EN IEC 62443-2-4:2024
(Main)Security for industrial automation and control systems - Part 2-4: Security program requirements for IACS service providers
Security for industrial automation and control systems - Part 2-4: Security program requirements for IACS service providers
IEC 62443-2:2023 specifies a comprehensive set of requirements for security-related processes that IACS service providers can offer to the asset owner during integration and maintenance activities of an Automation Solution. Because not all requirements apply to all industry groups and organizations, Subclause 4.1.4 provides for the development of "profiles" that allow for the subsetting of these requirements. Profiles are used to adapt this document to specific environments, including environments not based on an IACS. NOTE 1 The term "Automation Solution" is used as a proper noun (and therefore capitalized) in this document to prevent confusion with other uses of this term. Collectively, the security processes offered by an IACS service provider are referred to as its Security Program (SP) for IACS asset owners. In a related specification, IEC 62443-2-1 describes requirements for the Security Management System of the asset owner. NOTE 2 In general, these security capabilities are policy, procedure, practice and personnel related. Figure 1 illustrates the integration and maintenance security processes of the asset owner, service provider(s), and product supplier(s) of an IACS and their relationships to each other and to the Automation Solution. Some of the requirements of this document relating to the safety program are associated with security requirements described in IEC 62443-3-3 and IEC 62443-4-2. NOTE 3 The IACS is a combination of the Automation Solution and the organizational measures necessary for its design, deployment, operation, and maintenance. NOTE 4 Maintenance of legacy system with insufficient security technical capabilities, implementation of policies, processes and procedures can be addressed through risk mitigation.
IT-Sicherheit für industrielle Automatisierungssysteme - Teil 2-4: Anforderungen an das IT-Sicherheitsprogramm von Dienstleistern für industrielle Automatisierungssysteme
Sécurité des automatismes industriels et des systèmes de commande - Partie 2-4: Exigences de programme de sécurité pour les fournisseurs de service IACS
L’IEC 62453-2:2023 fournit des informations sur l’intégration de la technologie CIP™ dans la spécification des interfaces des outils des dispositifs de terrain (FDT) (IEC 62453-2). La Famille de profils de communication 2 (communément appelée CIP™ définit des profils de communication basés sur les normes IEC 61158‑2 Type 2, IEC 61158‑3‑2, IEC 61158‑4‑2, IEC 61158‑5‑2, IEC 61158‑6‑2 et IEC 62026‑3. Les profils de base CP 2/1 (ControlNet™), CP 2/2 (EtherNet/IP™) et CP 2/3 (DeviceNet™1) sont définis dans l’IEC 61784-1 et l’IEC 61784-2. Un Profil de communication supplémentaire (CompoNet™1), également basé sur CIP™, est défini dans l’IEC 62026-7. La présente partie de l’IEC 62453 spécifie les services de communication et autres services. La présente spécification ne contient pas la spécification des outils FDT et ne la modifie pas.CIP™ (Common Industrial Protocol), DeviceNet™ et CompoNet™ sont les appellations commerciales de Open DeviceNet Vendor Association, Inc (ODVA). Cette information est donnée à l’intention des utilisateurs du présent document et ne signifie nullement que l’IEC approuve ou recommande le détenteur de la marque ou de l’un quelconque de ses produits. La conformité à la présente norme n’exige pas l’emploi des appellations commerciales CIP™, DeviceNet™ ou CompoNet™. L’utilisation des appellations commerciales CIP™, DeviceNet™ ou CompoNet™ nécessite l’autorisation de Open DeviceNet Vendor Association, Inc. ControlNet™ est l’appellation commerciale de ControlNet International, Ltd. Cette information est donnée à l’intention des utilisateurs du présent document et ne signifie nullement que l’IEC approuve ou recommande le détenteur de la marque ou de l’un quelconque de ses produits. La conformité à ce profil n’exige pas l’emploi de l’appellation commerciale ControlNet™. L’utilisation de l’appellation commerciale ControlNet™ nécessite l’autorisation de ControlNet International, Ltd. EtherNet/IP™ est l’appellation commerciale de ControlNet International, Ltd et de Open DeviceNet Vendor Association, Inc. Cette information est donnée à l’intention des utilisateurs du présent document et ne signifie nullement que l’IEC approuve ou recommande le détenteur de la marque ou de l’un quelconque de ses produits. La conformité à ce profil n’exige pas l’emploi de l’appellation commerciale EtherNet/IP™. L’utilisation de l’appellation commerciale EtherNet/IP™ nécessite l’autorisation de ControlNet International, Ltd. ou de Open DeviceNet Vendor Association, Inc.
