Showing 150 controls
2-1-1-1
OT/ICS assets inventory must be developed in electronic format for all OT/ICS assets, and reviewed periodically.
2-1-1-2
Automated solution to collect asset inventory information must be utilized.
2-1-1-3
OT/ICS asset inventory must be stored securely.
2-1-1-4
Asset owners for all OT/ICS assets must be identified and involved throughout the relevant asset inventory management lifecycle.
2-1-1-5
Criticality rating for all assets must be assigned, documented, and approved by asset owners.
2-1-2
With reference to the ECC control 2-1-6, the cybersecurity requirements for managing OT/ICS assets must be reviewed, and their implementation effectiveness is measured and evaluated periodically.
2-10-1-1
With reference to the ECC subcontrol 2-11-3-1, scope and activities of penetration testing must be defined to ensure the coverage of OT/ICS environment and networks connected to the operational networ...
2-10-1-2
With reference to the ECC subcontrol 2-11-3-2, penetration testing must only be conducted with limited or no impact on the production environment, or on an identical separate environment.
2-10-1-3
With reference to the ECC subcontrol 2-11-3-2, penetration testing for OT/ICS systems must be conducted periodically. Level 1 : 3 Months / Level 2 : 6 Months / Level 3 : 12 Months
2-10-1-4
Alternative testing methods (such as passive testing mechanisms) must be defined and Implemented to collect relevant information when a potential impact to operational production environment may occur...
2-10-2
With reference to the ECC control 2-11-4, the cybersecurity requirements for penetration testing in OT/ICS environment must be reviewed, and their implementation effectiveness is measured and evaluate...
2-11-1-1
Cybersecurity event logs and audit trails must be activated for all OT/ICS assets.
2-11-1-10
All access control points between the network security boundaries and external connections must be monitored.
2-11-1-2
Failure attempts in accessing the organization’s monitor- ing systems must be detected and logged.
2-11-1-3
Continuous, in-depth cybersecurity log review and monitoring, covering all logs and audit trails must be conducted.
2-11-1-4
Monitoring, detecting, and analyzing User Behaviors Analytics (UBA) must be performed.
2-11-1-5
Upload or download activities of OT/ICS assets including Safety Instrumented Systems (SIS) must be detected.
2-11-1-6
All remote access sessions must be monitored.
2-11-1-7
Malicious events must be detected and analyzed.
2-11-1-8
Logging and monitoring of new alerts when new or unauthorized devices are connected to the OT/ICS networks must be performed.
2-11-1-9
OT/ICS Threat Intelligence must be used and incorporated to regularly tune and refresh alerts of Security Information and Event Management (SIEM) technologies.
2-11-2
With reference to the ECC control 2-12-4, the cybersecurity requirements for cybersecurity event logs and monitoring management in OT/ICS environment must be reviewed, and their implementation effecti...
2-12-1-1
OT/ICS cybersecurity incident response plans must be integrated and aligned with organizational plans and its proce- dures such as IT incident response plans, crisis management, and Business Continuit...
2-12-1-2
Formal incident response and root cause analysis for any detected cybersecurity incidents must be conducted.
2-12-1-3
Sequence of incident response activities necessary to restore normal operations must be defined.
2-12-1-4
Incident communications plan must be established.
2-12-1-5
OT/ICS including Safety Instrumented Systems (SIS) recovery procedures must be included in the incident response, system recovery plans, and business continuity plans.
2-12-1-6
Trainings and skillsets for the organization’s personnel (including employees, contractors and subcontractors) to respond to OT/ICS cybersecurity incidents must be provided.
2-12-1-7
Cybersecurity incident response capabilities, readiness, and plan must be periodically tested by performing cyber-attack simulations exercises.
2-12-1-8
Threat Intelligence information must be used to identify Tactics, Techniques, and Procedures (TTPs) of activity groups targeting OT/ICS systems.
2-12-2
With reference to the ECC control 2-13-4, the cybersecurity requirements for cybersecurity incident and threat management in OT/ICS environment must be reviewed, and their implementation effectiveness...
2-13-1-1
List of personnel with authorized access to facilities and sensitive locations where OT/ICS assets reside must be maintained.
