iTeh StandardsiTeh Standards
EURUSD
Your shopping cart is empty.
SIST

oSIST prEN IEC 62443-2-1:2019

(Main)

Security for industrial automation and control systems - Part 2-1: Security program requirements for IACS asset owners

Security for industrial automation and control systems - Part 2-1: Security program requirements for IACS asset owners

Réseaux industriels de communication - Sécurité dans les réseaux et les systèmes - Partie 2-1: Etablissement d'un programme de sécurité pour les systèmes d'automatisation et de commande industrielles

Zaščita industrijske avtomatizacije in kontrolnih sistemov - 2-1. del: Zahteve za program varnosti zaščite za lastnike sredstev IACS

General Information

Status
Not Published
Public Enquiry End Date
13-Nov-2019
ICS
25.040.01 - Industrial automation systems in general
35.030 - IT Security
Technical Committee
MOV - Measuring equipment for electromagnetic quantities
Current Stage
5020 - Formal vote (FV) (Adopted Project)
Start Date
05-Mar-2024
Due Date
23-Apr-2024
Ref Project
FprEN IEC 62443-2-1:2024 - Security for industrial automation and control systems - Part 2-1: Security program requirements for IACS asset owners

Buy Standard

prEN IEC 62443-2-1:2019 - BARVEprEN IEC 62443-2-1:2019 - BARVE
PreviousNext
Draft
prEN IEC 62443-2-1:2019 - BARVE
English language
93 pages
sale 10% off
Preview
sale 10% off
Preview
e-Library read for
1 day

Standards Content (Sample)

SLOVENSKI STANDARD
oSIST prEN IEC 62443-2-1:2019
01-november-2019
Zaščita industrijske avtomatizacije in kontrolnih sistemov - 2-1. del: Zahteve za
program varnosti zaščite za lastnike sredstev IACS
Security for industrial automation and control systems - Part 2-1: Security program
requirements for IACS asset owners
Réseaux industriels de communication - Sécurité dans les réseaux et les systèmes -
Partie 2-1: Etablissement d'un programme de sécurité pour les systèmes
d'automatisation et de commande industrielles
Ta slovenski standard je istoveten z: prEN IEC 62443-2-1:2019
ICS:
25.040.01 Sistemi za avtomatizacijo v Industrial automation
industriji na splošno systems in general
35.030 Informacijska varnost IT Security
oSIST prEN IEC 62443-2-1:2019 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------
oSIST prEN IEC 62443-2-1:2019

---------------------- Page: 2 ----------------------
oSIST prEN IEC 62443-2-1:2019
65/756/CDV

COMMITTEE DRAFT FOR VOTE (CDV)
PROJECT NUMBER:
IEC 62443-2-1 ED2
DATE OF CIRCULATION: CLOSING DATE FOR VOTING:
2019-08-23 2019-11-15
SUPERSEDES DOCUMENTS:
65/692A/RR

IEC TC 65 : INDUSTRIAL-PROCESS MEASUREMENT, CONTROL AND AUTOMATION
SECRETARIAT: SECRETARY:
France Mr Rudy BELLIARDI
OF INTEREST TO THE FOLLOWING COMMITTEES: PROPOSED HORIZONTAL STANDARD:

TC 44, SC 45A, TC 57, SC 62A; ISO/IEC/JTC1/SC 27
Other TC/SCs are requested to indicate their interest, if any, in
this CDV to the secretary.
FUNCTIONS CONCERNED:
 EMC ENVIRONMENT QUALITY ASSURANCE SAFETY
SUBMITTED FOR CENELEC PARALLEL VOTING NOT SUBMITTED FOR CENELEC PARALLEL VOTING
Attention IEC-CENELEC parallel voting
The attention of IEC National Committees, members of
CENELEC, is drawn to the fact that this Committee Draft for Vote
(CDV) is submitted for parallel voting.
The CENELEC members are invited to vote through the
CENELEC online voting system.

