Substation Digital Access Handover for EPC Projects: Accounts, Backups and Vendor Support

Zisheng Electric treats substation digital access handover as an engineering deliverable, not an administrative afterthought. An EPC project may hand over protection relays, gateways, meters, HMIs, engineering workstations and remote support paths from several vendors. If account ownership, backup integrity and service boundaries are unclear, the owner can receive functioning equipment without the ability to maintain it safely. This guide sets out a practical handover method for project engineers and asset owners.

What substation digital access handover must prove

A useful handover proves four things: the owner can reach each approved device, the owner controls the accounts needed for normal administration, the configuration can be restored from an identified backup, and vendor access follows an agreed process. It also records exceptions. A password spreadsheet alone does not prove that an account works, that a backup is current or that an external service route has been closed.

Define the digital boundary from the approved architecture and equipment schedule. It may include protection relays, bay controllers, meters, protocol gateways, station computers, network switches, time sources, historian interfaces and engineering tools. The boundary should show which assets are in scope, who supplies them, who configures them, and which interfaces are owned by the utility, EPC, OEM or site operator. Avoid implying that every device has the same account model or remote access capability.

Build an access register around asset ownership

Assign a unique asset identifier that matches the single-line diagram, panel schedule and equipment label. For each asset, record manufacturer and model, firmware or software version where relevant, management interface, account role, owner, authentication method, support contact, backup reference and the procedure for recovery. Do not place live passwords in a broadly circulated commissioning report. Store secrets in the owner’s approved credential vault and have the responsible owner acknowledge receipt through its controlled process.

Separate named human accounts from shared service accounts. Where a vendor device requires a shared administrator account, document why it exists, who may authorize its use, how access is monitored, and when credentials will be rotated under the owner’s policy. Avoid generic “admin” access for routine work if the equipment supports individual roles. Use role-based permissions so operators, protection engineers, system administrators and vendor support personnel receive only the functions needed for their tasks.

Account naming and recovery methods should be agreed before factory testing. An EPC should not assume that a vendor’s default account can be changed without affecting a support tool or configuration workflow. Confirm the approved method with the equipment supplier, record any constraints, and include them in the commissioning procedure.

Control vendor support without breaking maintainability

Remote support can shorten fault resolution, but the channel must be visible to the owner and consistent with project cybersecurity rules. Record whether support uses a VPN, jump host, managed service gateway, temporary dial-in, or an on-site laptop. The precise architecture is project-specific and must be approved by the asset owner and relevant utility. Do not create a new internet route just to make a handover checklist easier.

For any external access, document the initiator, approval path, permitted destination, time window, logging location and closure check. Prefer access that is disabled by default and enabled for a defined maintenance session. If the owner requires a vendor to retain an account for warranty support, state its purpose, privilege level, expiry or review date, and the process for revocation. The contractual support arrangement and the technical access arrangement must agree; neither should silently override the other.

IEC 62443-2-4:2023 describes security program requirements for IACS service providers, while IEC 62443-2-1:2024 addresses security program requirements for asset owners. These standards can inform contractual role definitions and lifecycle controls. They do not replace the project’s risk assessment, applicable regulations, owner policy or equipment-specific instructions. Confirm the applicable editions and contractual requirements with the project authority before claiming conformance.

Backups must be identifiable and restorable

List the configuration artifacts needed to recover each system: relay settings, gateway mappings, switch configurations, HMI projects, server images, licenses, certificates, engineering files, firmware packages and approved network diagrams. The exact list depends on the supplied equipment. For each artifact, record the source device or engineering tool, version, export date, responsible person, storage location, file checksum if used, and any license or dependency required to restore it.

A file existing on a USB drive is not the same as a tested recovery path. During commissioning, restore a representative backup in a controlled environment or verify the restoration procedure with the equipment supplier. Where restoration could disrupt protection or control, do not test against the live system without an approved method and outage plan. Capture evidence such as a signed test sheet, application version, device identity and a clear pass/fail result. If a restore test cannot be performed before handover, list the limitation and assign a post-handover action with an owner and due date.

Verify the complete system, not only individual devices

Connectivity should be tested at the boundary that the operator will actually use. Confirm that approved workstations can reach the intended device interfaces, that role restrictions behave as specified, and that normal monitoring continues after the test. Check time synchronization, event and alarm logs, backup paths and the restoration of configuration files as appropriate to the design. Never treat an open port or successful ping as proof that a control function is ready.

