IEC TS 60870-5-7:2025

Overview

IEC TS 60870-5-7:2025 is a Technical Specification from the IEC that provides security extensions to the telecontrol protocols IEC 60870-5-101 and IEC 60870-5-104 by applying the mechanisms defined in IEC 62351. Edition 2.0 (2025) replaces the 2013 edition and specifies message and data formats to implement IEC 62351-5:2023 and aligns with IEC 62351-3:2023. The main purpose is to enable a receiver of any IEC 60870-5-101/104 Application Protocol Data Unit (APDU) to verify that the APDU was transmitted by an authorized user and was not modified in transit.

Key topics and requirements

• Message and data formats: Defines ASDU formats and extensions required to carry integrity/MAC and authenticated/encrypted payloads for secure APDUs.
• Profiles: Defines specific application-layer (A-Profile) and transport-layer (T-Profile) security profiles for 101 and 104 implementations.
• Authentication and integrity: Support for MAC/AEAD protection to verify APDU origin and detect tampering.
• Key and session management: Session keys, update key procedures, session key change messages and broadcast session key distribution mechanisms (including multicast security for unbalanced IEC 60870-5-101).
• Session control: Introduction of a Session Initiation Request to handle re-established connections and the associated state machines and message sequences (implemented per IEC 62351-5:2023).
• Coexistence: Mechanisms for interoperating with non-secure implementations and configurable parameters for gradual deployment.
• Role-Based Access Control (RBAC): Incorporates IEC 62351-8 RBAC approach and role-to-permission mappings defined in IEC 62351-5:2023.
• Conformance: Protocol Implementation Conformance Statement (PICS) items including selectable algorithms, MAC/encryption/key-wrap choices and configurable statistic thresholds.

Applications and practical value

• Secures SCADA/telecontrol communications in electric power systems by providing integrity and authentication for telemetry and control APDUs.
• Enables vendors and integrators to implement interoperable security extensions for remote terminal units (RTUs), master stations, protocols over serial links and TCP/IP.
• Supports multicast/broadcast scenarios for telemetry distribution in unbalanced 101 networks.
• Helps utilities and operators meet cybersecurity requirements for power system management and reduce risk from message spoofing or manipulation.

Who should use this standard

• Power utilities, grid operators and system architects planning secure telecontrol deployments
• SCADA/RTU vendors and firmware developers implementing IEC 60870-5-101/104
• Security architects, network engineers and integrators implementing IEC 62351-based protections
• Compliance teams assessing protocol-level cybersecurity for power systems

Related standards

• IEC 62351-5:2023 (security for control system application layer)
• IEC 62351-3:2023 (transport/security profiles)
• IEC 62351-8 (RBAC)
• IEC 60870-5-104:2016 (companion protocol)
• Note: IEC 60870-5-102/103 are out of scope; IEC 61850 + IEC 62351 recommended for 103 users

Keywords: IEC TS 60870-5-7:2025, IEC 60870-5-101, IEC 60870-5-104, IEC 62351, telecontrol security, SCADA cybersecurity, RBAC, multicast security, APDU verification.