2-13-1-2
Real-time physical intrusion detection alarms and surveillance equipment, and proper mechanisms must be implemented to recognize potential intrusions and apply the approved response actions.
2-13-1-3
Physical access points and perimeter to sensitive OT/ICS areas shall be protected and ensure continuous monitoring.
2-13-1-4
Safeguards, such as locks on cabinets containing control systems or sensitive assets related to OT/ICS, must be utilized to prevent unauthorized access to devices that could provide a mechanism to com...
2-13-1-5
Strict limitation must be enforced on the physical access to all OT/ICS assets, including Safety Instrumented Systems (SIS).
2-13-1-6
Visitor access records to restricted locations where OT/ ICS reside must be maintained.
2-13-1-7
Work being performed by contractor or vendor personnel must be monitored.
2-13-1-8
Trainings and skillsets for the organizational security guards must be provided in line with roles and responsibilities with respect to OT/ICS physical security.
2-13-1-9
Physical security capabilities and readiness must be periodically tested by performing simulation exercises (such as social engineering).
2-13-2
With reference to the ECC control 2-14-4, the cybersecurity requirements for physical security in OT/ICS environment must be reviewed, and their implementation effectiveness is measured and evaluated...
2-2-1-1
Identity and access management lifecycle for OT/ICS is separated and independent from Information Technology (IT) including centrally managed identity and access management solutions.
2-2-1-10
With reference to the ECC subcontrol 2-2-3-5, users’ identities and access rights must be reviewed in response to cybersecurity incidents, personnel roles changes, or whenever there is a change in OT/...
2-2-1-11
Access shall be immediately revoked when no longer needed.
2-2-1-2
Service accounts must be managed securely for OT/ICS services, applications, systems, and devices that are separated and disconnected from interactive users account logins.
2-2-1-3
Default credentials for all OT/ICS assets must be changed, disabled, or removed.
2-2-1-4
Sessions must be managed securely, including session authenticity, session lockout, and session timeout termination.
2-2-1-5
Automatic disabling/removing of service accounts, programs, or accounts related to (OT/ICS) assets must be prevented, except for monitoring systems.
2-2-1-6
Dual approval and explicit privilege escalation mechanisms for sensitive actions within the OT/ICS environment must be employed.
2-2-1-7
Remote access to the OT/ICS networks must be restricted and exceptionally enabled when necessary and justified. A cybersecurity risk assessment must be conducted prior to granting a remote access and...
2-2-1-8
Secure and complex password standards must be implemented.
2-2-1-9
Secure mechanisms to store OT/ICS assets’ passwords must be used.
2-2-2
With reference to the ECC control 2-2-4, the cybersecurity requirements for identity and access management in OT/ICS environment must be reviewed, and its implementation effectiveness is measured and...
2-3-1-1
Advanced, up-to-date protection mechanisms and techniques must be utilized and securely managed to block and protect from malware, Advanced Persistent Threats (APT), malicious files, and activities.
2-3-1-10
Systems’ logs and critical files must be protected from unauthorized access, tampering, illegitimate modification and/or deletion.
2-3-1-11
Unauthorized applications, scripts, tasks, and changes must be detected and analyzed.
2-3-1-12
New communications sessions and commands execution must be detected and analyzed.
2-3-1-13
Direct communications between the OT/ICS environment and external hosts must be detected and analyzed.
2-3-1-2
Periodic security configurations’ review and hardening must be conducted in alignment with the vendor implementation guidance or recommendations with respect to cybersecurity and organization’s formal...
2-3-1-3
Periodic security patches and upgrades must be implemented in alignment with vendor implementation guidance or recommendations with respect to cybersecurity and organization’s formal change management...
2-3-1-4
Principles of least privilege and least functionality must be applied.
2-3-1-5
Safety Instrumented Systems (SIS) controllers must be configured in appropriate modes at all times, which prevent any unauthorized changes, and changes to improper modes are limited to exceptional cas...
2-3-1-6
Application whitelisting techniques or other similar techniques must be deployed to limit the applications that are allowed to run in OT/ICS environment.
2-3-1-7
OT/ICS assets must be managed through dedicated, segmented and hardened Engineering Workstation (EWS) and Human-Machine Interface (HMI) for management purposes and maintenance.
