Requirement
In addition to subcontrols in the ECC control 2-10-3, cybersecurity requirements for vulnerability management in OT/ICS must cover, at a minimum, the following:
Sub-Controls
2-9-1-1
Requirement: Scope and activities of vulnerability assessments must be defined for OT/ICS environment as part of organization's formal vulnerability management while ensuring limited or no impact on the production environment.
2-9-1-2
Requirement: With reference to the ECC subcontrol 2-10-3-3, remediation of newly discovered critical vulnerabilities presenting significant risks to the OT/ICS environment must be performed in a timely manner.
2-9-1-3
Requirement: With reference to the ECC subcontrol 2-10-3-1, vulnerability assessment for OT/ICS systems must be conducted periodically. [L1: 3 Months | L2: 6 Months | L3: 12 Months]
References
- ECC – 2:2024 equivalent: 2-10-3
