, etc.) is restricted. As in many aspects of security, RBAC is not just a technology; it is a way of running a business. RBAC is not a new concept; in fact, it is used by many operating systems to control access to system resources. Specifically, RBAC provides an alternative to the all-ornothing super-user model in which all subjects have access to all data, including control commands. RBAC is a primary method to meet the security principle of least privilege, which states that no subject should be authorized more permissions than necessary for performing that subject’s task. With RBAC, authorization is separated from authentication. RBAC enables an organization to subdivide super-user capabilities and package them into special user accounts' termed roles for assignment to specific individuals according to their associated duties. This subdivision enables security policies to determine who or what systems are permitted access to which data in other systems. RBAC thus provides a means of reallocating system controls as defined by the organization policy. In particular, RBAC can protect sensitive system operations from inadvertent (or deliberate) actions by unauthorized users. Clearly RBAC is not confined to human users though; it applies equally well to automated systems and software applications, i.e., software parts operating independent of user interactions. The following interactions are in scope: – local (direct wired) access to the object by a human user, a local and automated computer agent, or a built-in human machine interface (HMI) or panel; – remote (via dial-up or wireless media) access to the object by a human user; – remote (via dial-up or wireless media) access to the object by a remote automated computer agent, e.g., another object at another substation, a distributed energy resource at an enduser’s facility, or a control centre application. While this document defines a set of mandatory roles to be supported, the exchange format for defined specific or custom roles is also in scope of this document. This is achieved by defining two different encoding approaches to handle the definition of custom roles, either based on specific permissions or based on constraints to existing permissions. The definition on handling custom based roles was started in IEC 62351-90-1 and taken over into the IEC 62351-8:2020. Moreover, additionally to the definition of custom roles based on associated permissions, this document also includes options how to assign permissions to objects in a general way. Referencing documents will provide a mapping to a concrete data model to ensure an interoperability for standard roles used in different data models as well as for custom defined roles. Referencing documents might be standards such as IEC PAS 61850-90-19 or IEC 60870-5-7:2025 or also definitions by an operator. Out of scope for this document are all topics which are not directly related to the definition of roles and access tokens for local and remote access, especially administrative or organizational tasks, such as: – definition of usernames and password definitions/policies; – management of keys and/or key exchange; – engineering process of roles; – assignment of roles; – selection of trusted certification authorities issuing credentials (access tokens); – defining the tasks of a security officer; – integrating local policies in RBAC. NOTE Specifically, the manage
SIST EN IEC 62351-8:2026 is classified under the following ICS (International Classification for Standards) categories: 29.240.30 - Control equipment for electric power systems; 33.200 - Telecontrol. Telemetering; 35.240.50 - IT applications in industry. The ICS classification helps identify the subject area and facilitates finding related standards.
SIST EN IEC 62351-8:2026 has the following relationships with other standards: It is inter standard links to SIST EN IEC 62351-8:2020, SIST EN IEC 62351-3:2023, SIST EN IEC 62351-5:2023, SIST EN IEC 62351-7:2026, SIST-TP CLC IEC/TR 62541-2:2021. Understanding these relationships helps ensure you are using the most current and applicable version of the standard.
