Operational Technology Cybersecurity Controls (OTCC – 1 : 2022) Handbook

• Cybersecurity Policies and Procedures

  Ensures OT/ICS cybersecurity requirements are documented, communicated and complied with per related laws, regulations and organizational requirements.

  3 controls

• Cybersecurity Roles and Responsibilities

  Ensures roles and responsibilities are defined for all parties participating in implementing the OTCC within the organization.

  1 control

• Cybersecurity Risk Management

  Ensures cybersecurity risks are managed methodologically to protect the organization's OT/ICS assets per organizational policies and related laws and regulations.

  1 control

• Cybersecurity in Industrial Control System Project Management

  Ensures cybersecurity requirements are included in project management to maintain safe operations and the confidentiality, integrity and availability of OT/ICS assets.

  2 controls

• Cybersecurity in Change Management

  Ensures cybersecurity requirements are included in change management so change requests in the OT/ICS environment are implemented safely with due-diligence analysis and control.

  4 controls

• Periodical Cybersecurity Review and Audit

  Ensures OT/ICS cybersecurity controls are implemented and in compliance with organizational policies and related national and international laws, regulations and agreements.

  2 controls

• Cybersecurity in Human Resources

  Ensures cybersecurity risks and requirements related to OT/ICS personnel are managed efficiently before, during and after employment or separation.

  2 controls

• Cybersecurity Awareness and Training Program

  Ensures personnel are aware of their cybersecurity responsibilities and receive the training, skills and credentials needed to protect the organization's OT/ICS assets.

  2 controls

• Asset Management

  Ensures the organization keeps an accurate, detailed inventory of OT/ICS assets to support cybersecurity and operational requirements and safe, continuous operations.

  2 controls

• Identity and Access Management

  Ensures secure, restricted logical access to OT/ICS assets so that only authorized users gain the access necessary for their assigned tasks.

  2 controls

• System and Processing Facilities Protection

  Ensures OT/ICS systems and processing facilities, including workstations, servers and Safety Instrumented Systems (SIS), are protected against cyber risks.

  2 controls

• Networks Security Management

  Ensures the organization's OT/ICS networks are protected from cyber risks.

  2 controls

• Mobile Devices Security

  Ensures mobile devices such as laptops and handheld configuration or network test devices are protected from cyber risks and sensitive data is handled securely.

  2 controls

• Data and Information Protection

  Ensures the confidentiality, integrity and availability of the organization's data and information per organizational policies and related laws and regulations.

  2 controls

• Cryptography

  Ensures the proper and efficient use of cryptography to protect information assets per organizational policies and related laws and regulations.

  2 controls

• Backup and Recovery Management

  Ensures the organization's data, information, information systems and software configurations are protected from cyber risks through secure backup and recovery.

  2 controls

• Vulnerabilities Management

  Ensures timely detection and effective remediation of technical vulnerabilities to prevent or minimize their exploitation in cyber-attacks against the organization.

  2 controls

• Penetration Testing

  Assesses the organization's cybersecurity defense capabilities through simulated cyber-attacks that uncover unknown weaknesses in the technical infrastructure.

  2 controls

• Cybersecurity Event Logs and Monitoring Management

  Ensures timely collection, analysis and monitoring of cybersecurity events for early detection of potential cyber-attacks on the organization's operations.

  2 controls

• Cybersecurity Incident and Threat Management

  Ensures timely identification, detection and effective handling of cybersecurity incidents and threats affecting the organization's OT/ICS operations.

  2 controls

• Physical Security

  Ensures OT/ICS assets are protected from unauthorized physical access, loss, theft and damage.

  2 controls

• Cybersecurity Resilience Aspects of Business Continuity Management (BCM)

  Ensures cybersecurity resiliency requirements are embedded in business continuity management to minimize the impact of cyber-incident-driven disasters on the OT/ICS environment.

  2 controls

• Third-Party Cybersecurity

  Ensures organizational assets are protected against cybersecurity risks from third parties, including OT/ICS hardware and software manufacturers, product vendors and service suppliers.

  2 controls

Need help putting this into practice? See our NCA OTCC compliance services.