2-3-1-8
External storage media is scanned and analyzed against malware and APT. The scan must be executed in an isolated and secure environment.
2-3-1-9
Usage of external storage media in the production en- vironment must be restricted unless secure mechanisms for data transfer are developed and properly implemented.
2-3-2
With reference to the ECC control 2-3-4, the cybersecurity requirements for system and processing facilities protection in OT/ ICS environment must be reviewed, and their implementation effectiveness...
2-4-1-1
OT/ICS environment must be segmented logically or physically from other environments or networks.
2-4-1-10
Remote access point in the DMZ zone must not be connected to the OT/ICS networks unless needed, while ensuring that the session is multi-factor authenticated, recorded, and established for a defined p...
2-4-1-11
Proxies must be employed between the corporate and OT/ICS zones for all machine-to-machine traffic.
2-4-1-12
Dedicated gateways must be used to segment OT/ICS networks from corporate zone.
2-4-1-13
Dedicated DMZ zone must be used to reside any system that needs services provided by corporate zone.
2-4-1-14
Strict limitation on enabling/usage of industrial protocols and ports to the minimum to meet operational, maintenance, and safety requirements.
2-4-1-15
Periodic patches and upgrades for production assets must be certified by respective vendor and tested in a separate environment prior to implementation.
2-4-1-16
Details related to network architecture and topology, zones, network data flows, connectivity, and interdependencies must be documented, updated, and maintained.
2-4-1-2
Different zones within the OT/ICS environment must be segmented logically or physically in accordance with the zone’s ap- propriate level that isolates data flows and directs traffic to "Choke Points”...
2-4-1-3
Safety Instrumented Systems (SIS) must be segmented logically or physically from other OT/ICS networks.
2-4-1-4
Wireless technologies (such as Wi-Fi, Bluetooth, cellular, satellite, etc.) must be restricted, and to only be used when the technology meets specific business requirements and is properly secured.
2-4-1-5
Wireless technologies must be segmented logically or physically from other OT/ICS networks.
2-4-1-6
Network communications, services, and connection points between different zones must be limited to the minimum to meet operational, maintenance, and safety requirements.
2-4-1-7
Direct exposure of common remote authentication and access management services on external-facing hosts must be prevented.
2-4-1-8
Only authorized business-critical services are accessible from the internal OT/ICS networks, and accessibility to services with known vulnerabilities must be limited to the greatest extent possible.
2-4-1-9
Direct communications between corporate zone and OT/ ICS zones must be prevented, and direct all the required connections through dedicated, secured, and hardened jump host/solution in the DMZ zone.
2-4-2
With reference to the ECC control 2-5-4, the cybersecurity requirements for network security management in OT/ICS environment must be reviewed, and their implementation effectiveness is measured and e...
2-5-1-1
Usage of mobile devices for OT/ICS must be restricted unless specifically required. A cybersecurity risk assessment must be conducted where risks must be defined and managed. A management approval mus...
2-5-1-2
Mobile devices must only be used for their intended purposes and in compliance with cybersecurity requirements of its respective zones prior to being connected to OT/ICS environment, and are hardened...
2-5-1-3
Limited and approved list of mobile devices must be defined while ensuring that only these mobile devices can be connected to OT/ICS environment.
2-5-1-4
Centralized management of mobile devices must be deployed.
2-5-1-5
Encryptions mechanisms must be used for mobile devices authorized to access the OT/ICS assets.
2-5-2
With reference to the ECC control 2-6-4, the cybersecurity requirements for mobile devices security in OT/ICS environment must be reviewed, and their implementation effectiveness is measured and evalu...
2-6-1-1
Electronic and physical data (at rest and in transit) must be protected at a level consistent with its classification.
2-6-1-2
Data Leakage Prevention (DLP) mechanisms must be used to protect the classified data and information.
2-6-1-3
Secure wiping mechanisms for configuration details and stored data from OT/ICS assets prior to decommissioning must be implemented.
2-6-1-4
Transfer or usage of OT systems’ data in any environment other than production environment must be limited, except after applying strict controls for protecting that data.
2-6-2
With reference to the ECC control 2-7-4, the cybersecurity requirements for data and information protection in OT/ICS environment must be reviewed, and their implementation effectiveness is measured a...
