SCADA networks have used RS-232 serial connections since the 1960s. These links are simple, dependable and well understood. For many years, nearly every device from sensors to controllers used serial ports, which kept costs low through mass production. That broad market support is now in decline.

Serial systems are slow and limited compared to modern networks. Each connection usually carries only one channel of data, and adding capacity requires more cables and ports. Large serial deployments can require extensive patch-panel infrastructure, which creates an additional operational burden for documentation, troubleshooting and cable management. From a capacity standpoint, an Ethernet-based system can often carry the same aggregate traffic over a much smaller number of physical connections, as long as latency, jitter, segmentation and failover requirements are addressed. As scale increases, Ethernet-based networks are easier to grow, document and operate. 

Few utilities can replace every device at once. Transitional solutions bridge serial and IP systems, allowing them to run together while the network modernizes. In many cases, the initial migration focuses on transporting existing serial protocols across IP networks before later transitioning field devices to native IP protocols.

It is important to distinguish between using IP as a transport or management technology and converting the SCADA data flow itself to a routable IP protocol. Many utilities already use IP networks, raw sockets, IPsec and IP-based management around otherwise serial SCADA applications. In those environments, the more significant architectural change occurs when the operational SCADA data itself transitions from serial communication to native, routable IP. That transition can change how communications paths, security controls and applicable NERC CIP requirements must be evaluated.

One common option is pseudowire transport, which emulates a serial circuit across a packet-based backbone. This approach keeps existing field devices in service but requires specialized equipment at both ends.

A more flexible method uses raw socket transport protected by IPsec tunnels (see Figure 1). This technique carries the serial traffic through secure IP tunnels built with industrial routers, terminal servers or gateway platforms that support serial transport. It can support authentication and transport security approaches that may be used as part of a broader NERC CIP security program.

These transitional designs let utilities upgrade the backbone first and replace remote devices later. They also improve troubleshooting through standard IP tools such as ping and ARP, reduce physical cabling, and prepare the organization for broader IP adoption. 

A mature IP SCADA environment reduces reliance on point-to-point serial transport by using routed and redundant IP communications where practical. A routed Ethernet architecture can replace racks of serial cables while providing greater capacity and supporting resilient network designs.

The advantages are clear:

• Scalability. IP addressing supports growth without major redesign.
• Reliability. Routed redundancy can support automatic failover when routing design, path diversity, timers and SCADA application requirements are coordinated.
• Security. Encryption, access control, logging and configuration management can support secure operation and many common NERC CIP security objectives.
• Efficiency. Built-in diagnostics can improve fault isolation and support faster restoration.

Even large deployments, such as 1,000 remote devices running at 38.4 kbps aggregated uses less than 4% of a gigabit Ethernet link, even after accounting for typical overhead and transport encapsulation. A properly designed IP SCADA network (see Figure 2) can handle this load while improving operational visibility and providing additional troubleshooting and monitoring capabilities, helping utilities respond to communications issues more efficiently. That translates to shorter outages, fewer truck rolls and lower operational costs. 

NERC CIP standards do not require utilities to use a specific communications architecture, but IP networks can support many of the controls needed for secure and auditable operation while improving visibility, segmentation and centralized management capabilities. Each design must be evaluated based on asset classification, security boundaries, access controls and documented operational processes.

Several NERC CIP standards are especially relevant when evaluating how IP-based SCADA architectures affect security boundaries, access control and operational management:

• CIP-005. Addresses electronic security perimeters and controlled electronic access. IPsec tunnels may support these controls when they are designed with appropriate segmentation, access control, logging and documentation.
• CIP-007. Addresses system security management, including controls such as patch management, malicious code prevention, security event monitoring and access management. Modern IP routing and security platforms can support many of these functions, although they still must be configured and maintained as part of a broader program.
• CIP-010. Focuses on configuration change management and vulnerability assessments. IP-based systems can support more consistent baseline tracking when paired with appropriate tools and processes.
• CIP-012. Addresses protection of applicable communications between control centers. While it may not apply to every SCADA communications path, its focus on protecting data in transit is consistent with the broader security value of encrypted IP transport.

The compliance impact of a SCADA modernization depends on more than whether the underlying transport uses IP. Pseudowire and raw socket architectures may already rely on routed IP infrastructure, IPsec, centralized logging and IP-based device management while continuing to carry serial SCADA data. When the SCADA data itself moves to a native routable IP protocol, however, the resulting connectivity can change how electronic access, segmentation, asset classification and security boundaries must be evaluated. The specific CIP implications depend on the utility’s architecture and asset classifications and should be established with the compliance team as part of the migration design.

Centralized logging and encryption can improve auditability and support more consistent security management. Encryption should be paired with segmentation, access control, logging and configuration management. IPsec protects traffic in transit, but it does not replace the need for network zoning or documented security controls. Designing networks with auditability, operational consistency and long-term compliance management in mind can help reduce complexity as systems evolve. 

Every modernization effort comes with challenges. Common concerns include interoperability between new and old devices, latency in real-time control signals, and exposure to new security threats. There are organizational hurdles, such as training needs and temporary workload increases during cutover. IPsec also introduces operational responsibilities, including key or certificate management, tunnel monitoring, configuration control, and life cycle management.

From a technical perspective, validation should include polling behavior, timeout settings, latency, jitter, failover convergence and recovery after link interruptions. Quality of service policies also could be needed to prioritize SCADA traffic across shared OT WAN links.

Utilities can manage these risks through staged implementation, lab testing, and clear communication among engineering, operations and cybersecurity teams. Layered security, redundancy and continuous monitoring can help support reliable operation throughout the transition process.

A structured transition plan reduces risk and builds confidence throughout the organization. Typical stages include:

• Assessment. Inventory all serial endpoints and network links.
• Core and new deployments. Build out central infrastructure and use IP SCADA for new deployments.
• Pilot: Test raw socket solutions in a controlled setting.
• Hybrid operation. Run new deployments of raw socket and IP systems in parallel with the existing serial systems to validate performance.
• Full conversion. Replace serial RTUs with Ethernet-capable devices where practical and retire legacy transport equipment as sites are converted.
• Optimization. Simplify routing and update documentation after full cutover.

Training is vital. Teams that understand how IP routing, addressing and cybersecurity work will manage the new system more effectively. Investing in skill development early reduces long-term support costs and strengthens operational security. 

As legacy serial SCADA systems age out of production and replacement parts become scarce, there is an urgent need for utilities to modernize. A planned, phased migration to IP SCADA supports more consistent security management and compliance preparation. Transitional solutions allow for this modernization to happen at a manageable pace, without requiring immediate equipment replacement.

By making the switch, utilities gain a network that more readily supports encryption, centralized monitoring and modern security controls. Ultimately, moving to IP SCADA offers greater capacity, redundancy and long-term reliability.