Requirement
In addition to subcontrols in the ECC control 3-1-3, cybersecurity requirements for cybersecurity resilience aspects of business continuity management in OT/ICS must include, at a minimum, the following:
Sub-Controls
3-1-1-1
Requirement: Activities necessary to sustain minimum operations of the OT/ICS systems must be defined.
3-1-1-2
Requirement: Redundant OT/ICS networks, connections, and devices must be implemented in accordance to the periodic cybersecurity risk assessment.
3-1-1-3
Requirement: OT/ICS cybersecurity requirements must be incorporated into the Business Continuity Plan (BCP), Business Impact Analysis (BIA), Recovery Time Objectives (RTO), and Recovery Point Objectives (RPO).
3-1-1-4
Requirement: OT/ICS cybersecurity requirements must be incorporated into the Disaster Recovery Plan (DRP) including cybersecurity-related disaster scenarios, system failure handling procedures, and operational continuity management procedures.
3-1-1-5
Requirement: In the event of a system failure due to a cybersecurity incident, OT/ICS assets or systems must operate on an acceptable safe mode to achieve a continuous operation.
3-1-1-6
Requirement: Periodic testing and simulation exercises (e.g. tabletop exercises "TTX") must be conducted to test the effectiveness of OT/ICS related DRP and BCP and complete incident root cause analysis.
References
- ECC – 2:2024 equivalent: 3-1-3
