Standards to Secure Energy Infrastructure

Energy sector stakeholders rely upon a patchwork of standards to defend their industrial control systems (ICS) and operational technology (OT); there is no single security standard that applies to all stakeholders in all conditions. These stakeholders need guidance on which standards apply to specific activities around securing control systems during their design, procurement, construction, operation, maintenance, and disposal phases. By identifying where particular standards are more or less appropriate across different use cases, energy sector stakeholders can optimize their decision-making process, enhance their cybersecurity, and avoid costly mistakes.

Search for Standards

American Petroleum Institute (API) – Pipeline SCADA Security (API STD 1164)

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, OT Services Providers
Purpose: Document Good Practices
Geographic Scope: United States
Functional Scope: Midstream ONG
Type: Standard
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.GV Governance, PR.AC Identity Management and Access Control, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, PR.PT Protective Technology, RS.RP Response Planning, RC. RP Recovery Planning

American Water Works Association (AWWA) – Water Sector Cybersecurity Risk Management Guidance ((not numbered))

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators
Purpose: Document Good Practices
Geographic Scope: United States
Functional Scope: Community water systems
Type: Guide
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, ID.BE Business Environment, ID.GV Governance, ID.RA Risk Assessment, ID.RM Risk Management Strategy, ID.SC Supply Chain Risk Management, PR.AC Identity Management and Access Control, PR.AT Awareness and Training, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, PR.MA Maintenance, PR.PT Protective Technology, DE.AE Anomalies and Events, DE.CM Security Continuous Monitoring, DE.DP Detection Processes, RS.RP Response Planning, RS.CO Communications, RS.AN Analysis, RS.MI Mitigation, RS.IM Improvements, RC. RP Recovery Planning, RC.IM Improvements, RC.CO Communications

Department of Homeland Security (DHS) Transportation Safety Administration (TSA) – TSA Pipeline Security Guidelines (TSA Pipeline Security Program)

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: United States
Functional Scope: Pipelines including Midstream ONG
Type: Recommended Practices
Assurance Mechanism: non-compulsory TSA Corporate Security Reviews and Critical Facility Security Reviews
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, ID.BE Business Environment, ID.GV Governance, ID.RA Risk Assessment, ID.RM Risk Management Strategy, PR.AC Identity Management and Access Control, PR.AT Awareness and Training, PR.DS Data Security, PR.PT Protective Technology, DE.AE Anomalies and Events, DE.CM Security Continuous Monitoring, DE.DP Detection Processes, RS.RP Response Planning, RS.CO Communications, RS.MI Mitigation, RC. RP Recovery Planning, RC.IM Improvements

Energy Sector Control Systems Working Group (ESCSWG) – Cybersecurity Procurement Language for Energy Delivery Systems ((not numbered))

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Original Equipment Manufacturers, OT Services Providers, Third-Party Suppliers
Purpose: Support Ownership and Operation
Geographic Scope: United States
Functional Scope: Energy delivery systems (SCADA, EMS, DMS, DCS)
Type: Recommended Practices
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.GV Governance, ID.SC Supply Chain Risk Management, PR.AC Identity Management and Access Control, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, PR.MA Maintenance, RS.CO Communications

Institute of Electrical and Electronics Engineers (IEEE), IEEE-SA Board of Governors – Standard for Ubiquitous Green Community Control Network: Security (IEEE Std 1888.3-2013)

Applicability

Family: IEEE Std 1888
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, OT Services Providers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Large commercial buildings energy use
Type: Standard
Assurance Mechanism: First-party declaration of conformance
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.AC Identity Management and Access Control

Institute of Electrical and Electronics Engineers (IEEE), Power and Energy Society (PES), Nuclear Power Engineering Committee – Standard for Criteria for Security Systems for Nuclear Power Generating Stations (IEEE Std 692-2013)

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Nuclear power generation
Type: Standard
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.BE Business Environment, PR.AC Identity Management and Access Control

Institute of Electrical and Electronics Engineers (IEEE), Power and Energy Society (PES), Power System Communications and Cybersecurity Committee – Standard for Secure SCADA Communications Protocol (SSCP) (IEEE Std 1711.2-2019)

Applicability

Family: "IEEE Std 1711 Trial-Use Standard for a Cryptographic Protocol for Cyber Security of Substation Serial Links"
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Electric power systems using SSCP with serial communications
Type: Standard
Assurance Mechanism: First-party declaration of conformance
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.DS Data Security

