{"id":244123,"date":"2024-10-19T16:01:57","date_gmt":"2024-10-19T16:01:57","guid":{"rendered":"https:\/\/pdfstandards.shop\/product\/uncategorized\/bs-en-62443-2-12010\/"},"modified":"2024-10-25T11:00:32","modified_gmt":"2024-10-25T11:00:32","slug":"bs-en-62443-2-12010","status":"publish","type":"product","link":"https:\/\/pdfstandards.shop\/product\/publishers\/bsi\/bs-en-62443-2-12010\/","title":{"rendered":"BS EN 62443-2-1:2010"},"content":{"rendered":"
IEC 62443-2-1:2010 defines the elements necessary to establish a cyber security management system (CSMS) for industrial automation and control systems (IACS) and provides guidance on how to develop those elements. This standard uses the broad definition and scope of what constitutes an IACS described in IEC\/TS 62443-1-1. The elements of a CSMS described in this standard are mostly policy, procedure, practice and personnel related, describing what shall or should be included in the final CSMS for the organization. This bilingual version (2012-04) corresponds to the monolingual English version, published in 2010-11.<\/p>\n
PDF Pages<\/th>\n | PDF Title<\/th>\n<\/tr>\n | ||||||
---|---|---|---|---|---|---|---|
4<\/td>\n | CONTENTS <\/td>\n<\/tr>\n | ||||||
7<\/td>\n | FOREWORD <\/td>\n<\/tr>\n | ||||||
9<\/td>\n | 0 INTRODUCTION 0.1 Overview 0.2 A cyber security management system for IACS 0.3 Relationship between this standard and ISO\/IEC 17799 and ISO\/IEC 27001 <\/td>\n<\/tr>\n | ||||||
11<\/td>\n | 1 Scope 2 Normative references 3 Terms, definitions, abbreviated terms, acronyms, and conventions 3.1 Terms and definitions <\/td>\n<\/tr>\n | ||||||
16<\/td>\n | 3.2 Abbreviated terms and acronyms <\/td>\n<\/tr>\n | ||||||
18<\/td>\n | 3.3 Conventions 4 Elements of a cyber security management system 4.1 Overview <\/td>\n<\/tr>\n | ||||||
19<\/td>\n | Figures Figure 1 \u2013 Graphical view of elements of a cyber security management system <\/td>\n<\/tr>\n | ||||||
20<\/td>\n | 4.2 Category: Risk analysis Figure 2 \u2013 Graphical view of category: Risk analysis Tables Table 1 \u2013 Business rationale: Requirements <\/td>\n<\/tr>\n | ||||||
21<\/td>\n | Table 2 \u2013 Risk identification, classification and assessment: Requirements <\/td>\n<\/tr>\n | ||||||
22<\/td>\n | 4.3 Category: Addressing risk with the CSMS Figure 3 \u2013 Graphical view of element group:Security policy, organization and awareness <\/td>\n<\/tr>\n | ||||||
23<\/td>\n | Table 3 \u2013 CSMS scope: Requirements <\/td>\n<\/tr>\n | ||||||
24<\/td>\n | Table 4 \u2013 Organizing for security: Requirements Table 5 \u2013 Staff training and security awareness: Requirements <\/td>\n<\/tr>\n | ||||||
25<\/td>\n | Table 6 \u2013 Business continuity plan: Requirements <\/td>\n<\/tr>\n | ||||||
26<\/td>\n | Table 7 \u2013 Security policies and procedures: Requirements <\/td>\n<\/tr>\n | ||||||
27<\/td>\n | Figure 4 \u2013 Graphical view of element group: Selected security countermeasures <\/td>\n<\/tr>\n | ||||||
28<\/td>\n | Table 8 \u2013 Personnel security: Requirements <\/td>\n<\/tr>\n | ||||||
29<\/td>\n | Table 9 \u2013 Physical and environmental security: Requirements <\/td>\n<\/tr>\n | ||||||
30<\/td>\n | Table 10 \u2013 Network segmentation: Requirements <\/td>\n<\/tr>\n | ||||||
31<\/td>\n | Table 11 \u2013 Access control \u2013 Account administration: Requirements <\/td>\n<\/tr>\n | ||||||
32<\/td>\n | Table 12 \u2013 Access control \u2013 Authentication: Requirements <\/td>\n<\/tr>\n | ||||||
33<\/td>\n | Table 13 \u2013 Access control \u2013 Authorization: Requirements <\/td>\n<\/tr>\n | ||||||
34<\/td>\n | Figure 5 \u2013 Graphical view of element group: Implementation <\/td>\n<\/tr>\n | ||||||
35<\/td>\n | Table 14 \u2013 Risk management and implementation: Requirements Table 15 \u2013 System development and maintenance: Requirements <\/td>\n<\/tr>\n | ||||||
36<\/td>\n | Table 16 \u2013 Information and document management: Requirements <\/td>\n<\/tr>\n | ||||||
37<\/td>\n | Table 17 \u2013 Incident planning and response: Requirements <\/td>\n<\/tr>\n | ||||||
38<\/td>\n | 4.4 Category: Monitoring and improving the CSMS Figure 6 \u2013 Graphical view of category: Monitoring and improving the CSMS <\/td>\n<\/tr>\n | ||||||
39<\/td>\n | Table 18 \u2013 Conformance: Requirements <\/td>\n<\/tr>\n | ||||||
