Requirement
In addition to the subcontrols in the ECC control 2-11-3, cybersecurity requirements for penetration testing in OT/ICS must cover, at a minimum, the following:
Sub-Controls
2-10-1-1
Requirement: With reference to the ECC subcontrol 2-11-3-1, scope and activities of penetration testing must be defined to ensure the coverage of OT/ICS environment and networks connected to the operational network by qualified team.
2-10-1-2
Requirement: With reference to the ECC subcontrol 2-11-3-2, penetration testing must only be conducted with limited or no impact on the production environment, or on an identical separate environment.
2-10-1-3
Requirement: With reference to the ECC subcontrol 2-11-3-2, penetration testing for OT/ICS systems must be conducted periodically. [L1: 3 Months | L2: 6 Months | L3: 12 Months]
2-10-1-4
Requirement: Alternative testing methods (such as passive testing mechanisms) must be defined and Implemented to collect relevant information when a potential impact to operational production environment may occur.
References
- ECC – 2:2024 equivalent: 2-11-3
