CLC/TS 50491-7:2024
(Main)General requirements for Home and Building Electronic Systems (HBES) and Building Automation and Control Systems (BACS) - Part 7: IT security and data protection - User Guide
General requirements for Home and Building Electronic Systems (HBES) and Building Automation and Control Systems (BACS) - Part 7: IT security and data protection - User Guide
This document provides guidance to set-up and manage/update a cybersecure HBES/BACS connected to Internet. This document provides: 1) categories of HBES/BACS networks related to cybersecurity updates: - managed networks; - unmanaged networks; 2) risk analysis guide for the above-mentioned categories: - at device level for both managed and unmanaged networks; - at system level for managed ones only. For manufacturers, the document provides a classification based on the security levels from existing standards (ETSI EN 303 645, EN IEC 62443 (all parts)). For installers, system integrators and administrators of HBES/BACS this document provides guidance for each responsible actor, as listed below: - system integrators and administrators: - a generic method for assessment of the security risk for each product in the perspective of the overall system. The result of the evaluation gives the minimum required security level on product level corresponding to the manufacturer classification; - best practice measures on the system security level; - a guide to enhance the maturity level of the cyber security management process. - installers, system integrators and administrators: - a guide to select products to comply with the required security level during configuration and operation. In some commercial applications, dedicated standards can apply per country that are not covered by this document, e.g.: - fire (e.g. detection, alarm); - medical; - security applications: Intruder alarms, video surveillance, access control; - critical infrastructure; - AAL (Active assisted living). For such applications not covered by this document the specification could be used as guidance.
Elektrische Systemtechnik in Heim und Gebäude - IT-Sicherheit und Datenschutz - User Guide
Systèmes Électroniques pour les Foyers Domestiques et les Bâtiments - Sécurité informatique et protection des données - User Guide
Splošne zahteve za elektronske sisteme za dom in stavbe (HBES) ter sisteme za avtomatizacijo in krmiljenje stavb (BACS) - 7. del: varnost IT in zaščita podatkov – Uporabniški priročnik
General Information
Standards Content (Sample)
SLOVENSKI STANDARD
01-januar-2025
Splošne zahteve za elektronske sisteme za dom in stavbe (HBES) ter sisteme za
avtomatizacijo in krmiljenje stavb (BACS) - 7. del: varnost IT in zaščita podatkov –
Uporabniški priročnik
General requirements for Home and Building Electronic Systems (HBES) and Building
Automation and Control Systems (BACS) - Part 7: IT security and data protection - User
Guide
Elektrische Systemtechnik in Heim und Gebäude - IT-Sicherheit und Datenschutz - User
Guide
Systèmes Électroniques pour les Foyers Domestiques et les Bâtiments - Sécurité
informatique et protection des données - User Guide
Ta slovenski standard je istoveten z: CLC/TS 50491-7:2024
ICS:
35.030 Informacijska varnost IT Security
97.120 Avtomatske krmilne naprave Automatic controls for
za dom household use
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
TECHNICAL SPECIFICATION CLC/TS 50491-7
SPÉCIFICATION TECHNIQUE
TECHNISCHE SPEZIFIKATION November 2024
ICS 97.120; 35.030
English Version
General requirements for Home and Building Electronic Systems
(HBES) and Building Automation and Control Systems (BACS) -
Part 7: IT security and data protection - User Guide
Systèmes Électroniques pour les Foyers Domestiques et Elektrische Systemtechnik in Heim und Gebäude - IT-
les Bâtiments - Sécurité informatique et protection des Sicherheit und Datenschutz - User Guide
données - User Guide
This Technical Specification was approved by CENELEC on 2024-10-21.
CENELEC members are required to announce the existence of this TS in the same way as for an EN and to make the TS available promptly
at national level in an appropriate form. It is permissible to keep conflicting national standards in force.
CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic,
Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the
Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Türkiye and the United Kingdom.
European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2024 CENELEC All rights of exploitation in any form and by any means reserved worldwide for CENELEC Members.