Institute of Electrical and Electronics Engineers (IEEE), Power and Energy Society (PES), Power System Communications and Cybersecurity Committee – Standard for Interoperability of Internet Protocol Security (IPsec) Utilized within Utility Control Systems (IEEE Std 2030.102.1-2020)

Applicability

Family: IEEE Std 2030
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Electric power systems using IPsec
Type: Standard
Assurance Mechanism: First-party declaration of conformance
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.DS Data Security

Institute of Electrical and Electronics Engineers (IEEE), Power and Energy Society (PES), Power System Relaying and Control and Substations Committees – Standard for Cybersecurity Requirements for Substation Automation, Protection, and Control Systems (IEEE Std C37.240-2014)

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Electric power substations
Type: Standard
Assurance Mechanism: First-party declaration of conformance
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.AC Identity Management and Access Control, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, PR.MA Maintenance, PR.PT Protective Technology, DE.AE Anomalies and Events, DE.CM Security Continuous Monitoring, RS.AN Analysis

Institute of Electrical and Electronics Engineers (IEEE), Power and Energy Society (PES), Power System Relaying and Control Committee – Guide for Categorizing Security Needs for Protection and Automation Related Data Files (IEEE SA PC37.249)

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Original Equipment Manufacturers, OT Services Providers, Systems Integrators
Purpose: Document Good Practices
Geographic Scope: International
Functional Scope: Electric power protection and automation systems
Type: Guide
Assurance Mechanism: N/A
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, PR.DS Data Security

Institute of Electrical and Electronics Engineers (IEEE), Power and Energy Society (PES), Substations and Transmission and Distribution Committees – Standard for Intelligent Electronic Devices Cyber Security Capabilities (IEEE 1686-2013)

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators, Government and Regulatory, Original Equipment Manufacturers
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Intelligent electronic devices used in NERC CIP environments
Type: Standard
Assurance Mechanism: First-party declaration of conformance
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.AC Identity Management and Access Control, PR.DS Data Security, PR.MA Maintenance, PR.PT Protective Technology, DE.AE Anomalies and Events, DE.CM Security Continuous Monitoring

Institute of Electrical and Electronics Engineers (IEEE), Power and Energy Society (PES), Substations Committee – Guide for Electric Power Substation Physical and Electronic Security (IEEE Std 1402-2000)

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Electric power substations
Type: Standard
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.RA Risk Assessment, PR.AC Identity Management and Access Control

Institute of Electrical and Electronics Engineers (IEEE), Power and Energy Society (PES), Transmission and Distribution and Substations Committees – Standard for Electric Power Systems Communications-Distributed Network Protocol (DNP3) (IEEE Std 1815-2012)

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Electric power systems using DNP3
Type: Standard
Assurance Mechanism: First-party declaration of conformance
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.AC Identity Management and Access Control

International Electrotechnical Commission (IEC), Technical Committee 45, Subcommittee 45A – Nuclear power plants - Instrumentation, control and electrical power systems - Cybersecurity requirements (IEC 62645:2019)

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, OT Services Providers
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Nuclear power generation
Type: Standard
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, ID.BE Business Environment, ID.GV Governance, ID.RA Risk Assessment, ID.SC Supply Chain Risk Management, PR.AC Identity Management and Access Control, PR.IP Information Protection Processes and Procedures, PR.MA Maintenance, RS.IM Improvements

International Electrotechnical Commission (IEC), Technical Committee 57 – Part 1: Communication network and system security - Introduction to security issues (IEC TS 62351-1:2007)

Applicability

Family: IEC 62351 Power systems management and associated information exchange - Data and communications security
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Original Equipment Manufacturers, OT Services Providers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Energy management and associated data exchange systems
Type: Report
Assurance Mechanism: N/A
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

ID.BE Business Environment, ID.GV Governance, ID.RA Risk Assessment

International Electrotechnical Commission (IEC), Technical Committee 57 – Part 12: Resilience and security recommendations for power systems with distributed energy resources (DER) cyber-physical systems (IEC TR 62351-12:2016)

Applicability

Family: IEC 62351 Power systems management and associated information exchange - Data and communications security
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Electric power systems with interconnected Distributed Energy Resources (DER)
Type: Report
Assurance Mechanism: N/A
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