This document is still under study and subject to change. It should not be used for reference purposes.
Recipients of this document are invited to submit, with their comments, notification of any relevant patent rights of which they are
aware and to provide supporting documentation.

TITLE:
Security for industrial automation and control systems – Part 2-1: Security program requirements for IACS
asset owners

PROPOSED STABILITY DATE: 2024

NOTE FROM TC/SC OFFICERS:


Copyright © 2019 International Electrotechnical Commission, IEC. All rights reserved. It is permitted to download this
electronic file, to make a copy and to print out the content for the sole purpose of preparing National Committee positions.
You may not copy or "mirror" the file or printed version of the document, or any part of it, for any other purpose without
permission in writing from IEC.

---------------------- Page: 3 ----------------------
oSIST prEN IEC 62443-2-1:2019
65/756/CDV – 2 – IEC CDV 62443-2-1 © IEC 2019
CONTENTS

FOREWORD . 9
INTRODUCTION . 11
1 Scope . 13
2 Normative references . 14
3 Terms, definitions, abbreviated terms, acronyms and conventions . 14
3.1 Terms and definitions . 14
3.3 Abbreviated terms and acronyms . 17
4 Concepts . 19
4.1 Use of IEC 62443‑2‑1 . 19
4.1.1 Applicable roles . 19
4.1.2 Use of IEC 62443‑2‑1 by asset owners. 20
4.1.3 Use of IEC 62443‑2‑1 by service providers and product suppliers . 22
4.2 Maturity model . 22
4.3 Security levels (SLs) . 24
4.4 Requirements definitions .
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.

This May Also Interest You

SIST
SIST EN IEC 62443-4-2:2019/AC:2023(Corrigendum)
Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components (IEC 62443-4-2:2019/COR1:2022)
EN IEC 62443-4-2:2019/AC:2022-09

IEC Corrected Version

  • Corrigendum
    3 pages
    French language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62443-3-2:2020(Main)
Security for industrial automation and control systems - Part 3-2: Security risk assessment and system design (IEC 62443-3-2:2020)
EN IEC 62443-3-2:2020

This part of IEC 62443 establishes requirements for:
• defining a system under consideration (SUC) for an industrial automation and control
system (IACS);
• partitioning the SUC into zones and conduits;
• assessing risk for each zone and conduit;
• establishing the target security level (SL-T) for each zone and conduit; and
• documenting the security requirements.

  • Standard
    34 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62443-3-3:2019/AC:2020(Corrigendum)
Industrial communication networks - Network and system security - Part 3-3: System security requirements and security levels (IEC 62443-3-3:2013/COR1:2014)
EN IEC 62443-3-3:2019/AC:2019-10

This part of the IEC 62443 series provides detailed technical control system requirements (SRs) associated with the seven foundational requirements (FRs) described in IEC 62443‑1‑1 including defining the requirements for control system capability security levels, SL-C(control system). These requirements would be used by various members of the industrial automation and control system (IACS) community along with the defined zones and conduits for the system under consideration (SuC) while developing the appropriate control system target SL, SL-T(control system), for a specific asset.
As defined in IEC 62443‑1‑1 there are a total of seven FRs:
a) Identification and authentication control (IAC),
b) Use control (UC),
c) System integrity (SI),
d) Data confidentiality (DC),
e) Restricted data flow (RDF),
f) Timely response to events (TRE), and
g) Resource availability (RA).
These seven requirements are the foundation for control system capability SLs, SL-C (control system). Defining security capability at the control system level is the goal and objective of this standard as opposed to target SLs, SL-T, or achieved SLs, SL-A, which are out of scope.
See IEC 62443‑2‑1 for an equivalent set of non-technical, program-related, capability SRs necessary for fully achieving a control system target SL.