SIST EN IEC 62351-8:2026 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
SLOVENSKI STANDARD
01-december-2026
Nadomešča:
SIST EN IEC 62351-8:2020
Upravljanje elektroenergetskega sistema in pripadajoča izmenjava informacij -
Varnost podatkov in komunikacij - 8. del: Kontrola dostopa do
elektroenergetskega sistema na podlagi vlog (IEC 62351-8:2026)
Power systems management and associated information exchange - Data and
communications security - Part 8: Role-based access control for power system
management (IEC 62351-8:2026)
Energiemanagementsysteme und zugehöriger Datenaustausch – IT-Sicherheit für Daten
und Kommunikation – Teil 8: Rollenbasierte Zugriffskontrolle für
Energiemanagementsysteme (IEC 62351-8:2026)
Gestion des systèmes de puissance et échanges d'informations associés - Sécurité des
communications et des données - Partie 8: Contrôle d'accès basé sur les rôles pour la
gestion de systèmes de puissance (IEC 62351-8:2026)
Ta slovenski standard je istoveten z: EN IEC 62351-8:2026
ICS:
29.240.30 Krmilna oprema za Control equipment for electric
elektroenergetske sisteme power systems
35.240.50 Uporabniške rešitve IT v IT applications in industry
industriji
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EUROPEAN STANDARD EN IEC 62351-8
NORME EUROPÉENNE
EUROPÄISCHE NORM October 2026
ICS 33.200 Supersedes EN IEC 62351-8:2020
English Version
Power systems management and associated information
exchange - Data and communications security - Part 8: Role-
based access control for power system management
(IEC 62351-8:2026)
Gestion des systèmes de puissance et échanges Energiemanagementsysteme und zugehöriger
d'informations associés - Sécurité des communications et Datenaustausch - IT-Sicherheit für Daten und
des données - Partie 8: Contrôle d'accès basé sur les rôles Kommunikation - Teil 8: Rollenbasierte Zugriffskontrolle für
pour la gestion de systèmes de puissance Energiemanagementsysteme
(IEC 62351-8:2026) (IEC 62351-8:2026)
This European Standard was approved by CENELEC on 2026-08-26. CENELEC members are bound to comply with the CEN/CENELEC
Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.
Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC
Management Centre or to any CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CENELEC member into its own language and notified to the CEN-CENELEC Management Centre has the
same status as the official versions.
CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic,
Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the
Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Türkiye and the United Kingdom.
European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2026 CENELEC All rights of exploitation in any form and by any means reserved worldwide for CENELEC Members.
Ref. No. EN IEC 62351-8:2026 E
European foreword
The text of document 57/2882/FDIS, future edition 2 of IEC 62351-8, prepared by TC 57 "Power
systems management and associated information exchange" was submitted to the IEC-CENELEC
parallel vote and approved by CENELEC as EN IEC 62351-8:2026.
The following dates are fixed:
• latest date by which the document has to be implemented at national (dop) 2027-10-31
level by publication of an identical national standard or by endorsement
• latest date by which the national standards conflicting with the (dow) 2029-10-31
document have to be withdrawn
This document supersedes EN IEC 62351-8:2020 and all of its amendments and corrigenda (if any).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CENELEC shall not be held responsible for identifying any or all such patent rights.
Any feedback and questions on this document should be directed to the users’ national committee. A
complete listing of these bodies can be found on the CENELEC website.
Endorsement notice
The text of the International Standard IEC 62351-8:2026 was approved by CENELEC as a European
Standard without any modification.
In the official version, for Bibliography, the following notes have to be added for the standard indicated:
IEC 60870-5-104 NOTE Approved as EN 60870-5-104
IEC 61784 (series) NOTE Approved as EN IEC 61784 (series)
IEC 61850-7-2 NOTE Approved as EN 61850-7-2
IEC 61850-8-1 NOTE Approved as EN 61850-8-1
IEC 61968 (series) NOTE Approved as EN IEC 61968 (series)
IEC 61970 (series) NOTE Approved as EN IEC 61970 (series)
IEC 62351-4 NOTE Approved as EN IEC 62351-4
IEC 62351-5 NOTE Approved as EN IEC 62351-5
IEC 62351-7 NOTE Approved as EN IEC 62351-7
IEC 62351-9 NOTE Approved as EN IEC 62351-9
Annex ZA
(normative)
Normative references to international publications
with their corresponding European publications
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments)
applies.
NOTE 1 Where an International Publication has been modified by common modifications, indicated by (mod),
the relevant EN/HD applies.
NOTE 2 Up-to-date information on the latest versions of the European Standards listed in this annex is available
here: www.cencenelec.eu.
