Requirement
In addition to subcontrols in the ECC control 2-12-3, cybersecurity requirements for cybersecurity event logs and monitoring management in OT/ICS must include, at a minimum, the following:
Sub-Controls
2-11-1-1
Requirement: Cybersecurity event logs and audit trails must be activated for all OT/ICS assets.
2-11-1-2
Requirement: Failure attempts in accessing the organization's monitoring systems must be detected and logged.
2-11-1-3
Requirement: Continuous, in-depth cybersecurity log review and monitoring, covering all logs and audit trails must be conducted.
2-11-1-4
Requirement: Monitoring, detecting, and analyzing User Behaviors Analytics (UBA) must be performed.
2-11-1-5
Requirement: Upload or download activities of OT/ICS assets including Safety Instrumented Systems (SIS) must be detected.
2-11-1-6
Requirement: All remote access sessions must be monitored.
2-11-1-7
Requirement: Malicious events must be detected and analyzed.
2-11-1-8
Requirement: Logging and monitoring of new alerts when new or unauthorized devices are connected to the OT/ICS networks must be performed.
2-11-1-9
Requirement: OT/ICS Threat Intelligence must be used and incorporated to regularly tune and refresh alerts of Security Information and Event Management (SIEM) technologies.
2-11-1-10
Requirement: All access control points between the network security boundaries and external connections must be monitored.
References
- ECC – 2:2024 equivalent: 2-12-3