2-7-1
In addition to subcontrols in the ECC control 2-8-3, the organization must ensure that cryptographic technologies used in OT/ICS environment are aligned with the NCA National Cryptographic Standard (N...
2-7-2
With reference to the ECC control 2-8-4, the cybersecurity requirements for cryptography in OT/ICS environment must be re- viewed, and their implementation effectiveness is measured and evaluated peri...
2-8-1-1
Backups for all OT/ICS assets must be covered and stored in centralized and offline locations.
2-8-1-2
OT/ICS assets’ critical configuration files and engineering files must be included in the backup’s scope.
2-8-1-3
Backups must be performed periodically as per the defined OT/ICS assets classification and their associated risks.
2-8-1-4
Access, storage, and transfer of backups and their mediums must be secured to ensure their protection against damage, change, or unauthorized access.
2-8-2
With reference to the ECC control 2-9-4, the cybersecurity requirements for backup and recovery management in OT/ICS envi- ronment must be reviewed, and their implementation effectiveness is measured...
2-9-1-1
Scope and activities of vulnerability assessments must be defined for OT/ICS environment as part of organization’s formal vulnerability management while ensuring limited or no impact on the production...
2-9-1-2
With reference to the ECC subcontrol 2-10-3-3, remediation of newly discovered critical vulnerabilities presenting significant risks to the OT/ICS environment must be performed in a timely manner.
2-9-1-3
With reference to the ECC subcontrol 2-10-3-1, vulnerability assessment for OT/ICS systems must be conducted periodically. Level 1 : 3 Months / Level 2 : 6 Months / Level 3 : 12 Months
2-9-2
With reference to the ECC control 2-10-4, the cybersecurity requirements for vulnerability management in OT/ICS environment must be reviewed, and their implementation effectiveness is measured and eva...
1-1-1
With reference to the ECC controls 1-3-1 and 1-3-2, the organization must document, approve, and implement a customized set of cybersecurity policies and procedures for OT/ICS systems or assets.
1-1-2
With reference to the ECC control 1-3-3, the cybersecurity OT/ ICS policies and procedures must be supported by cybersecurity requirements such as vendor recommendations, implementation guidelines, an...
1-1-3
With reference to the ECC control 1-3-4, OT/ICS cybersecurity policies and procedures must be reviewed periodically and/ or when there is a change in the risks landscape, organizational structure, and...
1-2-1-1
Cybersecurity roles and responsibilities (RACI) assignment for all stakeholders of the OT/ICS assets must be defined, documented, communicated and approved by the Authorizing Official while ensuring t...
1-2-1-2
Cybersecurity roles and responsibilities related to OT/ ICS assets must be assigned to the cybersecurity function in the organization.
1-3-1-1
OT/ICS cybersecurity risk management methodology must be included as part of the organization’s risk management and safety risk management methodologies.
1-3-1-2
Cybersecurity risk assessment for OT/ICS assets must be conducted periodically while ensuring to include risks associ- ated with signing contracts and agreements with OT/ICS related third-party organi...
1-3-1-3
Risk register for OT/ICS cybersecurity risks must be included as part of the organization’s risk register.
1-3-1-4
Appropriate level assignment to facilities which include (OT/ICS) must be conducted based on approved methodology.
1-3-1-5
Include a qualitative analysis of cybersecurity risks within the Process Hazard Analysis (PHA) which is applied with any change in operations and/or procedures in Plants.
1-3-1-6
In the event that cybersecurity requirements cannot be implemented within the OT/ICS environment, the specific justifications for not applying those requirements must be documented and approved by the...
1-3-1-7
In the event of risk acceptance, alternative cybersecurity controls must be clearly defined, documented, approved by the Authorizing Official, and implemented effectively for a defined period of time...
1-4-1-1
Cybersecurity requirements must be part of OT/ICS project’s lifecycle.
1-4-1-2
Cybersecurity requirements must be included as part of any functional and acceptance testing and evaluation process (such as Factory Acceptance Testing “FAT” , Site Acceptance Test- ing “SAT”, Commiss...
1-4-1-3
Secure-by-design principles must be included as part of security architectural designs for OT/ICS environments.
1-4-1-4
System development environments including testing environment and integration platforms must be protected.