Publication Year Title EN/HD Year
IEC 62351-3 2023 Power systems management and associated EN IEC 62351-3 2023
information exchange - Data and communications
security - Part 3: Communication network and system
security - Profiles including TCP/IP
IEC/TS 62351-2 - Power systems management and associated - -
information exchange - Data and communications
security - Part 2: Glossary of terms
ISO/IEC 9594-8 2020 Information technology_- Open systems - -
interconnection_- Part_8: The Directory: Public-key
and attribute certificate frameworks
IANA Private Enterprise Numbers Registry:
https://www.iana.org/assignments/enterprisenumbers/
RFC 2865 Remote Authentication Dial In User Service
(RADIUS)
IETF RFC 4513 Lightweight Directory Access Protocol (LDAP):
Authentication Methods and Security Mechanisms
IETF RFC 6614 Transport Layer Security (TLS) Encryption for
RADIUS
IETF RFC 6749 The OAuth 2.0 Authorization Framework
IETF RFC 7519 JSON Web Token (JWT)
XACML-RBAC, XACML v3.0 Core and Hierarchical
Role Based Access Control (RBAC) Profile Version
1.0, October 2014. Available at: http://docs.oasis-
open.org/xacml/3.0/xacml-3.0-rbac-v1-spec-en.html
IEC 62351-8 ®
Edition 2.0 2026-07
INTERNATIONAL
STANDARD
Power systems management and associated information exchange - Data and
communications security -
Part 8: Role-based access control for power system management
ICS 33.200 ISBN 978-2-8327-1354-9
IEC 62351-8:2026-07(en)
IEC 62351-8:2026 © IEC 2026
CONTENTS
FOREWORD . 6
INTRODUCTION . 8
1 Scope . 10
1.1 General . 10
1.2 Published versions of the standard and related namespace names . 12
1.3 Identification of the code component . 12
1.4 Code Component distribution . 12
2 Normative references . 13
3 Terms and definitions . 13
4 Abbreviated terms . 16
5 RBAC – Process model and concepts . 17
5.1 General . 17
5.2 Overview of RBAC process model . 18
5.3 Generic RBAC concepts . 18
5.4 Separation of subjects, roles, and permissions . 20
5.4.1 RBAC model . 20
5.4.2 Subject assignment (subject-to-role mapping) . 23
5.4.3 Role-to-permission mapping . 23
5.4.4 Permission definition . 23
5.4.5 operationSet assignment (mapping of roles-permission-combinations
to objects) . 23
5.5 Criteria for defining roles . 24
5.5.1 Policies. 24
5.5.2 Subjects, roles, and permissions . 24
5.5.3 Introducing roles reduces complexity . 24
6 Definition of roles and permission assignment . 25
6.1 General . 25
6.2 Pre-defined roles . 25
6.3 Role-to-permission assignment . 26
6.3.1 General . 26
6.3.2 Number of supported permissions by a role . 27
6.3.3 Number of supported roles . 27
6.3.4 Assigning permissions to roles . 27
6.4 Definition of pre-defined and custom based roles . 29
6.4.1 General . 29
6.4.2 Encoding of roles based on specific permissions . 30
6.4.3 Encoding of roles using constraints on existing permissions . 36
6.5 Consideration of operational states . 39
6.6 Security event consideration for the engineering of roles and permissions . 40
7 Simplified role assignment . 42
7.1 General . 42
7.2 Application of roles associated with multiple role definitions (generic roles) . 42
7.3 Illustrative examples . 43
7.3.1 General . 43
7.3.2 Application of pre-defined role "VIEWER" on Device-X for all role
definitions . 44
IEC 62351-8:2026 © IEC 2026
7.3.3 Application of custom role "OPERATOR-DFR" on Device-Y for all
supported role definitions . 45
7.3.4 Application of pre-defined role "SECADM" for selected role definitions . 46
8 Definition of access tokens . 48
8.1 General . 48
8.2 Supported profiles . 48
8.3 Role-based access control related Object Identifiers . 48
8.4 General structure of the access tokens . 49
8.4.1 Profile specific mandatory components in the access tokens . 49
8.4.2 Optional access token components . 50
