Requirement
In addition to the ECC subdomain 1-5, cybersecurity requirements for cybersecurity risk management in OT/ICS must include, at a minimum, the following:
Sub-Controls
1-3-1-1
Requirement: OT/ICS cybersecurity risk management methodology must be included as part of the organization's risk management and safety risk management methodologies.
1-3-1-2
Requirement: Cybersecurity risk assessment for OT/ICS assets must be conducted periodically while ensuring to include risks associated with signing contracts and agreements with OT/ICS related third-party organizations and/or upon changes in related regulatory requirements as part of the assessment.
1-3-1-3
Requirement: Risk register for OT/ICS cybersecurity risks must be included as part of the organization's risk register.
1-3-1-4
Requirement: Appropriate level assignment to facilities which include (OT/ICS) must be conducted based on approved methodology.
1-3-1-5
Requirement: Include a qualitative analysis of cybersecurity risks within the Process Hazard Analysis (PHA) which is applied with any change in operations and/or procedures in Plants.
1-3-1-6
Requirement: In the event that cybersecurity requirements cannot be implemented within the OT/ICS environment, the specific justifications for not applying those requirements must be documented and approved by the respective cybersecurity function and the Authorizing Official.
1-3-1-7
Requirement: In the event of risk acceptance, alternative cybersecurity controls must be clearly defined, documented, approved by the Authorizing Official, and implemented effectively for a defined-period of time while reassessing the risk continuously.
References
- ECC – 2:2024 equivalent: 1-5
