DANSK DSF/IEC 62443-1-3 TS ED. 1 - 65/557/CDTS PDF

This document defines the high-priority system cybersecurity conformance metrics for an industrial automation and control system (IACS). High-priority metrics focus attention on security technical control functions which enable the requirements specified in IEC 62443-3-3. The underlying management governance policies, procedures, and organizational directives conforming to IEC 62443-2-1 are assumed to be enforced by the IACS owner/operator. These conformance metrics are defined to: a) measure conformance with IACS requirements specified in other parts of the IEC 62443 series; b) manage the development of secure IACS products and services; c) monitor and manage the user-specified quality of service throughout the deployed life of the system; d) verify secure disposal of system, subsystem and components when they are removed from service; and e) provide system measurements to be used by compliance authorities. NOTE 1 The basis for conformance is governed by the control system application in accordance with a tailored version of ISO 14253, Annex H. [6] NOTE 2 ISO/IEC 27004 [8] provides guidance on the development and use of measures and measurement in order to assess the effectiveness of an implemented information security management system (ISMS) and controls or groups of controls, as specified in ISO/IEC 27001 [7].