8.4.3 Definition of specific fields . 50
8.5 Access token profiles . 55
8.5.1 General . 55
8.5.2 Profile A: X.509 Public-key certificate . 55
8.5.3 Profile B: X.509 Attribute certificate . 59
8.5.4 Profile C: JSON Web Token – JWT . 63
8.5.5 Profile D: RADIUS provided access token information . 66
8.5.6 Profile E: LDAP provided RBAC information . 69
9 Verification of access tokens . 75
9.1 General . 75
9.2 Multiple access token existence . 75
9.3 Subject authentication. 75
9.4 Access token availability . 76
9.5 Validity period . 76
9.6 Access token integrity . 76
9.7 Issuer . 76
9.8 Role ID . 77
9.9 Revision . 77
9.10 Area of responsibility . 77
9.11 Role definition . 77
9.12 Revocation state . 77
9.13 Operation . 78
9.14 Sequence number . 78
9.15 Revocation methods . 78
9.15.1 General . 78
9.15.2 Supported methods . 79
10 RBAC access token distribution models . 79
10.1 General . 79
10.2 PUSH model . 80
10.3 PULL model . 81
11 Interaction with backend services for RBAC access token distribution . 83
11.1 General . 83
11.2 Using directory services with LDAP . 83
11.2.1 General . 83
11.2.2 Secure communication . 83
11.2.3 LDAP Directory organization . 85
11.3 Using OAuth to provide JWT token . 85
11.3.1 General . 85
11.3.2 Secure communication . 87
IEC 62351-8:2026 © IEC 2026
11.4 Using AAA services with RADIUS . 87
11.4.1 General . 87
11.4.2 Secure communication . 87
11.4.3 Peer configuration . 88
11.4.4 RADIUS server organization . 88
11.5 Comparison of backend interaction depending on RBAC profile . 89
12 Access token transport . 90
12.1 General . 90
12.2 Transport in Ethernet-based protocols . 90
12.3 Usage in non-Ethernet based protocols. 91
12.4 Usage in the context of the application protocol . 91
13 Conformity . 91
13.1 General . 91
13.2 Notation . 91
13.3 Mapping to existing authorization mechanisms . 91
13.4 Conformance to access token format . 92
13.5 Conformance to access token content . 92
13.6 Access token distribution . 94
13.7 Role information . 94
13.8 Role information exchange . 95
13.9 Security events . 95
Annex A (informative) Security Events . 96
A.1 General . 96
A.2 Mapping of general access token security events . 96
A.3 Mapping of access token security events specific for profile A, B, and C . 97
A.4 Mapping of security events related to backend service interaction . 97
A.5 Mapping of security events related to RBAC engineering and maintenance . 97
Annex B (informative) Role definition from previous revisions/editions of IEC 62351-8 . 99
B.1 General . 99
B.2 Role definition from IEC TS 62351-8:2011 . 99
B.3 Role definition from IEC 62351-8:2020 . 100
Annex C (informative) Informative example for specific role definition . 102
C.1 General . 102
C.2 Use case description . 102
C.3 XACML definition example . 102
C.4 Role description . 103
C.5 Permission group description . 104
C.6 Permission description . 105
C.7 Request syntax for PDP . 109
Annex D (informative) Examples for LDAP interaction . 110
D.1 General . 110
D.2 Import of new LDAP schema for "IEC6351-RoleStructure" . 110
D.3 Import of new LDAP schema for "roles" . 110
Annex E (informative) General application of RBAC access token . 111
E.1 General . 111
E.2 Session-based approach . 111
E.3 Message-based approach . 113
Bibliography . 114
IEC 62351-8:2026 © IEC 2026
Figure 1 – Generic framework for access control . 19
Figure 2 – Diagram of RBAC with static and dynamic separation of duty (enhanced
version of ANSI INCITS 359-2004). 20
Figure 3 – Overview on the concepts of subjects, roles, permissions, and
operationSets . 22
Figure 4 – Referencing Documents . 26
Figure 5 – Relation of Roles and Permissions . 27
Figure 6 – Object binding using distinct role and permission files . 31
