Requirement
In addition to subcontrols in the ECC control 2-3-3, cybersecurity requirements for system and processing facility protection in OT/ICS environment must include, at a minimum, the following:
Sub-Controls
2-3-1-1
Requirement: Advanced, up-to-date protection mechanisms and techniques must be utilized and securely managed to block and protect from malware, Advanced Persistent Threats (APT), malicious files, and activities.
2-3-1-2
Requirement: Periodic security configurations' review and hardening must be conducted in alignment with the vendor implementation guidance or recommendations with respect to cybersecurity and organization's formal change management mechanisms.
2-3-1-3
Requirement: Periodic security patches and upgrades must be implemented in alignment with vendor implementation guidance or recommendations with respect to cybersecurity and organization's formal change management mechanisms.
2-3-1-4
Requirement: Principles of least privilege and least functionality must be applied.
2-3-1-5
Requirement: Safety Instrumented Systems (SIS) controllers must be configured in appropriate modes at all times, which prevent any unauthorized changes, and changes to improper modes are limited to exceptional cases with a specific period of time.
2-3-1-6
Requirement: Application whitelisting techniques or other similar techniques must be deployed to limit the applications that are allowed to run in OT/ICS environment.
2-3-1-7
Requirement: OT/ICS assets must be managed through dedicated, segmented and hardened Engineering Workstation (EWS) and Human-Machine Interface (HMI) for management purposes and maintenance.
2-3-1-8
Requirement: External storage media is scanned and analyzed against malware and APT. The scan must be executed in an isolated and secure environment.
2-3-1-9
Requirement: Usage of external storage media in the production environment must be restricted unless secure mechanisms for data transfer are developed and properly implemented.
2-3-1-10
Requirement: Systems' logs and critical files must be protected from unauthorized access, tampering, illegitimate modification and/or deletion.
2-3-1-11
Requirement: Unauthorized applications, scripts, tasks, and changes must be detected and analyzed.
2-3-1-12
Requirement: New communications sessions and commands execution must be detected and analyzed.
2-3-1-13
Requirement: Direct communications between the OT/ICS environment and external hosts must be detected and analyzed.
References
- ECC – 2:2024 equivalent: 2-3-3
