Requirement
In addition to subcontrols in the ECC Control 2-14-3, cybersecurity requirements for physical security in OT/ICS environment must include, at a minimum, the following:
Sub-Controls
2-13-1-1
Requirement: List of personnel with authorized access to facilities and sensitive locations where OT/ICS assets reside must be maintained.
2-13-1-2
Requirement: Real-time physical intrusion detection alarms and surveillance equipment, and proper mechanisms must be implemented to recognize potential intrusions and apply the approved response actions.
2-13-1-3
Requirement: Physical access points and perimeter to sensitive OT/ICS areas shall be protected and ensure continuous monitoring.
2-13-1-4
Requirement: Safeguards, such as locks on cabinets containing control systems or sensitive assets related to OT/ICS, must be utilized to prevent unauthorized access to devices that could provide a mechanism to compromise the OT/ICS assets.
2-13-1-5
Requirement: Strict limitation must be enforced on the physical access to all OT/ICS assets, including Safety Instrumented Systems (SIS).
2-13-1-6
Requirement: Visitor access records to restricted locations where OT/ICS reside must be maintained.
2-13-1-7
Requirement: Work being performed by contractor or vendor personnel must be monitored.
2-13-1-8
Requirement: Trainings and skillsets for the organizational security guards must be provided in line with roles and responsibilities with respect to OT/ICS physical security.
2-13-1-9
Requirement: Physical security capabilities and readiness must be periodically tested by performing simulation exercises (such as social engineering).
References
- ECC – 2:2024 equivalent: 2-14-3
