Requirement
In addition to the ECC controls 1-6-2 and 1-6-3, cybersecurity requirements in OT/ICS change management must include, at a minimum, the following:
Sub-Controls
1-5-3-1
Requirement: Cybersecurity requirements are part of the change management lifecycle.
1-5-3-2
Requirement: Changes are validated in a separate environment prior to implementing the changes on the production environment.
1-5-3-3
Requirement: In the event that OT/ICS devices are replaced with different, but functionally equivalent devices, whether in design, testing, or operation environments, the cybersecurity of the replacement device must be validated prior to being utilized in operational environment.
1-5-3-4
Requirement: Restricted processes for exceptional changes must be implemented.
1-5-3-5
Requirement: Automated configuration and asset change detection mechanisms must be implemented.
References
- ECC – 2:2024 equivalent: 1-6-2
- ECC – 2:2024 equivalent: 1-6-3
