A smart circuit breaker cybersecurity checklist should cover the entire connected system: the breaker interface, gateway, local network, application, remote service and people who can change settings or operate equipment. Start with an asset inventory, restrict access, separate monitoring from control and verify recovery after a communication or account failure. These controls must support the installation's electrical safety and operating procedures. No network setting alone establishes safe isolation or permission to reenergize a circuit. This guide provides procurement and handover questions for panel builders and facilities teams; it does not assert that a particular SUTON model has unconfirmed security features or certifications.
Identify the actual connected assets
Write down the exact device model, accessories, firmware, gateway, application and support service in the proposed arrangement. Identify which components store configuration, measurements, account details and switching records. A breaker without a direct internet interface can still be affected through a connected gateway. Conversely, a product described as smart may only provide measurements and have no remote operating function. Build the inventory from the supplied configuration rather than its marketing category.
Record the owner and support contact for every component. Include serial or asset identifiers, physical location and the version of the approved documentation. Keep credentials in the organization's approved secure system rather than in the shared equipment schedule. The inventory should let a future maintainer determine what is installed and who can authorize a change without revealing passwords or private access tokens.
Separate electrical functions from digital permissions
Identify what each connection can do. Reading a voltage value, acknowledging an alarm, changing a protection setting and closing a breaker have different consequences. Do not give all four permissions to every person who needs a dashboard. Request separate access roles where supported, and define suitable compensating restrictions where the device cannot provide the desired separation. Record any unresolved limitation before acceptance.
Local protection and remote supervision also require distinct review. Ask the supplier to describe behavior when communication, gateway power or a cloud service is unavailable. Do not assume either that a network outage disables protection or that every protective function remains independent of external services. Confirm the exact architecture. The smart circuit breaker guide provides the product context for defining those responsibilities.
Remove unnecessary access paths
List the services and connections required for normal operation, commissioning and support. Close or disable unused paths through approved configuration. Do not expose a management interface to the public internet simply to make a demonstration convenient. If remote support is essential, use the organization's controlled access arrangement and record the approved destination, users, duration and purpose. Review the gateway and support computer as well as the device itself.
CISA's guide to securing remote access software explains why legitimate remote support tools also need security controls. For a breaker project, ask the responsible network team to document the selected route and restrictions. A private address alone does not demonstrate that every upstream path is controlled or that an external support service has been adequately reviewed.
Establish account ownership before handover
The building owner should know which accounts remain active and how they can be revoked. Avoid a permanent installation that depends on an undocumented personal account belonging to a departing contractor. Change default credentials where applicable, use unique identities where supported and protect privileged access through the approved authentication arrangements. Confirm which functions support stronger authentication and where an external access gateway must enforce it.
Record how accounts are created, reviewed and removed. Temporary commissioning access should have an agreed end point. If the application uses a cloud tenant, identify its owner and the procedure for transferring or recovering administration. An installer saying that the password is available on request is not a substitute for a usable ownership and recovery process that the facilities team can execute.
Protect commands and configuration changes
Maintain a distinction between a user who requests an operation and a component that executes it. A BMS account may lack a close button while its gateway still permits unrestricted writes from another connection. Review all documented write paths and remove unnecessary command capability. Required controls should retain the approved local permissions, inhibition and feedback, independent of how convenient the application makes the request.
The remote trip and reclose guide explains why command acceptance and physical state are different evidence. A security review should ensure that delayed or replayed requests do not bypass operating permission after a reconnection. Do not test this by issuing uncontrolled commands on a live process. Agree a controlled acceptance arrangement with the equipment and operations teams.
Review the network boundary
A connected electrical device should sit within a network arrangement appropriate to its operational role. Document the allowed communication paths and which system enforces them. A separate subnet or VLAN label is not sufficient evidence by itself; the actual permitted traffic and administrative access need review. Shared engineering laptops, wireless access and remote maintenance routes may introduce paths that are absent from the simplified network drawing.
NIST SP 800-82 Revision 3 provides guidance for securing operational technology while considering its operational needs. Use it with the responsible specialists to select project controls. The checklist below translates that review into procurement evidence and ownership; it is not an independent compliance assessment or an assertion of a security level for the pictured breaker.
| Review area | Evidence to retain | Responsible team |
|---|---|---|
| Asset inventory | Model, accessory, firmware and support owner | Equipment supplier and facilities |
| Network access | Required routes, services and remote entry points | Network administrator |
| Accounts | Owner, permissions and revocation procedure | System owner |
| Commands | Approved writes, local inhibits and feedback | Electrical operations and integrator |
| Updates | Supported process, version and recovery plan | Supplier and maintainer |
| Recovery | Usable backups and controlled restoration results | Facilities and system administrator |
Each control needs a named owner and a documented result. A blank entry should remain an open acceptance item. If a requested feature is unavailable, record the actual limitation and the approved alternative instead of changing the wording to imply compliance. For example, a managed access gateway may control remote sessions, but it does not transform an unauthenticated field protocol into a different device capability.
