How to Build Cybersecurity Into Your RTU Modernization Strategy

Modernizing a fleet of remote terminal units is a rare chance to fix more than old hardware. The RTUs being replaced were often designed in an era when a device on a private serial line was considered safe by isolation alone. Those units now sit on IP networks, reachable from far beyond the substation fence. If a RTU modernization strategy treats cybersecurity as something to add later, it repeats the same mistake with newer boxes. Security has to be built in, at every layer, from the first line of the plan.

Why modernization and security belong in the same project

Legacy RTUs carry real risk: unencrypted protocols, default or shared passwords, no logging, firmware that cannot be verified, and no way to tell who changed what. As these assets connect to wider networks for remote access and data, each one becomes a doorway. The moment you open a cabinet to swap the hardware, you are already touching the wiring, the network and the access model. That is exactly the moment to design security in, rather than bolting it on in a separate project that may never get funded.

Put simply: secure by design, not by patch. Patching is for the unexpected. The predictable risks should be engineered out from the start.

What “built-in” cybersecurity actually looks like

Built-in security is not one feature. It is a set of properties the device and the system carry by default, so the secure way is also the normal way.

Standards give this structure. IEC 62443-4-1 covers the secure development process, how the device is built, and IEC 62443-4-2 covers the technical security of the product itself. Choosing RTUs certified to these standards means the security groundwork is already done and independently verified, rather than taken on trust.

A phased approach to secure modernization

You do not have to secure everything at once. A modernization program works best in phases, with security designed into each one rather than saved for the end.

Assess the fleet first: what is out there, what it connects to, and where the risk sits. Segment the network into zones and conduits so a problem in one area cannot spread. Harden the RTU by replacing legacy units with secure-by-design hardware. Encrypt and authenticate so data is protected in transit and only the right people, in the right roles, can act. Then monitor and maintain: log activity, apply updates, and manage security across the whole lifecycle, not just at go-live.

Security is a lifecycle, not a launch

The work does not end when the new RTUs are installed. Threats change, people change, and firmware needs updating. A device built for security makes this manageable: signed firmware so updates can be trusted, role-based access so leavers lose access cleanly, and logging so you can see what happened and prove it later. The goal is a fleet you can keep secure for years, not one that is secure only on the day it is commissioned.

That is the thinking behind how Brodersen builds the RTU32M: certified to IEC 62443, secure by design, and made to stay secure across its life in the field.

Build your RTU in the online configurator → Talk to us about secure modernization →