Requirement
In addition to subcontrols in the ECC control 2-6-3, cybersecurity requirements for mobile device security in OT/ICS must cover, at a minimum, the following:
Sub-Controls
2-5-1-1
Requirement: Usage of mobile devices for OT/ICS must be restricted unless specifically required. A cybersecurity risk assessment must be conducted where risks must be defined and managed. A management approval must be granted by respective cybersecurity function for a defined period of time only in alignment with organization's formal access management mechanisms.
2-5-1-2
Requirement: Mobile devices must only be used for their intended purposes and in compliance with cybersecurity requirements of its respective zones prior to being connected to OT/ICS environment, and are hardened and updated with the latest security patches and scanned against malware and APT.
2-5-1-3
Requirement: Limited and approved list of mobile devices must be defined while ensuring that only these mobile devices can be connected to OT/ICS environment.
2-5-1-4
Requirement: Centralized management of mobile devices must be deployed.
2-5-1-5
Requirement: Encryptions mechanisms must be used for mobile devices authorized to access the OT/ICS assets.
References
- ECC – 2:2024 equivalent: 2-6-3