Ref. No. CLC/TS 50491-7:2024 E
Contents Page
European foreword . 3
Introduction . 4
1 Scope . 6
2 Normative references . 6
3 Terms and definitions . 7
4 Abbreviations . 13
5 Awareness about the threat landscape . 13
5.1 ENISA reference documents . 13
6 User guidance for cyber security measures . 16
6.1 Recommended hardening measures . 16
6.1.1 General . 16
6.1.2 General hardening measures . 16
6.1.3 Hardening measures for unmanaged networks . 16
6.1.4 Hardening measures for managed networks. 18
6.2 Generic Risk analysis for managed networks to select the right product security . 20
6.2.1 Introduction . 20
6.2.2 Risk analysis for the product selection in managed networks. 20
6.2.3 Security level classification . 22
6.2.4 Device Security class for managed networks . 23
6.3 Zoning for logical network segmentation for managed networks . 23
6.3.1 Introduction . 23
6.3.2 Residential buildings . 23
6.3.3 Non-residential buildings . 26
6.3.4 Guidelines for device assignment to zones . 27
6.3.5 Filtering . 27
6.3.6 Mixed Networks . 29
6.4 System enrolment and configuration for managed networks . 29
6.5 Update management by user for managed networks . 29
6.6 Documentation . 29
6.6.1 Check lists for Installers, system integrators and administrators . 29
6.6.2 Check lists for users . 31
6.6.3 Check lists for HBES/BACS manufacturers. 31
7 Security level classification for HBES/BACS devices by manufactures . 32
7.1 Security class . 32
7.2 Security level indication . 32
Annex A (normative) Constraints for HBES and BASC risk analysis by solving a constraint satisfaction
problem . 33
Annex B (informative) Update management (Good practice for the manufacturer) . 37
B.1 General . 37
B.2 Patches . 37
B.3 Minor Updates . 37
B.4 Major Updates . 38
Annex C (informative) Mapping threat ENISA to OWSAP . 39
Bibliography . 40
European foreword
This document (CLC/TS 50491-7:2024) has been prepared by CLC/TC TC 205, “Home and Building Electronic
Systems (HBES)”.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. CENELEC shall not be held responsible for identifying any or all such patent rights.
This document is part of the EN 50491 series of European Standards — General requirements for Home and
Building Electronic Systems (HBES) and Building Automation and Control Systems (BACS) — which will
comprise the following parts:
— Part 1: General requirements.
— Part 2: Environmental Conditions.
— Part 3: Electric Safety Requirements.
— Part 4-1: General functional safety requirements for products intended to be integrated in Building
Electronic Systems (HBES) and Building Automation and Control Systems (BACS);
— Part 5-1: EMC requirements, conditions and test set-up.
— Part 5-2: EMC requirements for HBES/BACS used in residential, commercial and light industry
environment.
— Part 5-3: EMC requirements for HBES/BACS used in industry environment
— Part 6-1: HBES installations — Installation and planning.
— Part 6-3: HBES installations — Assessment and definition of levels.
— Part 7: IT security and data protection - User Guide
— Part 11: Smart Metering — Application Specification — Simple External Consumer Display.
— Part 12: Smart grid — Application specification — Interface and framework for customer.
— Part 12-1: Interface between the CEM and Home/Building Resource manager– General Requirements and
Architecture.
— Part 12-2: Interface between the Home/Building CEM and Resource manager(s) – Data model and
messaging.
— Future Part 12-3: Home/Building Customer Energy Manager (CEM);
— Future Part 12-4: Resource manager.
Any feedback and questions on this document should be directed to the users’ national committee. A complete
listing of these bodies can be found on the CENELEC website.
Introduction
When an HBES/BACS system is installed in a home or building and connected to internet, it should keep the
integrity of the connected cyberspace during all the products’ lifetime from installation and configuration
throughout all operation to the end of life.
Cybersecurity is a continuous process as cyber threats evolve over time. Thus, countermeasures should follow
any new threat also after the product has been installed.
The risk of cyber-attacks highly depends on the type of application, type of communication medium and the
location where the data are intercepted.
As examples,
— data that is transmitted wireless can be more easily intercepted than data transmitted via wire;
— devices installed in public areas (garden, hallways) or public buildings (schools, hotels, sports complex, …)
are more susceptible to attack than devices that are installed in private and closed areas;
— data that is transmitted to switch on light may be of lesser importance than data containing metering data;
— HBES/BACS connected to cloud servers may be more vulnerable to attack than HBES/BACS devices that
are stand-alone, i.e. not connected.
In buildings, two types of networks can be identified: managed and unmanaged, depending on available
resources (e.g. network administrator) to ensure cybersecurity update during the products’ lifetime.
Examples of applications typically implemented as
— unmanaged network: Home or small office including building control applications, … where no or insufficient
resources (e.g. network administrator) are available for network cybersecurity updates and device access
control. Cybersecurity updates at device level may be ensured by device manufacturers, provided the final
user has given consent;
— managed networks: larger size installations including building control applications where typically an
organization (e.g. an administrator) updates components and the network including its structure: Resources
(e.g. integrator, maintenance provider, asset owner) are available for cybersecurity updates.
Cybersecurity updates in HBES/BACS systems installed and connected to internet systems can be managed
at two different levels: device level and system level. Updates at device level are possible both for managed
and unmanaged networks, while updates at system level is possible for managed networks only.
Considering the two levels, two main areas of application for managed and unmanaged networks can be
identified:
1) in case of unmanaged networks, for device update one is relying on the device fulfilling the cybersecurity
requirements identified by risk analysis for their intended use (e.g. in EU: RED Delegated Act on
cybersecurity).
2) managed networks apply when:
a) an organization is available for updates of the devices and the network; or
b) some devices cannot be updated at the level identified by risk analysis: in this case, protection is to be
ensured at system level and access to non-updateable devices is to be protected/controlled (e.g. old
equipment’s that cannot be updated nor substituted with new ones) by moving it out of the trusted
security zone; or
c) additional cybersecurity requirements are necessary at system level on top of the device level updates
(e.g. defining trusted and untrusted zones).
In all
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.