Requirement
In addition to subcontrols in the ECC Control 2-13-3, cybersecurity requirements for cybersecurity incident and threat management in OT/ICS must include, at a minimum, the following:
Sub-Controls
2-12-1-1
Requirement: OT/ICS cybersecurity incident response plans must be integrated and aligned with organizational plans and its procedures such as IT incident response plans, crisis management, and Business Continuity Plan (BCP).
2-12-1-2
Requirement: Formal incident response and root cause analysis for any detected cybersecurity incidents must be conducted.
2-12-1-3
Requirement: Sequence of incident response activities necessary to restore normal operations must be defined.
2-12-1-4
Requirement: Incident communications plan must be established.
2-12-1-5
Requirement: OT/ICS including Safety Instrumented Systems (SIS) recovery procedures must be included in the incident response, system recovery plans, and business continuity plans.
2-12-1-6
Requirement: Trainings and skillsets for the organization's personnel (including employees, contractors and subcontractors) to respond to OT/ICS cybersecurity incidents must be provided.
2-12-1-7
Requirement: Cybersecurity incident response capabilities, readiness, and plan must be periodically tested by performing cyber-attack simulations exercises.
2-12-1-8
Requirement: Threat Intelligence information must be used to identify Tactics, Techniques, and Procedures (TTPs) of activity groups targeting OT/ICS systems.
References
- ECC – 2:2024 equivalent: 2-13-3