ID.BE Business Environment, ID.RA Risk Assessment, PR.DS Data Security, RS.AN Analysis, RS.MI Mitigation

International Electrotechnical Commission (IEC), Technical Committee 57 – Part 11: Security for XML documents (IEC 62351-11:2016)

Applicability

Family: IEC 62351 Power systems management and associated information exchange - Data and communications security
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Energy management and associated data exchange systems
Type: Standard
Assurance Mechanism: First-party declaration of conformance
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.DS Data Security

International Electrotechnical Commission (IEC), Technical Committee 57 – Part 10: Security architecture guidelines (IEC TR 62351-10:2012)

Applicability

Family: IEC 62351 Power systems management and associated information exchange - Data and communications security
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Energy management and associated data exchange systems
Type: Report
Assurance Mechanism: N/A
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

ID.BE Business Environment, ID.GV Governance, ID.RA Risk Assessment

International Electrotechnical Commission (IEC), Technical Committee 57 – Part 9: Cyber security key management for power system equipment (IEC 62351-9:2017)

Applicability

Family: IEC 62351 Power systems management and associated information exchange - Data and communications security
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Energy management and associated data exchange systems
Type: Standard
Assurance Mechanism: First-party declaration of conformance
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.DS Data Security, PR.PT Protective Technology

International Electrotechnical Commission (IEC), Technical Committee 57 – Part 8: Role-based access control for power system management (IEC 62351-8:2020)

Applicability

Family: IEC 62351 Power systems management and associated information exchange - Data and communications security
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Energy management and associated data exchange systems
Type: Standard
Assurance Mechanism: First-party declaration of conformance
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.AC Identity Management and Access Control

International Electrotechnical Commission (IEC), Technical Committee 57 – Part 7: Network and System Management (NSM) data object models (IEC 62351-7:2017)

Applicability

Family: IEC 62351 Power systems management and associated information exchange - Data and communications security
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Energy management and associated data exchange systems
Type: Standard
Assurance Mechanism: First-party declaration of conformance
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.DS Data Security, PR.PT Protective Technology

International Electrotechnical Commission (IEC), Technical Committee 57 – Part 6: Security for IEC 61850 (IEC 62351-6:2020)

Applicability

Family: IEC 62351 Power systems management and associated information exchange - Data and communications security
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Energy management and associated data exchange systems
Type: Standard
Assurance Mechanism: First-party declaration of conformance
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.DS Data Security, PR.PT Protective Technology

International Electrotechnical Commission (IEC), Technical Committee 57 – Part 5: Security for IEC 60870-5 and derivatives (IEC TS 62351-5:2013)

Applicability

Family: IEC 62351 Power systems management and associated information exchange - Data and communications security
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Energy management and associated data exchange systems using IEC 60870-5 and derivatives
Type: Report
Assurance Mechanism: N/A
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

PR.DS Data Security, PR.PT Protective Technology

International Electrotechnical Commission (IEC), Technical Committee 57 – Part 4: Profiles including MMS and derivatives (IEC 62351-4:2018+AMD1:2020 CSV )

Applicability

Family: IEC 62351 Power systems management and associated information exchange - Data and communications security
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Energy management and associated data exchange systems using MMS and derivatives
Type: Standard
Assurance Mechanism: First-party declaration of conformance
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.DS Data Security, PR.PT Protective Technology

International Electrotechnical Commission (IEC), Technical Committee 57 – Part 3: Communication network and system security - Profiles including TCP/IP (IEC 62351-3:2014+AMD1:2018+AMD2:2020 CSV)

Applicability

Family: IEC 62351 Power systems management and associated information exchange - Data and communications security
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Energy management and associated data exchange systems using TCP/IP
Type: Standard
Assurance Mechanism: First-party declaration of conformance
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.DS Data Security, PR.PT Protective Technology

International Electrotechnical Commission (IEC), Technical Committee 57 – Part 2: Glossary of terms (IEC TS 62351-2:2008)

Applicability

Family: IEC 62351 Power systems management and associated information exchange - Data and communications security
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Original Equipment Manufacturers, OT Services Providers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Energy management and associated data exchange systems
Type: Report
Assurance Mechanism: N/A
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

International Electrotechnical Commission (IEC), Technical Committee 65 – Part 3-1: Security technologies for industrial automation and control systems (IEC TR 62443-3-1:2009)

