Requirement
In addition to subcontrols in ECC control 2-5-3, cybersecurity requirements for network security management in OT/ICS environment must cover, at a minimum, the following:
Sub-Controls
2-4-1-1
Requirement: OT/ICS environment must be segmented logically or physically from other environments or networks.
2-4-1-2
Requirement: Different zones within the OT/ICS environment must be segmented logically or physically in accordance with the zone's appropriate level that isolates data flows and directs traffic to "Choke Points".
2-4-1-3
Requirement: Safety Instrumented Systems (SIS) must be segmented logically or physically from other OT/ICS networks.
2-4-1-4
Requirement: Wireless technologies (such as Wi-Fi, Bluetooth, cellular, satellite, etc.) must be restricted, and to only be used when the technology meets specific business requirements and is properly secured.
2-4-1-5
Requirement: Wireless technologies must be segmented logically or physically from other OT/ICS networks.
2-4-1-6
Requirement: Network communications, services, and connection points between different zones must be limited to the minimum to meet operational, maintenance, and safety requirements.
2-4-1-7
Requirement: Direct exposure of common remote authentication and access management services on external-facing hosts must be prevented.
2-4-1-8
Requirement: Only authorized business-critical services are accessible from the internal OT/ICS networks, and accessibility to services with known vulnerabilities must be limited to the greatest extent possible.
2-4-1-9
Requirement: Direct communications between corporate zone and OT/ICS zones must be prevented, and direct all the required connections through dedicated, secured, and hardened jump host/solution in the DMZ zone.
2-4-1-10
Requirement: Remote access point in the DMZ zone must not be connected to the OT/ICS networks unless needed, while ensuring that the session is multi-factor authenticated, recorded, and established for a defined period of time only.
2-4-1-11
Requirement: Proxies must be employed between the corporate and OT/ICS zones for all machine-to-machine traffic.
2-4-1-12
Requirement: Dedicated gateways must be used to segment OT/ICS networks from corporate zone.
2-4-1-13
Requirement: Dedicated DMZ zone must be used to reside any system that needs services provided by corporate zone.
2-4-1-14
Requirement: Strict limitation on enabling/usage of industrial protocols and ports to the minimum to meet operational, maintenance, and safety requirements.
2-4-1-15
Requirement: Periodic patches and upgrades for production assets must be certified by respective vendor and tested in a separate environment prior to implementation.
2-4-1-16
Requirement: Details related to network architecture and topology, zones, network data flows, connectivity, and interdependencies must be documented, updated, and maintained.
References
- ECC – 2:2024 equivalent: 2-5-3
