Cybersecurity Fundamentals Are Not Just for Industrial Control Systems: Guidance and Direction Are Available

Industrial automation and control systems (IACSs) are important for supporting the U.S. critical infrastructure and maintaining national security. IACS owners and operators continue to face threats from a variety of adversaries, whose intentions include gathering intelligence, stealing intellectual property, obtaining financial compensation through ransom, and disrupting national critical infrastructures. The IACSs discussed do not just include control systems but often include electrical assets (microprocessor-based relays, trip units, etc.) that have been networked together using various communication protocols. Previous IEEE IAS Petroleum and Chemical Industry Technical Conference (PCIC) articles have mentioned cybersecurity without providing details on how to secure an IACS. This article describes the issues that IACS owners and operators face and introduces the International Society of Automation (ISA)/International Electrotechnical Commission (IEC) 62443 [1], [2], [3], [4], [5], [6], [7], [8], [9] series of standards as the basis for an effective cybersecurity program. These standards have been developed by the ISA99 committee of the ISA and IEC Technical Committee 65 Working Group 10 (TC65 WG10).