Document the method and conditions: test account, device, software version, network zone, start and end time, observed result and witness. Use non-production or test accounts where possible. If a temporary test credential was created, remove it or transfer it through the owner’s approved process before closing the work package. A final check should confirm that temporary remote sessions, commissioning accounts, removable media and test routes have been handled according to the agreed rules.

Coordinate interfaces before FAT and site commissioning

Digital handover is easier when the interface matrix is agreed before factory acceptance testing. The matrix should identify each signal or data exchange, its source and destination, protocol or file format, responsible party, cybersecurity boundary, test method and required evidence. For a transformer and substation package, interfaces may include protection trips, alarms, temperature monitoring, tap changer indications, metering, SCADA points and time synchronization. Verify signal ownership and scaling against approved drawings rather than relying on informal vendor descriptions.

During FAT, confirm the delivered software baseline, account roles, configuration archive and interface simulation evidence. A FAT checklist should identify which tests are witnessed, which are simulated and which require site conditions. At site commissioning, compare device identity and loaded version against the released baseline. Any deviation should be recorded, assessed and approved before it becomes the new reference configuration.

Related EPC interface guidance is available in Zisheng Electric’s articles on transformer protection interface matrices and transformer and GIS interface coordination. Equipment context can be reviewed through the prefabricated substation and power transformer product pages.

Acceptance gates for substation digital access handover

Use a short acceptance matrix to stop administrative items from being hidden inside an overall commissioning certificate. For each device family, identify the technical owner, the account custodian, the backup custodian, the required test and the evidence reviewer. Mark each item as accepted, accepted with an approved limitation, or open. The owner should explicitly accept any deferred restore test or retained vendor account, including the compensating control and planned closure date.

Separate transfer of operational authority from transfer of credentials. A control room operator may need read-only access immediately, while a protection engineer receives setting-change privileges only after training and role approval. The account register should show those role boundaries, but should not include passwords in the handover package. The asset owner can acknowledge receipt of vault entries through its approved secure process.

Closeout records should identify the source baseline. Include the approved network drawing revision, device list revision, software tool version and configuration archive date. If a change occurred after FAT, document the deviation, reason, approval and retest evidence. A file name such as “final settings” is not a controlled revision reference. Use a revision identifier and a repository location the owner can maintain after the EPC team demobilizes.

For systems managed by a utility or third-party operator, agree the boundary in writing. The EPC may deliver a device and its configuration while the owner or utility retains authority over accounts, network routes or master time sources. Record which party holds each responsibility and what evidence is required before the EPC’s temporary access is removed. This avoids confusing project acceptance with a transfer of operational permissions the EPC does not own.

At the final review, select one representative device and trace its record from the equipment tag through the approved architecture, access role, backup reference, test evidence and support contact. This end-to-end sample reveals broken links that a field-by-field checklist may miss. Log corrections before the owner signs acceptance.

Where the site uses separate operational and corporate networks, verify that the final handover package reflects the approved boundary and does not include temporary commissioning routes as permanent interfaces. Record any owner-directed exception with its authorization and review date.

Before acceptance, check that recovery media is readable on the owner’s approved platform and that any encryption key or license dependency has an identified custodian. Confirm backup retention and version-control rules with the asset owner; do not assume removable media is the designated long-term archive. If the project uses a vendor-owned engineering workstation, hand over its operating procedure, access boundary and recovery image as contractually agreed.

Close the handover with named owners and controlled records

Put the access register, backup index, approved architecture, test evidence and exception log in the owner’s designated document system. Include revision, approval status and the person authorized to maintain each record. The EPC closeout meeting should identify who accepts account ownership, who controls vendor support, who stores recovery media and who will complete any deferred test. Ensure that the vendor’s warranty and service contacts remain available without retaining undocumented access.

Substation digital access handover is complete when the asset owner can identify each managed device, control the approved access path, locate a current recovery artifact and understand the support boundary. Zisheng Electric can review transformer, switchgear and prefabricated substation package interfaces against the project drawings, data sheets, load list, technical specification, single-line diagram, grid parameters, environmental conditions and installation-site requirements. Our engineering team will review the requirements and respond to project inquiries within 24 hours.