Figure 7 – XACML structure . 32
Figure 8 – Object binding using operationSets and O2OS files . 36
Figure 9 – operationSets definition on the example of IEC 61850 . 38
Figure 10 – operationSets assignment to objects utilizing O2OS files . 39
Figure 11 – Generic roles – Interrelation of referencing documents with IEC 62351-8
with examples for role identification triplets . 43
Figure 12 – Example LDAP tree . 72
Figure 13 – LDAP object class roles . 72
Figure 14 – Assignment of LDAP groups to IED known roles . 73
Figure 15 – LDAP memberOf assignment . 74
Figure 16 – Schematic view of authorization based on RBAC PUSH model . 81
Figure 17 – Schematic view of authorization based on RBAC PULL model. 82
Figure 18 – RBAC model using OAuth workflow applying JWT . 86
Figure E.1 – Session based RBAC approach (simplified IEC 62351-4 end-to-end
security). 113
Table 1 – Published versions and related namespace names . 12
Table 2 – Attributes of the IEC 62351-8 code component . 12
Table 3 – Pre-defined roles . 25
Table 4 – Template for role-to-permission mapping. 28
Table 5 – Template for permission definition . 29
Table 6 – Evaluation Context . 36
Table 7 – Possible range of permissions per role . 38
Table 8 – Security Event Mapping to IEC 62351-14 . 41
Table 9 – Access token: meta information . 49
Table 10 – Access token: user role information . 49
Table 11 – Optional access token components . 50
Table 12 – AoR fields and format . 54
Table 13 – Informative example: AoR handling on IED . 55
Table 14 – Mapping between ID and attribute certificate . 63
Table 15 – RBAC profile comparison . 89
Table 16 – Conformance to access token format . 92
Table 17 – Access token: meta information . 93
Table 18 – Access token: user role information . 93
Table 19 – Optional access token components . 93
Table 20 – Generic Role support. 94
IEC 62351-8:2026 © IEC 2026
Table 21 – Conformance to access token distribution . 94
Table 22 – Support of pre-defined roles . 94
Table A.1 – General access token security events mapped to IEC 62351-14 . 96
Table A.2 – Profile A, B, and C specific access token security events mapped to
IEC 62351-14 . 97
Table A.3 – Security event logs related to backend service interaction . 97
Table A.4 – Security event logs related to RBAC engineering and maintenance . 98
Table B.1 – List of pre-defined role-to-permission assignment (2011 version) . 99
Table B.2 – List of pre-defined role-to-permission assignment (2021 version) . 100
Table C.1 – Permission assignment . 102
IEC 62351-8:2026 © IEC 2026
INTERNATIONAL ELECTROTECHNICAL COMMISSION
____________
Power systems management and associated information exchange -
Data and communications security -
Part 8: Role-based access control for power system management
FOREWORD
1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising
all national electrotechnical committees (IEC National Committees). The object of IEC is to promote international
co-operation on all questions concerning standardization in the electrical and electronic fields. To this end and
in addition to other activities, IEC publishes International Standards, Technical Specifications, Technical Reports,
Publicly Available Specifications (PAS) and Guides (hereafter referred to as "IEC Publication(s)"). Their
preparation is entrusted to technical committees; any IEC National Committee interested in the subject dealt with
may participate in this preparatory work. International, governmental and non-governmental organizations liaising
with the IEC also participate in this preparation. IEC collaborates closely with the International Organization for
Standardization (ISO) in accordance with conditions determined by agreement between the two organizations.
