CLC IEC/TS 63074:2024
(Main)Safety of machinery - Security aspects related to functional safety of safety-related control systems
Safety of machinery - Security aspects related to functional safety of safety-related control systems
This technical specification identifies the relevant aspects of the IEC 62443 series related to security threats and vulnerabilities that are considered for the design and implementation of safety-related control systems (SCS) which can lead to the loss of the ability to maintain safe operation of a machine. Typical security aspects related to the machine with potential relation to SCS are: – vulnerabilities of the SCS either directly or indirectly through the other parts of the machine which can be exploited by security threats that can result in security attacks (security breach); – influence on the safety characteristics and ability of the SCS to properly perform its function(s); – typical use case definition and application of a corresponding threat model. Non-safety-related aspects of security threats and vulnerabilities are not considered in this document. The focus of this document is on intentional malicious actions. However, intentional hardware manipulation (e.g. wiring, exchange of components) or foreseeable misuse by physical manipulation of SCS (e.g. physical bypass) is not considered in this document. This document does not cover security requirements for information technology (IT) products and for the design of devices used in the SCS (e.g., product specific standards can be available, such as IEC TS 63208).
Maschinensicherheit - Sicherheitsaspekte in Verbindung mit der funktionalen Sicherheit von sicherheitsrelevanten Steuerungssystemen
Sécurité des machines - Aspects liés à la sûreté relatifs à la sécurité fonctionnelle des systèmes de commande relatifs à la sécurité
Varnost strojev - Zaščitni vidiki, povezani s funkcionalno varnostjo varnostno pomembnih nadzornih sistemov
Ta tehnična specifikacija opredeljuje ustrezne vidike skupine standardov IEC 62443, povezane z varnostnimi grožnjami in ranljivostmi, ki se upoštevajo pri načrtovanju in izvajanju varnostno pomembnih nadzornih sistemov (SCS) ter lahko vodijo v nezmožnost ohranjanja varnega delovanja stroja.
Tipični zaščitni vidiki, povezani s strojem s potencialno povezavo z varnostno pomembnim nadzornim sistemom, so:
– ranljivosti varnostno pomembnega nadzornega sistema, tako neposredne kot posredne, tj. prek drugih delov stroja, ki jih lahko izkoristijo varnostne grožnje in posledica katerih so lahko varnostni napadi (kršitev varnosti);
– vpliv na varnostne lastnosti in zmožnost varnostno pomembnega nadzornega sistema, da pravilno izvaja svoje funkcije;
– opredelitev tipičnega primera uporabe in uporaba ustreznega modela groženj.
Vidiki varnostnih groženj in ranljivosti, ki niso povezani z zaščito, v tem dokumentu niso obravnavani.
Ta dokument se osredotoča na zlonamerna dejanja, ki so izvedena namerno. Namerna manipulacija strojne opreme (npr. ožičenje, zamenjava komponent) oziroma predvidljiva zloraba s fizično manipulacijo varnostno pomembnega nadzornega sistema (npr. fizični obvod) v tem dokumentu ni obravnavana.
Ta dokument ne zajema varnostnih zahtev za izdelke informacijske tehnologije (IT) in za načrtovanje naprav, ki se uporabljajo v varnostno pomembnem nadzornem sistemu (npr. na voljo so lahko posebni standardi za izdelke, kot je IEC TS 63208).