40<\/td>\n | Table 19 \u2013 Review, improve and maintain the CSMS: Requirements <\/td>\n<\/tr>\n | ||||||
41<\/td>\n | Annex A (informative) Guidance for developing the elements of a CSMS <\/td>\n<\/tr>\n | ||||||
42<\/td>\n | Figure A.1 \u2013 Graphical view of elements of a cyber security management system Figure A.2 \u2013 Graphical view of category: Risk analysis <\/td>\n<\/tr>\n | ||||||
46<\/td>\n | Figure A.3 \u2013 Reported attacks on computer systems through 2004 (source: CERT) <\/td>\n<\/tr>\n | ||||||
54<\/td>\n | Table A.1 \u2013 Typical likelihood scale <\/td>\n<\/tr>\n | ||||||
56<\/td>\n | Table A.2 \u2013 Typical consequence scale <\/td>\n<\/tr>\n | ||||||
57<\/td>\n | Table A.3 \u2013 Typical risk level matrix <\/td>\n<\/tr>\n | ||||||
59<\/td>\n | Figure A.4 \u2013 Sample logical IACS data collection sheet <\/td>\n<\/tr>\n | ||||||
61<\/td>\n | Figure A.5 \u2013 Example of a graphically rich logical network diagram <\/td>\n<\/tr>\n | ||||||
68<\/td>\n | Figure A.6 \u2013 Graphical view of element group:Security policy, organization, and awareness <\/td>\n<\/tr>\n | ||||||
84<\/td>\n | Figure A.7 \u2013 Graphical view of element group: Selected security countermeasures <\/td>\n<\/tr>\n | ||||||
92<\/td>\n | Figure A.8 \u2013 Reference architecture alignment with an example segmented architecture <\/td>\n<\/tr>\n | ||||||
97<\/td>\n | Figure A.10 \u2013 Access control: Account administration <\/td>\n<\/tr>\n | ||||||
100<\/td>\n | Figure A.11 \u2013 Access control: Authentication <\/td>\n<\/tr>\n | ||||||
105<\/td>\n | Figure A.12 \u2013 Access control: Authorization <\/td>\n<\/tr>\n | ||||||
108<\/td>\n | Figure A.13 \u2013 Graphical view of element group: Implementation <\/td>\n<\/tr>\n | ||||||
109<\/td>\n | Table A.4 \u2013 Example countermeasures and practices based on IACS risk levels <\/td>\n<\/tr>\n | ||||||
111<\/td>\n | Figure A.14 \u2013 Security level lifecycle model: Assess phase <\/td>\n<\/tr>\n | ||||||
112<\/td>\n | Table A.5 \u2013 Example IACS asset table with assessment results Table A.6 \u2013 Example IACS asset table with assessment results and risk levels <\/td>\n<\/tr>\n | ||||||
114<\/td>\n | Figure A.15 \u2013 Corporate security zone template architecture <\/td>\n<\/tr>\n | ||||||
115<\/td>\n | Figure A.16 \u2013 Security zones for an example IACS <\/td>\n<\/tr>\n | ||||||
116<\/td>\n | Table A.7 \u2013 Target security levels for an example IACS <\/td>\n<\/tr>\n | ||||||
118<\/td>\n | Figure A.17 \u2013 Security level lifecycle model: Develop and implement phase <\/td>\n<\/tr>\n | ||||||
122<\/td>\n | Figure A.18 \u2013 Security level lifecycle model: Maintain phase <\/td>\n<\/tr>\n | ||||||
135<\/td>\n | Figure A.19 \u2013 Graphical view of category: Monitoring and improving the CSMS <\/td>\n<\/tr>\n | ||||||
142<\/td>\n | Annex B (informative) Process to develop a CSMS Figure B.1 \u2013 Top level activities for establishing a CSMS <\/td>\n<\/tr>\n | ||||||
144<\/td>\n | Figure B.2 \u2013 Activities and dependencies for activity: Initiate CSMS program <\/td>\n<\/tr>\n | ||||||
145<\/td>\n | Figure B.3 \u2013 Activities and dependencies for activity: High-level risk assessment <\/td>\n<\/tr>\n | ||||||
146<\/td>\n | Figure B.4 \u2013 Activities and dependencies for activity: Detailed risk assessment Figure B.5 \u2013 Activities and dependencies for activity: Establish security policy, organization and awareness <\/td>\n<\/tr>\n | ||||||
147<\/td>\n | Figure B.6 \u2013 Training and assignment of organization responsibilities <\/td>\n<\/tr>\n | ||||||
148<\/td>\n | Figure B.7 \u2013 Activities and dependencies for activity:Select and implement countermeasures <\/td>\n<\/tr>\n | ||||||
149<\/td>\n | Figure B.8 \u2013 Activities and dependencies for activity: Maintain the CSMS <\/td>\n<\/tr>\n | ||||||
150<\/td>\n | Annex C (informative) Mapping of requirements to ISO\/IEC 27001 Table C.1 \u2013 Mapping of requirements in this standard to ISO\/IEC 27001 references <\/td>\n<\/tr>\n | ||||||
154<\/td>\n | Table C.2 \u2013 Mapping of ISO\/IEC 27001 requirements to this standard <\/td>\n<\/tr>\n | ||||||
158<\/td>\n | Bibliography <\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":" Industrial communication networks. Network and system security – Establishing an industrial automation and control system security program<\/b><\/p>\n |