IEC TS 63383:2022 PDF

Overview

IEC TS 63383:2022 provides guidance on cybersecurity aspects of devices used for power metering and monitoring, power quality monitoring, and data collection and analysis. It focuses on measuring devices (PMD per IEC 61557-12, PQI per IEC 62586-1) and data collection devices (per IEC 62974-1) intended for installation in restricted access areas. IEC TS 63383:2022 aims to raise manufacturer and stakeholder awareness of device-level cybersecurity (device hardening, resilience, risk mitigation) while excluding organisational cybersecurity policy and billing meters (IEC 62053-2x).

Key topics and technical requirements

The Technical Specification emphasises a risk-based approach and covers these core topics:

• Security objectives for device confidentiality, integrity and availability.
• Cybersecurity risk assessment methodology (generic approach, use-cases, metrics and prioritisation).
• Requirements for countermeasures (device hardening and mitigation strategies).
• Testing requirements for verifying security measures and device resilience.
• Lifecycle security management-design, manufacturing, commissioning, operation, maintenance, de‑commissioning and disposal.
• Instructions for use to support secure installation and operation.
• Informative annexes with generic risk assessments, device-feared events, attack vectors and example countermeasures for PMD, PQI, data gateways (DGW), energy data loggers (EDL) and energy servers (ESE).

Key concepts in the standard include attack vectors, device assets, and threat-driven prioritisation. The document aligns recommendations with system-level standards such as IEC 62443 and ISO/IEC 27001.

Applications and who should use it

IEC TS 63383:2022 is practical for stakeholders involved in the lifecycle of power-measurement and data-collection devices:

• Device manufacturers - to design and harden PMDs, PQIs, gateways and loggers against common vulnerabilities.
• System integrators and OEMs - for secure integration and commissioning of energy-monitoring systems.
• Facility managers and operators - to implement lifecycle security, maintenance and secure operational practices in restricted access areas.
• Test laboratories and cybersecurity assessors - to define test scopes and validation for device resilience.
• Product managers and compliance teams - to map device-level controls to organisational cybersecurity programs.

Related standards

• IEC 61557-12 (PMD definitions)
• IEC 62586-1 (PQI definitions)
• IEC 62974-1 (data collection devices)
• IEC 62443 (industrial automation and control system security)
• ISO/IEC 27001 (information security management)

IEC TS 63383:2022 is a targeted, risk-based reference for improving the cybersecurity posture of electrical measurement and data-collection devices used in energy systems.