General Information
Standards Content (Sample)
SLOVENSKI STANDARD
01-september-2024
Varnost strojev - Zaščitni vidiki, povezani s funkcionalno varnostjo varnostno
pomembnih nadzornih sistemov
Safety of machinery - Security aspects related to functional safety of safety-related
control systems
Maschinensicherheit - Sicherheitsaspekte in Verbindung mit der funktionalen Sicherheit
von sicherheitsrelevanten Steuerungssystemen
Sécurité des machines - Aspects liés à la sûreté relatifs à la sécurité fonctionnelle des
systèmes de commande relatifs à la sécurité
Ta slovenski standard je istoveten z: CLC IEC/TS 63074:2024
ICS:
13.110 Varnost strojev Safety of machinery
25.040.01 Sistemi za avtomatizacijo v Industrial automation
industriji na splošno systems in general
29.020 Elektrotehnika na splošno Electrical engineering in
general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
TECHNICAL SPECIFICATION CLC IEC/TS 63074
SPÉCIFICATION TECHNIQUE
TECHNISCHE SPEZIFIKATION February 2024
ICS 13.110; 29.020
English Version
Safety of machinery - Security aspects related to functional
safety of safety-related control systems
(IEC/TS 63074:2023)
Sécurité des machines - Aspects liés à la sûreté relatifs à la Maschinensicherheit - Sicherheitsaspekte in Verbindung mit
sécurité fonctionnelle des systèmes de commande relatifs à der funktionalen Sicherheit von sicherheitsrelevanten
la sécurité Steuerungssystemen
(IEC/TS 63074:2023) (IEC/TS 63074:2023)
This Technical Specification was approved by CENELEC on 2024-01-22.
CENELEC members are required to announce the existence of this TS in the same way as for an EN and to make the TS available promptly
at national level in an appropriate form. It is permissible to keep conflicting national standards in force.
CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic,
Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the
Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Türkiye and the United Kingdom.
European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2024 CENELEC All rights of exploitation in any form and by any means reserved worldwide for CENELEC Members.
Ref. No. CLC IEC/TS 63074:2024 E
European foreword
This document (CLC IEC/TS 63074:2024) consists of the text of IEC/TS 63074:2023 prepared by
IEC/TC 44 "Safety of machinery - Electrotechnical aspects".
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CENELEC shall not be held responsible for identifying any or all such patent rights.
Any feedback and questions on this document should be directed to the users’ national committee. A
complete listing of these bodies can be found on the CENELEC website.
Endorsement notice
The text of the International Technical Specification IEC/TS 63074:2023 was approved by CENELEC
as a European Technical Specification without any modification.
In the official version, for Bibliography, the following notes have to be added for the standard indicated:
IEC 60204-1:2016 NOTE Approved as EN 60204-1:2018
IEC 61496 (series) NOTE Approved as EN IEC 61496 (series)
IEC 61508-2:2010 NOTE Approved as EN 61508-2:2010 (not modified)
IEC 61508-3:2010 NOTE Approved as EN 61508-3:2010 (not modified)
IEC 61508-4:2010 NOTE Approved as EN 61508-4:2010 (not modified)
IEC 62443 (series) NOTE Approved as EN IEC 62443 (series)
IEC 62443-2-4:2015 NOTE Approved as EN IEC 62443-2-4:2019 (not modified)
IEC 62443-2-4:2015/A1:2017 NOTE Approved as EN IEC 62443-2-4:2019/A1:2019 (not modified)
IEC 62443-3-2:2020 NOTE Approved as EN IEC 62443-3-2:2020 (not modified)
IEC 62443-3-3:2013 NOTE Approved as EN IEC 62443-3-3:2019 (not modified)
IEC 62443-4-1:2018 NOTE Approved as EN IEC 62443-4-1:2018 (not modified)
IEC 62745 NOTE Approved as EN 62745
ISO 12100:2010 NOTE Approved as EN ISO 12100:2010 (not modified)
ISO 13849-2:2012 NOTE Approved as EN ISO 13849-2:2012 (not modified)
ISO 14119 NOTE Approved as EN ISO 14119
ISO/TR 22100-4:2018 NOTE Approved as CEN ISO/TR 22100-4:2020 (not modified)
Annex ZA
(normative)
Normative references to international publications
with their corresponding European publications
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
NOTE 1 Where an International Publication has been modified by common modifications, indicated by (mod), the
relevant EN/HD applies.
NOTE 2 Up-to-date information on the latest versions of the European Standards listed in this annex is available
here: www.cencenelec.eu.