1-4-2
Cybersecurity requirements within the organization’s OT/ICS project management must be reviewed, and their implementation effectiveness is measured and evaluated periodically.
1-5-1
Cybersecurity requirements within the organization’s OT/ICS change management must be defined, documented, and approved. The cybersecurity requirements must be a key part of the overall requirements o...
1-5-2
Cybersecurity requirements within the organization’s OT/ICS change management lifecycle must be implemented.
1-5-3-1
Cybersecurity requirements are part of the change management lifecycle.
1-5-3-2
Changes are validated in a separate environment prior to implementing the changes on the production environment.
1-5-3-3
In the event that OT/ICS devices are replaced with differ- ent, but functionally equivalent devices, whether in design, testing, or operation environments, the cybersecurity of the replacement device...
1-5-3-4
Restricted processes for exceptional changes must be implemented.
1-5-3-5
Automated configuration and asset change detection mechanisms must be implemented.
1-5-4
Cybersecurity requirements within the organization’s OT/ICS change management requirements must be reviewed, and their implementation effectiveness is measured and evaluated periodically.
1-6-1
With reference to ECC control 1-8-1, the organization’s cybersecu- rity function must review the implementation of (OTCC-1:2022) controls at least annually.
1-6-2
With reference to ECC control 1-8-2, the implementation of (OTCC-1:2022) controls must be reviewed by independent parties within the organization, outside the cybersecurity function at least once ever...
1-7-1
In addition to subcontrols in the ECC control 1-9-3, cybersecurity requirements related to human resources for OT/ICS environment must include, at a minimum, screening or vetting of all personnel (inc...
1-7-2
With reference to the ECC control 1-9-6, the cybersecurity re- quirements for cybersecurity in human resources in OT/ICS must be reviewed, and their implementation effectiveness is measured and evalua...
1-8-1
In addition to subcontrols in the ECC control 1-10-3, the cybersecurity awareness program must include a secure and safe interaction with the OT/ICS assets or systems.
1-8-2-1
Customized training, qualifications, knowledge, and professional skillsets must be provided to all personnel with access to the OT/ICS assets. The organization is encouraged to utilize the reference m...
1-8-2-2
Participation in OT/ICS authorized and/or specialized organizations and groups must be encouraged to stay up-to-date on common cybersecurity practices.
3-1-1-1
Activities necessary to sustain minimum operations of the OT/ICS systems must be defined.
3-1-1-2
Redundant OT/ICS networks, connections, and devices must be implemented in accordance to the periodic cybersecurity risk assessment.
3-1-1-3
OT/ICS cybersecurity requirements must be incorporated into the Business Continuity Plan (BCP), Business Impact Analysis (BIA), Recovery Time Objectives (RTO), and Recovery Point Objectives (RPO).
3-1-1-4
OT/ICS cybersecurity requirements must be incorporated into the Disaster Recovery Plan (DRP) including cybersecurity-related disaster scenarios, system failure handling procedures, and operational con...
3-1-1-5
In the event of a system failure due to a cybersecurity incident, OT/ICS assets or systems must operate on an acceptable safe mode to achieve a continuous operation.
3-1-1-6
Periodic testing and simulation exercises (e.g. tabletop exercises "TTX”) must be conducted to test the effectiveness of OT/ICS related DRP and BCP and complete incident root cause analysis.
3-1-2
With reference to the ECC control 3-1-4, the cybersecurity requirements for cybersecurity resilience aspects of business continuity management in OT/ICS environment must be reviewed, and their impleme...
4-1-1-1
Cybersecurity requirements are included during procurement lifecycle for OT/ICS products and services.
4-1-1-2
Cybersecurity requirements for third-party evaluation, selection, and information sharing must be defined.
4-1-1-3
Third-party contractors and vendors must use formal and documented Secure Development Life Cycle (SDLC) practices for systems and components designed or deployed in OT/ICS environment.
4-1-1-4
Periodic cybersecurity assessment and audits of third-party providers must be conducted to ensure the mitigation of any identified cyber threats.
4-1-2
With reference to the ECC control 4-1-4, the cybersecurity requirements for third-party cybersecurity in OT/ICS environment must be reviewed, and their implementation effectiveness is measured and eva...