2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international
consensus of opinion on the relevant subjects since each technical committee has representation from all
interested IEC National Committees.
3) IEC Publications have the form of recommendations for international use and are accepted by IEC National
Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC
Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any
misinterpretation by any end user.
4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications
transparently to the maximum extent possible in their national and regional publications. Any divergence between
any IEC Publication and the corresponding national or regional publication shall be clearly indicated in the latter.
5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity
assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any
services carried out by independent certification bodies.
6) All users should ensure that they have the latest edition of this publication.
7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and
members of its technical committees and IEC National Committees for any personal injury, property damage or
other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and
expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC
Publications.
8) Attention is drawn to the Normative references cited in this publication. Use of the referenced publications is
indispensable for the correct application of this publication.
9) IEC draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). IEC takes no position concerning the evidence, validity or applicability of any claimed patent rights in
respect thereof. As of the date of publication of this document, IEC had received notice of (a) patent(s), which
may be required to implement this document. However, implementers are cautioned that this may not represent
the latest information, which may be obtained from the patent database available at https://patents.iec.ch. IEC
shall not be held responsible for identifying any or all such patent rights.
IEC 62351-8 has been prepared by IEC technical committee 57: Power systems management
and associated information exchange. It is an International Standard.
This second edition cancels and replaces the first edition published in 2020. This edition
constitutes a technical revision.
This edition includes the following significant technical changes with respect to the previous
edition:
a) Removal of mapping of roles to permission to objects based on the target data model and/or
protocol to allow for other mappings than IEC 61850. Mapping is delegated to separate
documents;
b) Specification of handling of a combination of roles and permissions as operationSet to allow
more fine-grained assignments to objects;
IEC 62351-8:2026 © IEC 2026
c) Specification of a simplified roles assignment to more efficiently handle situations in which
roles are used relating to different data models, including examples;
d) Inclusion of new profile to allow for fetching RBAC information from LDAP repositories;
e) Definition of specific security events throughout the document;
f) Alignment of terminology and enhancement with examples.
The text of this International Standard is based on the following documents:
Draft Report on voting
57/2882/FDIS 57/2921/RVD
Full information on the voting for its approval can be found in the report on voting indicated in
the above table.
The language used for the development of this International Standard is English.
This document was drafted in accordance with ISO/IEC Directives, Part 2, and developed in
accordance with ISO/IEC Directives, Part 1 and ISO/IEC Directives, IEC Supplement, available
at www.iec.ch/members_experts/refdocs. The main document types developed by IEC are
described in greater detail at www.iec.ch/publications.
Recipients of this document are invited to submit, with their comments, notification of any
relevant patent rights of which they are aware and to provide supporting documentation.
This document includes code components, i.e., components that are intended to be directly
processed by a computer. Such content is any text found between the markers
BEGINS> and , or otherwise is clearly labelled in this document as a code
component.
The purchase of this document carries a copyright license for the purchaser to sell software
containing code components from this document directly to end users and to end users via
distributors, subject to IEC software licensing conditions, which can be found at:
http://www.iec.ch/CCv1.
In the case of any discrepancy between the document and the code components, the code
components take precedence.
In this document, the following print types are used:
Encoding in ASN.1 or XACML: couriernew
A list of all the parts in the IEC 62351 series, published under the general title Power systems
management and associated information exchange, can be found on the IEC website.
The committee has decided that the contents of this document will remain unchanged until the
stability date indicated on the IEC website under webstore.iec.ch in the data related to the
specific document. At this date, the document will be
– reconfirmed,
– withdrawn, or
– revised.
IEC 62351-8:2026 © IEC 2026
INTRODUCTION
This document provides a standard for access control in power systems. The power system
environment supported by this document is enterprise-wide and extends beyond traditional
borders to include external providers, suppliers, and other energy partners. Driving factors are
the liberalization of the energy sector to include many more stakeholders, the increasingly
decentralized generation of energy, and the need to control access to sensitive data of
resources and stakeholders.