Publication Year Title EN/HD Year
IEC 62061 2021 Safety of machinery - Functional safety of EN IEC 62061 2021
safety-related control systems
IEC TS 63074 ®
Edition 1.0 2023-02
TECHNICAL
SPECIFICATION
colour
inside
Safety of machinery – Security aspects related to functional safety of safety-
related control systems
INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
ICS 13.110; 29.020 ISBN 978-2-8322-6468-3
– 2 – IEC TS 63074:2023 © IEC 2023
CONTENTS
FOREWORD . 4
INTRODUCTION . 6
1 Scope . 7
2 Normative references . 7
3 Terms, definitions, and abbreviated terms . 8
3.1 Terms and definitions . 8
3.2 Abbreviated terms . 12
4 Safety and security overview . 12
4.1 General . 12
4.2 Safety objectives . 12
4.3 Security objectives . 13
5 Security aspects related to functional safety . 15
5.1 General . 15
5.1.1 Security risk assessment . 15
5.1.2 Security risk response strategy . 16
5.2 Security countermeasures . 16
5.2.1 General . 16
5.2.2 Identification and authentication . 18
5.2.3 Use control . 18
5.2.4 System integrity . 18
5.2.5 Data confidentiality . 18
5.2.6 Restricted data flow . 19
5.2.7 Timely response to events . 19
5.2.8 Resource availability . 19
6 Cybersecurity and functional safety of machinery . 19
6.1 General . 19
6.2 Aspects related to the protection against corruption . 19
6.3 Security countermeasures against corruption . 20
6.3.1 General . 20
6.3.2 Potential sources of cyber threats . 20
6.3.3 Multi-factor authentication . 20
6.3.4 Network architecture . 20
6.3.5 Portable devices . 21
6.3.6 Wireless communication . 21
6.3.7 Remote access . 21
6.3.8 Attack through direct physical connection . 22
7 Verification and maintenance of security countermeasures . 22
8 Information for the user of the machine(s) . 22
Annex A (informative) Basic information related to threats and threat modelling
approach . 23
A.1 Evaluation of threats . 23
A.2 Examples of threat related to a safety-related device . 24
Annex B (informative) Security risk assessment triggers . 26
B.1 General . 26
B.2 Event driven triggers . 26
IEC TS 63074:2023 © IEC 2023 – 3 –
Annex C (informative) Example of information flow between device supplier,
manufacturer of machine, integrator and user of machine . 27
C.1 General . 27
C.2 Example 1 – Design phase of the machine . 27
C.3 Example 2 – Use phase of the machine . 27
Bibliography . 29
Figure 1 – Relationship between threat(s), vulnerabilities, consequence(s) and security
risk(s) for SCS performing safety function(s) . 14
Figure 2 – Possible effects of security risk(s) to an SCS . 14
Figure A.1 – Safety-related device and possible accesses . 25
Figure C.1 – Example of generic information flow during design phase . 27
Figure C.2 – Example of generic information flow during use phase . 28
Figure C.3 – Example of information flow during use phase in context of IEC 62443-2-4 . 28
Table 1 – Overview of foundational requirements and possible influence(s) on an SCS . 17
– 4 – IEC TS 63074:2023 © IEC 2023
INTERNATIONAL ELECTROTECHNICAL COMMISSION
____________
SAFETY OF MACHINERY – SECURITY ASPECTS RELATED TO
FUNCTIONAL SAFETY OF SAFETY-RELATED CONTROL SYSTEMS
FOREWORD
1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising
all national electrotechnical committees (IEC National Committees). The object of IEC is to promote international
co-operation on all questions concerning standardization in the electrical and electronic fields. To this end and
in addition to other activities, IEC publishes International Standards, Technical Specifications, Technical Reports,
Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC Publication(s)”). Their
preparation is entrusted to technical committees; any IEC National Committee interested in the subject dealt with
may participate in this preparatory work. International, governmental and non-governmental organizations liaising
with the IEC also participate in this preparation. IEC collaborates closely with the Int
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.