Zaščita industrijske avtomatizacije in nadzornih sistemov - 2-4. del: Zahteve za program zaščite za ponudnike storitev IACS (IEC 62443-2-4:2023)
General Information
Relations
Standards Content (Sample)
SLOVENSKI STANDARD
oSIST prEN IEC 62443-2-4:2022
01-november-2022
Zaščita industrijske avtomatizacije in nadzornih sistemov - 2-4. del: Zahteve za
program varnosti zaščite za ponudnike storitev IACS
Security for industrial automation and control systems - Part 2-4: Security program
requirements for IACS service providers
IT-Sicherheit für industrielle Automatisierungssysteme - Teil 2-4: Anforderungen an das
IT-Sicherheitsprogramm von Dienstleistern für industrielle Automatisierungssysteme
Sécurité des automatismes industriels et des systèmes de commande - Partie 2-4:
Exigences de programme de sécurité pour les fournisseurs de service IACS
Ta slovenski standard je istoveten z: prEN IEC 62443-2-4:2022
ICS:
25.040.01 Sistemi za avtomatizacijo v Industrial automation
industriji na splošno systems in general
35.030 Informacijska varnost IT Security
oSIST prEN IEC 62443-2-4:2022 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
---------------------- Page: 1 ----------------------
oSIST prEN IEC 62443-2-4:2022
---------------------- Page: 2 ----------------------
oSIST prEN IEC 62443-2-4:2022
65/936/CDV
COMMITTEE DRAFT FOR VOTE (CDV)
PROJECT NUMBER:
IEC 62443-2-4 ED2
DATE OF CIRCULATION: CLOSING DATE FOR VOTING:
2022-09-09 2022-12-02
SUPERSEDES DOCUMENTS:
65/848/CD, 65/854A/CC
IEC TC 65 : INDUSTRIAL-PROCESS MEASUREMENT, CONTROL AND AUTOMATION
SECRETARIAT: SECRETARY:
France Mr Didier GIARRATANO
OF INTEREST TO THE FOLLOWING COMMITTEES: PROPOSED HORIZONTAL STANDARD:
TC 44,SC 45A,TC 57,SC 62A,SC 121A,ISO/IEC
JTC 1/SC 41
Other TC/SCs are requested to indicate their interest, if
any, in this CDV to the secretary.
FUNCTIONS CONCERNED:
EMC ENVIRONMENT QUALITY ASSURANCE SAFETY
SUBMITTED FOR CENELEC PARALLEL VOTING NOT SUBMITTED FOR CENELEC PARALLEL VOTING
Attention IEC-CENELEC parallel voting
The attention of IEC National Committees, members of
CENELEC, is drawn to the fact that this Committee Draft
for Vote (CDV) is submitted for parallel voting.
The CENELEC members are invited to vote through the
CENELEC online voting system.
This document is still under study and subject to change. It should not be used for reference purposes.
Recipients of this document are invited to submit, with their comments, notification of any relevant patent rights of
which they are aware and to provide supporting documentation.
TITLE:
Security for industrial automation and control systems - Part 2-4: Security program
requirements for IACS service providers
PROPOSED STABILITY DATE: 2025
NOTE FROM TC/SC OFFICERS:
Copyright © 2022 International Electrotechnical Commission, IEC. All rights reserved. It is permitted to download this
electronic file, to make a copy and to print out the content for the sole purpose of preparing National Committee positions.
You may not copy or "mirror" the file or printed version of the document, or any part of it, for any other purpose without
permission in writing from IEC.
---------------------- Page: 3 ----------------------
oSIST prEN IEC 62443-2-4:2022
– 2 – IEC CDV 62443-2-4 © IEC 2022
1 CONTENTS
2 CONTENTS . 2
3 FOREWORD . 3
4 INTRODUCTION . 5
5 Scope . 6
6 Normative references . 7
7 Terms, definitions, abbreviated terms and acronyms . 7
8 3.1 Terms and definitions. 7
9 3.2 Abbreviations . 11
10 Concepts . 12
11 4.1 Use of IEC 62443-2-4 . 12
12 4.1.1 Use of IEC 62443-2-4 by service providers . 12
13 4.1.2 Use of IEC 62443-2-4 by asset owners . 13
14 4.1.3 Use of IEC 62443-2-4 during negotiations between asset owners and
15 IACS service providers . 14
16 4.1.4 Profiles .
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.