The power system sector is continually improving the delivery of energy by leveraging technical
advances in computer-based applications. Utility operators, energy brokers, and end-users are
increasingly accessing multiple applications to deliver, transmit and consume energy in a
personalized way. These disparate applications are naturally connected to a common network
infrastructure that typically supports protection equipment, substation automation protocols,
inter-station protocols, remote access, and business-to-business services. Consequently,
secure access to these distributed and often loosely coupled applications is even more
important than access to an application running on a stand-alone device.
Secure access to computer-based applications involves authentication of the user to the
application. After authentication, the types of interactions that the user can perform with the
application is then determined. The use of local mechanisms for authorization creates a
patchwork of approaches which are difficult to uniformly administer across the breadth of a
power system enterprise. Each application decides with its own logic the authorization process.
However, if applications can use a network to help manage access, a database can serve as a
trusted source of user’s group or role affiliation. Thus, the access to a shared user base can be
controlled centrally. Each application can then examine the permissions listed for a subject and
corresponding role and determine their level of authorization.
This document defines role-based access control (RBAC) for enterprise-wide use in power
systems. It supports a distributed or service-oriented architecture where security is a distributed
service and applications are consumers of distributed services.
In this document, the role of a user is contained in a data structure called "access token" for
that user and is provided to the accessed resource. Access tokens are created and administered
by a (possibly federated) identity management. All access tokens have a lifetime and are
subject to expiration. Prior to verification of the access token itself, the user who tries to get
access is authenticated by the resource. The resource has a trust relation to the access token
management. The access token can be provided as self-contained object by the user or a
central repository or as data structure by a central repository. Specifically, the self-contained
access tokens enable local verification of the access token’s validity at remote sites without the
need to access a centralized repository. To ensure availability of information in the repository,
redundancy may be considered. Note that redundancy concepts are out of scope for this
document.
Different access token formats are supported as five defined profiles. These access tokens can
be bound to a specific transport or to a specific application in conjunction with different types
of repositories, holding the access tokens. Common to all profiles is the information contained,
to allow a migration from one profile to another.
As RBAC is being adopted for several protocols and data models this document has been
changed accordingly. In its current version it focuses on the general definition of RBAC,
mandatory to be supported roles and options for assigning roles to permissions. The actual
assignment of roles to permissions, and consequently the binding of RBAC related information
to objects, is addressed in the referencing documents, which directly relate to the target data
model. The existing definition of the IEC 61850 specific roles and permissions has been moved
to IEC 61850-90-19. Likewise for IEC 60807-5-101/-104 the specifics are handled in
IEC 60870-5-7:2025. Moreover, IEEE 1815 specifics will be handled in the context of
DNP3SAv6. This document provides information about the role to permission assignment of
previous versions of this document in Annex B.
IEC 62351-8:2026 © IEC 2026
This standard is maintained. Technical issues identified after publication will be handled via the
TISSUE database to keep correctness and interoperability. Approved technical issues will be
published as INF document and might be further handled according to IEC directives.
IEC 62351-8:2026 © IEC 2026
1 Scope
1.1 General
The scope of this part of IEC 62351 is to facilitate role-based access control (RBAC) for power
system management. RBAC assigns human users, automated systems, and software
applications (collectively called "subjects" in this document) to specified "roles", and restricts
their access to only those resources, which the security policies identify as necessary for their
roles.
As electric power systems become more automated and cyber security concerns become more
prominent, it is becoming increasingly critical to ensure that access to data (read, write, control,
etc.) is restricted. As in many aspects of security, RBAC is not just a technology; it is a way of
running a business. RBAC is not a new concept; in fact, it is used by many operating systems
to control access to system resources. Specifically, RBAC provides an alternative to the all-or-
nothing super-user model in which all subjects have access to all data, including control
commands.
RBAC is a primary method to meet the se
...