SCADA Standards and Guidelines: Protocols, Security, Alarms, HMI and Sector Rules
On this page
SCADA spans protocols, networks, software, control rooms and regulated infrastructure, so the relevant standards come from several bodies: IEC and IEEE for protocols, ISA and IEC for security, alarms and HMI, and sector organisations and regulators for power, pipelines and water. This page maps them to the tasks where they apply. Always check the current edition and the requirements of your jurisdiction.
Communication protocols
| Standard | Scope | Typical use |
|---|---|---|
| DNP3 (IEEE 1815) | Telemetry protocol with events, time stamps and Secure Authentication | North American utilities, water, oil and gas |
| IEC 60870-5-101 / -104 | Telecontrol over serial links / TCP/IP | European and international utilities |
| IEC 61850 | Substation automation: data models, GOOSE, sampled values | Substations and power plants |
| Modbus | Simple register-based protocol (RTU and TCP) | Widespread for devices and PLCs |
| OPC UA (IEC 62541) | Secure, information-model-based integration | SCADA to MES, historians, other systems |
| MQTT (OASIS) with Sparkplug | Publish/subscribe for IIoT and edge devices | Report-by-exception telemetry, edge integration |
See SCADA Telemetry Communications, Modbus, OPC UA and MQTT and Sparkplug B.
Cybersecurity
| Standard or rule | Scope |
|---|---|
| ISA/IEC 62443 | Industrial automation security: risk assessment, zones and conduits, security levels, requirements for asset owners, integrators and product suppliers |
| IEC 62351 | Security for power system protocols (including IEC 60870-5, IEC 61850 and DNP3) |
| NIST SP 800-82 | US guide to operational technology security |
| NERC CIP | Mandatory reliability standards for the bulk electric system in North America |
| API Std 1164 | Cybersecurity for pipeline control systems |
| EU NIS2 Directive | Cybersecurity obligations for essential and important entities in the EU, including energy, water and transport, implemented in national law |
See ISA/IEC 62443.
Alarms, displays and control rooms
| Standard | Scope |
|---|---|
| ISA-18.2 / IEC 62682 | Alarm management lifecycle, rationalisation and performance |
| ISA-101 | HMI philosophy, style guide and display hierarchy |
| ISO 11064 | Ergonomic design of control centres |
| API RP 1165 | Pipeline SCADA displays |
| API RP 1167 | Pipeline SCADA alarm management |
| API RP 1168 | Pipeline control room management |
See SCADA Alarm Management and SCADA HMI Display Design.
Sector requirements
| Sector | Examples of requirements |
|---|---|
| Electric power | NERC CIP (North America), IEC 61850 and IEC 60870-5 in substations, national grid codes |
| Pipelines (US) | Control room management rules in 49 CFR 192.631 (gas) and 195.446 (hazardous liquids), which reference API RP 1165 and API RP 1168; API Std 1164 for security |
| Water and wastewater | National regulations and guidance on water system cybersecurity and resilience; regulatory reporting requirements |
| Regulated manufacturing | Data integrity and validation rules (21 CFR Part 11, EU GMP Annex 11) where SCADA records are GMP records; see Computerised System Validation |
| General | IEEE C37.1 (definitions and specification of SCADA and automation systems in power), IEC 61131-3 for controller programming |
Standards across a SCADA project
| Phase | Standards typically applied |
|---|---|
| Requirements | Sector rules, IEC 62443 risk assessment, protocol choices |
| Design | Protocol standards, IEC 62443 zones and conduits, ISA-101 style guide, ISA-18.2 philosophy, ISO 11064 |
| Build and test | Protocol conformance, IEC 62443 component requirements, FAT and SAT |
| Operation | Alarm performance (ISA-18.2), security maintenance (IEC 62443-2-1), control room management rules |
Applying standards in practice
- Name standards and editions in specifications so they can be tested at FAT and SAT.
- Prefer secure protocol variants (DNP3 Secure Authentication, OPC UA with security, IEC 62351 profiles) where devices support them, and compensate with VPNs or network controls where they do not.
- Check protocol conformance of devices (for example DNP3 subset levels and IEC 61850 conformance testing).
- Turn standards into site documents: alarm philosophy, HMI style guide, security programme.
- Track regulatory changes: security regulations for critical infrastructure are changing quickly.
Frequently asked questions
Which standards apply to SCADA security?
ISA/IEC 62443 is the main international framework. Sector rules add requirements: NERC CIP for North American power, API 1164 for pipelines, IEC 62351 for power system protocols, and national laws such as those implementing the EU NIS2 Directive.
What is the difference between DNP3 and IEC 60870-5-104?
Both are telemetry protocols with events and time stamps. DNP3 (IEEE 1815) is common in North America and in water and oil and gas; IEC 60870-5-104 is common in European and international power utilities.
Are there specific standards for pipeline SCADA?
Yes. API RP 1165 covers displays, API RP 1167 alarm management, API RP 1168 control room management and API Std 1164 cybersecurity. In the US, 49 CFR control room management rules reference several of them.
Key takeaways
- SCADA standards cover protocols, security, alarms and displays, and sector rules.
- Choose protocols by sector and device support, and prefer their secure variants.
- ISA/IEC 62443 is the security framework; sector rules add mandatory requirements.
- Specify standards and editions, and implement them through site documents.
Related tutorials
Before you apply this in a plant: this article is for education. Always check the current edition of the relevant standards, the manufacturer's documentation for your exact product and version, and your site's procedures. Safety-related work needs qualified personnel. See our editorial policy.