  • Corrigendum
    3 pages
    English language
    sale 10% off
    e-Library read for
    1 day
  • Corrigendum
    3 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62443-2-4:2019/A1:2019(Amendment)
Security for industrial automation and control systems - Part 2-4: Security program requirements for IACS service providers (IEC 62443-2-4:2015/A1:2017)
EN IEC 62443-2-4:2019/A1:2019

This part of IEC 62443 specifies a comprehensive set of requirements for security capabilities
for IACS service providers that they can offer to the asset owner during integration and
maintenance activities of an Automation Solution. Because not all requirements apply to all
industry groups and organizations, Subclause 4.1.4 provides for the development of Profiles
that allow for the subsetting of these requirements. Profiles are used to adapt this document
to specific environments, including environments not based on an IACS.
NOTE 1 The term “Automation Solution” is used as a proper noun (and therefore capitalized) in this part of
IEC 62443 to prevent confusion with other uses of this term.
Collectively, the security capabilities offered by an IACS service provider are referred to as its
Security Program. In a related specification, IEC 62443-2-1 describes requirements for the
Security Management System of the asset owner.
NOTE 2 In general, these security capabilities are policy, procedure, practice and personnel related.
Figure 2 illustrates how the integration and maintenance capabilities relate to the IACS and
the control system product that is integrated into the Automation Solution. Some of these
capabilities reference security measures defined in IEC 62443-3-3 that the service provider
must ensure are supported in the Automation Solution (either included in the control system
product or separately added to the Automation Solution).

  • Amendment
    25 pages
    English language
    sale 10% off
    e-Library read for
    1 day
  • Draft
    21 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62443-3-3:2019(Main)
Industrial communication networks - Network and system security - Part 3-3: System security requirements and security levels (IEC 62443-3-3:2013)
EN IEC 62443-3-3:2019

This part of the IEC 62443 series provides detailed technical control system requirements (SRs) associated with the seven foundational requirements (FRs) described in IEC 62443‑1‑1 including defining the requirements for control system capability security levels, SL-C(control system). These requirements would be used by various members of the industrial automation and control system (IACS) community along with the defined zones and conduits for the system under consideration (SuC) while developing the appropriate control system target SL, SL-T(control system), for a specific asset.
As defined in IEC 62443‑1‑1 there are a total of seven FRs:
a) Identification and authentication control (IAC),
b) Use control (UC),
c) System integrity (SI),
d) Data confidentiality (DC),
e) Restricted data flow (RDF),
f) Timely response to events (TRE), and
g) Resource availability (RA).
These seven requirements are the foundation for control system capability SLs, SL-C (control system). Defining security capability at the control system level is the goal and objective of this standard as opposed to target SLs, SL-T, or achieved SLs, SL-A, which are out of scope.
See IEC 62443‑2‑1 for an equivalent set of non-technical, program-related, capability SRs necessary for fully achieving a control system target SL.

  • Standard
    83 pages
    English language
    sale 10% off
    e-Library read for
    1 day
  • Draft
    83 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62443-2-4:2019(Main)
Security for industrial automation and control systems - Part 2-4: Security program requirements for IACS service providers (IEC 62443-2-4:2015)
EN IEC 62443-2-4:2019

This part of IEC 62443 specifies a comprehensive set of requirements for security capabilities
for IACS service providers that they can offer to the asset owner during integration and
maintenance activities of an Automation Solution. Because not all requirements apply to all
industry groups and organizations, Subclause 4.1.4 provides for the development of Profiles
that allow for the subsetting of these requirements. Profiles are used to adapt this document
to specific environments, including environments not based on an IACS.
NOTE 1 The term “Automation Solution” is used as a proper noun (and therefore capitalized) in this part of
IEC 62443 to prevent confusion with other uses of this term.
Collectively, the security capabilities offered by an IACS service provider are referred to as its
Security Program. In a related specification, IEC 62443-2-1 describes requirements for the
Security Management System of the asset owner.
NOTE 2 In general, these security capabilities are policy, procedure, practice and personnel related.
Figure 2 illustrates how the integration and maintenance capabilities relate to the IACS and
the control system product that is integrated into the Automation Solution. Some of these
capabilities reference security measures defined in IEC 62443-3-3 that the service provider
must ensure are supported in the Automation Solution (either included in the control system
product or separately added to the Automation Solution).

