CAN/CSA-IEC 62443-3-3:17 (R2022)

FOREWORD
0 Introduction
1 Scope
2 Normative references
3 Terms, definitions, abbreviated terms, acronyms, and
   conventions
4 Common control system security constraints
5 FR 1 - Identification and authentication control
6 FR 2 - Use control
7 FR 3 - System integrity
8 FR 4 - Data confidentiality
9 FR 5 - Restricted data flow
10 FR 6 - Timely response to events
11 FR 7 - Resource availability
Annex A (informative) - Discussion of the SL vector
Annex B (informative) - Mapping of SRs and REs to FR
        SL levels 1-4
Bibliography

Specifies detailed technical control system requirements (SRs) associated with the seven foundational requirements (FRs) described in IEC 62443-1-1 including defining the requirements for control system capability security levels, SL-C (control system).

CSA Preface This is the first edition of CAN/CSA-IEC 62443-3-3, Industrial communication networks — Network and system security — Part 3-3: System security requirements and security levels , which is an adoption without modification of the identically titled IEC (International Electrotechnical Commission) Standard 62443-3-3 (first edition, 2013-08). For brevity, this Standard will be referred to as \"CAN/CSA-IEC 62443-3-3\" throughout. This Standard is one in a series of Standards developed by IEC/TC 65 on industrial automation networking security that are being adopted by CSA Group. This Standard specifies detailed technical control system requirements associated with the foundational requirements described in CAN/CSA-IEC/TS 62443-1-1:17, including defining the requirements for control system capability security requirements. These requirements would be used by various members of the industrial automation and control system community while developing the appropriate control system target service level for a specific asset. This Standard uses terminology and concepts specified in the following: a) CAN/CSA-IEC/TS 62443-1-1:17, Industrial communication networks — Network and system security — Part 1-1: Terminology, concepts and models; and b) CAN/CSA-IEC 62443-2-1:17, Industrial communication networks — Network and system security — Part 2-1: Establishing an industrial automation and control system security program. This Standard was reviewed for Canadian adoption by the CSA Technical Committee on Information Technology, under the jurisdiction of the CSA Strategic Steering Committee on Information and Communications Technology, and has been formally approved by the Technical Committee. This Standard has been developed in compliance with Standards Council of Canada requirements for National Standards of Canada. It has been published as a National Standard of Canada by CSA Group. Scope This part of the IEC 62443 series provides detailed technical control system requirements (SRs) associated with the seven foundational requirements (FRs) described in IEC 62443‑1‑1 including defining the requirements for control system capability security levels, SL-C(control system). These requirements would be used by various members of the industrial automation and control system (IACS) community along with the defined zones and conduits for the system under consideration (SuC) while developing the appropriate control system target SL, SL-T(control system), for a specific asset. As defined in IEC 62443‑1‑1 there are a total of seven FRs: a) Identification and authentication control (IAC) b) Use control (UC) c) System integrity (SI) d) Data confidentiality (DC) e) Restricted data flow (RDF) f) Timely response to events (TRE), and g) Resource availability (RA). These seven requirements are the foundation for control system capability SLs, SL-C (control system). Defining security capability at the control system level is the goal and objective of this standard as opposed to target SLs, SL-T, or achieved SLs, SL-A, which are out of scope. See IEC 62443‑2‑1 for an equivalent set of non-technical, program-related, capability SRs necessary for fully achieving a control system target SL.