Verify data quality and event records
A connection can be technically available while reporting misleading information. Ask how the system indicates stale measurements, unavailable states and failed transactions. A fixed last-known value should not look like a fresh reading. Where an event timestamp is assigned by a gateway rather than the device, record that distinction so an incident investigation does not mistake retrieval time for the actual sequence of operations.
Specify the records required for privileged changes and operating requests: identity, affected asset, request time, result and available confirmation. Protect access to those records and define retention under the site's policy. Avoid collecting credentials or unnecessary personal information in ordinary logs. Use the BMS integration guide to align data quality, alarms and ownership between electrical and building-system contractors.
Agree a supported update process
Request the supplier's firmware support policy, update instructions, vulnerability reporting contact and end-of-support information for every relevant component. A claim that updates are available is incomplete without knowing who obtains them, verifies the source and approves installation. Check whether a change affects point maps, access roles, settings, communication or the operating mechanism. Maintain a version record that can be compared with the accepted configuration.
Schedule changes through the organization's operating process. Do not automatically install unreviewed firmware during production simply because an application offers an update button. Establish the required backup, outage allowance, acceptance checks and recovery plan first. Likewise, do not assume an old version is acceptable indefinitely; track the supplier's advisories and have the responsible team assess relevant risks and supported remedies.
Test recovery without changing the safety basis
Prepare backups of the approved gateway mapping, application configuration and other supported settings. Identify what a replacement device needs and whether backups contain sensitive information. Store copies securely and test restoration using a suitable arrangement. A backup file existing on a laptop does not establish that the facilities team can restore service after the laptop or contractor account becomes unavailable.
During acceptance, verify the planned response to a lost network connection, expired remote account, unavailable gateway and restart. Confirm that data quality and alarms remain understandable and that control permissions are not silently broadened. Review any queued operations before reconnection. The recovery procedure should restore the approved configuration; it should not introduce automatic reclosing or remove an existing local inhibit merely to recover the dashboard.
Keep remote control separate from maintenance isolation
Cybersecurity controls protect access and integrity, while electrical work needs its own isolation and verification process. Disabling an account or disconnecting a network cable does not establish that equipment is electrically safe. An application showing OFF may be stale or may represent a requested state. The OSHA electrical work-practice requirements illustrate the distinction within their US workplace scope; other sites must follow the requirements applicable to them.
The project should document how remote operation is prevented during an authorized maintenance isolation. This is an electrical and operational design matter that must include the actual equipment and possible supply paths. Keep the approved procedure available even during a network or application outage. A cybersecurity acceptance should never require defeating protective interlocks or exposing personnel to live parts.
Review the actual SUTON evidence
The SUTON ETM3E intelligent measurement circuit breaker is relevant to a connected measurement discussion. Its exterior and family name do not independently confirm encrypted communication, authenticated writes, signed firmware, a vulnerability program, a cloud service or cybersecurity certification. Request written answers for the exact model, accessory and firmware combination before adding such features to the contract or a customer presentation.
Send the intended monitoring and control functions, network arrangement and access policy with the inquiry. Ask the supplier to distinguish device features from functions supplied by a separate gateway or platform. Include a support-period question and the documentation needed for replacement. Clear responsibility boundaries allow the buyer to judge the complete system instead of attributing a gateway capability to the breaker housing.
Close the checklist with evidence and ownership
At handover, retain the approved asset list, access roles, connection diagram, supported configurations, acceptance results and remaining limitations. Obtain confirmation that temporary accounts and commissioning routes have been removed or formally retained. Name the person responsible for reviewing access and supplier advisories. A security checklist loses value when every item is marked complete but nobody owns the next firmware or personnel change.
Revisit the record after a gateway replacement, firmware update, new remote service or transfer of building ownership. Focus the review on the actual change and its affected permissions or data paths. A previously accepted installation is useful evidence, but it does not automatically cover a different component or support arrangement. The goal is a maintainable connection whose capabilities and restrictions remain clear throughout service.
Frequently asked questions
Does a smart circuit breaker automatically include cybersecurity protection?
No. Determine the functions of the exact device and its gateway, network and application. Request evidence for claimed authentication, encryption, updates and support rather than inferring them from the smart product label.
Can a read-only BMS connection still require a security review?
Yes. Credentials, gateway configuration, exposed services, data quality and support access still matter. Confirm that the complete arrangement actually prevents unwanted writes rather than only hiding control buttons on one screen.
Is disconnecting the internet sufficient for safe electrical maintenance?
No. Network disconnection does not establish electrical isolation or absence of voltage. Maintenance requires the site's approved isolation and verification procedure, including prevention of unexpected reenergization where applicable.
Educational video
Cyber Security of Industrial Control Systems by Stanford. This Stanford lecture provides historical background on the physical effects of industrial control system cyber incidents. It is not current configuration guidance; use the current project review and linked official guidance for implementation.