  • Standard
    89 pages
    English language
    sale 10% off
    e-Library read for
    1 day
  • Standard
    89 pages
    English language
    sale 10% off
    e-Library read for
    1 day
  • Standard
    89 pages
    English language
    sale 10% off
    e-Library read for
    1 day
  • Draft
    89 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62443-4-2:2019(Main)
Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components (IEC 62443-4-2:2019)
EN IEC 62443-4-2:2019

This document provides detailed technical control system component requirements (CRs) associated with the seven foundational requirements (FRs) described in IEC TS 62443- 1-1 including defining the requirements for control system capability security levels and their components, SL-C(component). As defined in IEC TS 62443-1-1 there are a total of seven foundational requirements (FRs): a) identification and authentication control (IAC), b) use control (UC), c) system integrity (SI), d) data confidentiality (DC), e) restricted data flow (RDF), f) timely response to events (TRE), and g) resource availability (RA). These seven FRs are the foundation for defining control system security capability levels. Defining security capability levels for the control system component is the goal and objective of this document as opposed to SL-T or achieved SLs (SL-A), which are out of scope.

  • Standard
    97 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62443-4-1:2018(Main)
Security for industrial automation and control systems - Part 4-1: Secure product development lifecycle requirements (IEC 62443-4-1:2018)
EN IEC 62443-4-1:2018

This part of IEC 62443 specifies process requirements for the secure development of
products used in industrial automation and control systems. It defines a secure development
life-cycle (SDL) for the purpose of developing and maintaining secure products. This life-cycle
includes security requirements definition, secure design, secure implementation (including
coding guidelines), verification and validation, defect management, patch management and
product end-of-life. These requirements can be applied to new or existing processes for
developing, maintaining and retiring hardware, software or firmware for new or existing
products. These requirements apply to the developer and maintainer of the product, but not to
the integrator or user of the product. A summary list of the requirements in this document can
be found in Annex B.

  • Standard
    57 pages
    English language
    sale 10% off
    e-Library read for
    1 day
  • Standard
    57 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62443-2-4:2024(Main)
Security for industrial automation and control systems - Part 2-4: Security program requirements for IACS service providers (IEC 62443-2-4:2023)
EN IEC 62443-2-4:2024

IEC 62443-2:2023 specifies a comprehensive set of requirements for security-related processes that IACS service providers can offer to the asset owner during integration and maintenance activities of an Automation Solution. Because not all requirements apply to all industry groups and organizations, Subclause 4.1.4 provides for the development of "profiles" that allow for the subsetting of these requirements. Profiles are used to adapt this document to specific environments, including environments not based on an IACS.
NOTE 1 The term "Automation Solution" is used as a proper noun (and therefore capitalized) in this document to prevent confusion with other uses of this term. Collectively, the security processes offered by an IACS service provider are referred to as its Security Program (SP) for IACS asset owners. In a related specification, IEC 62443-2-1 describes requirements for the Security Management System of the asset owner.
NOTE 2 In general, these security capabilities are policy, procedure, practice and personnel related. Figure 1 illustrates the integration and maintenance security processes of the asset owner, service provider(s), and product supplier(s) of an IACS and their relationships to each other and to the Automation Solution. Some of the requirements of this document relating to the safety program are associated with security requirements described in IEC 62443-3-3 and IEC 62443-4-2.
NOTE 3 The IACS is a combination of the Automation Solution and the organizational measures necessary for its design, deployment, operation, and maintenance.
NOTE 4 Maintenance of legacy system with insufficient security technical capabilities, implementation of policies, processes and procedures can be addressed through risk mitigation.

  • Draft
    93 pages
    English language
    sale 10% off
    e-Library read for
    1 day
SIST
SIST EN IEC 62443-4-2:2019/AC:2023(Corrigendum)
Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components (IEC 62443-4-2:2019/COR1:2022)
EN IEC 62443-4-2:2019/AC:2022-09

IEC Corrected Version

  • Corrigendum
    3 pages
    French language
    sale 10% off
    e-Library read for
    1 day