![header thumbnail](/images/publishers\isa_cover.gif)
ISA TR99.00.02 : 2004
Superseded
A superseded Standard is one, which is fully replaced by another Standard, which is a new edition of the same Standard.
![header thumbnail](/images/publishers\isa_cover.gif)
INTEGRATING ELECTRONIC SECURITY INTO THE MANUFACTURING AND CONTROL SYSTEMS ENVIRONMENT
Hardcopy
13-01-2009
English
01-01-2004
1 Scope
2 Purpose
3 Intended Audience
4 General Terms and Definitions
5 Background
6 Developing a Security Program
6.1 Leadership Commitment
6.2 Develop a Business Case
6.3 Develop a Charter or Scope
6.4 Program Tasks
6.5 Special Considerations for Manufacturing
and Control Systems
6.6 Program
6.7 Manufacturing and Control System Change
Management Plan
6.8 The Security Lifecycle
6.9 Program Step Details
7 Define Risk Goals
8 Assess and Define Existing System
8.1 Form Cross-Functional Team
8.2 Pre-Risk Analysis Activities
8.3 Update the Screening Inventory
8.4 Make Preliminary Assessment of Overall Vulnerability
9 Conduct Risk Assessment and Gap Analysis
9.1 Conduct Detailed Risk Analysis Vulnerability
Assessment of the Prioritized Assets
9.2 Prioritize Systems for Implementation Phase of
Risk Mitigation Plan
10 Design or Select Countermeasures
10.1 Implement Risk Mitigation Strategies Based upon
Detected Vulnerabilities
10.2 Address Vulnerabilities
10.3 Formalize Change Management Plan for the System
11 Procure or Build Countermeasures
11.1 Translate Requirements from Design Phase to
Specification or Complete Construction
12 Define Component Test Plans
12.1 Decisions to Make When Planning a Test Program
12.2 Sufficient Testing
12.3 Component Test Plans
13 Test Countermeasures
14 Define Integration Test Plan
15 Perform Pre-Installation Integration Test
16 Define System Validation Test Plan
17 Perform Validation Test on Installed System
18 Finalize Operational Security Measures
18.1 Establish Operational Security Baseline
18.2 Finalize Operational Security Policy
18.3 Establish Management of Change (MOC) Program
18.4 Establish Periodic Audit Plan
18.5 Establish Audit Metrics
18.6 Establish Audit Metrics Reporting Procedure
18.7 Establish Compliance Requirements
18.8 Establish Corrective Action Procedures
18.9 Disaster Recovery
18.10 Monitoring and Logging
18.11 Intrusion Detection
18.12 Incident Response
18.13 Contingency Plans
18.14 Normal
18.15 Formalize Audit Plan for the System
18.16 Implement
19 Routine Security Reporting and Analysis
20 Periodic Audit and Compliance Measures
21 Reevaluate Security Countermeasures
22 Work with Suppliers and Consultants
22.1 System Suppliers
22.2 Consultants
22.3 Integrators
22.4 User Group
23 Participate in Industry Forums and Development Programs
23.1 ISA-The Instrumentation, Systems, and Automation
Society
23.2 U.S. National Institute of Standards and Technology
(NIST)
23.3 North American Electric Reliability Council (NERC)
23.4 Chemical Industry Data Exchange (CIDX)
23.5 Institute of Electrical and Electronics Engineers
(IEEE)
23.6 International Electrotechnical Commission (IEC)
23.7 International Council on Large Electric Systems
(CIGRE)
23.8 U.S. Department of Energy National SCADA Test Bed
Program
23.9 Process Control System Cyber Security Forum (PCSRF)
24 Bibliography and References
Annex A - Sample Policies and Procedures Document
Annex B - A Sample Vulnerability Assessment Procedure
Annex C - Integrating Security into Supplier Practices
Access your standards online with a subscription
Features
-
Simple online access to standards, technical information and regulations.
-
Critical updates of standards and customisable alerts and notifications.
-
Multi-user online standards collection: secure, flexible and cost effective.