Applicability

Family: ISA/IEC 62443 Industrial communication networks - Network and system security
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Document Good Practices
Geographic Scope: International
Functional Scope: Industrial Automation and Control Systems (IACS)
Type: Report
Assurance Mechanism: N/A
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

PR.AC Identity Management and Access Control, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, PR.PT Protective Technology, DE.AE Anomalies and Events, DE.CM Security Continuous Monitoring, RS.AN Analysis

International Electrotechnical Commission (IEC), Technical Committee 65 – Part 1-1: Terminology, concepts and models (IEC TS 62443-1-1:2009)

Applicability

Family: ISA/IEC 62443 Industrial communication networks - Network and system security
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Government and Regulatory, Original Equipment Manufacturers, OT Services Providers, Systems Integrators, Third-Party Suppliers
Purpose: Document Good Practices
Geographic Scope: International
Functional Scope: Industrial Automation and Control Systems (IACS)
Type: Report
Assurance Mechanism: N/A
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, ID.GV Governance, ID.RA Risk Assessment

International Electrotechnical Commission (IEC), Technical Committee 65 – Part 2-1: Establishing an industrial automation and control system security program (IEC 62443-2-1:2010)

Applicability

Family: ISA/IEC 62443 Industrial communication networks - Network and system security
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, OT Services Providers, Systems Integrators
Purpose: Document Good Practices
Geographic Scope: International
Functional Scope: Industrial Automation and Control Systems (IACS)
Type: Guide
Assurance Mechanism: N/A
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, ID.BE Business Environment, ID.GV Governance, ID.RA Risk Assessment, ID.RM Risk Management Strategy, PR.AC Identity Management and Access Control, PR.AT Awareness and Training, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, PR.MA Maintenance, PR.PT Protective Technology, DE.AE Anomalies and Events, DE.CM Security Continuous Monitoring, DE.DP Detection Processes, RS.RP Response Planning, RS.CO Communications, RS.AN Analysis, RS.MI Mitigation, RS.IM Improvements, RC.IM Improvements

International Electrotechnical Commission (IEC), Technical Committee 65 – Part 2-3: Patch management in the IACS environment (IEC TR 62443-2-3:2015)

Applicability

Family: ISA/IEC 62443 Industrial communication networks - Network and system security
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, OT Services Providers, Systems Integrators
Purpose: Document Good Practices
Geographic Scope: International
Functional Scope: Industrial Automation and Control Systems (IACS)
Type: Guide
Assurance Mechanism: N/A
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, PR.IP Information Protection Processes and Procedures, PR.MA Maintenance

International Electrotechnical Commission (IEC), Technical Committee 65 – Part 2-4: Security program requirements for IACS service providers (IEC 62443-2-4:2015+AMD1:2017 CSV)

Applicability

Family: ISA/IEC 62443 Industrial communication networks - Network and system security
Type of Organization: Cybersecurity Services Providers, OT Services Providers, Systems Integrators
Purpose: Support Ownership and Operation
Geographic Scope: International
Functional Scope: Industrial Automation and Control Systems (IACS)
Type: Standard
Assurance Mechanism: Point-in-time third party formal certification
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, ID.GV Governance, ID.RA Risk Assessment, PR.AC Identity Management and Access Control, PR.AT Awareness and Training, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, PR.PT Protective Technology, DE.AE Anomalies and Events, DE.CM Security Continuous Monitoring, DE.DP Detection Processes, RS.CO Communications, RC. RP Recovery Planning

International Electrotechnical Commission (IEC), Technical Committee 65 – Part 3-2: Security risk assessment for system design (IEC 62443-3-2:2020)

Applicability

Family: ISA/IEC 62443 Industrial communication networks - Network and system security
Type of Organization: Asset Owners and Operators, Systems Integrators
Purpose: Support Ownership and Operation
Geographic Scope: International
Functional Scope: Industrial Automation and Control Systems (IACS)
Type: Standard
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.RA Risk Assessment

International Electrotechnical Commission (IEC), Technical Committee 65 – Part 3-3: System security requirements and security levels (IEC 62443-3-3:2013)

Applicability

Family: ISA/IEC 62443 Industrial communication networks - Network and system security
Type of Organization: Asset Owners and Operators, Systems Integrators
Purpose: Support Ownership and Operation
Geographic Scope: International
Functional Scope: Industrial Automation and Control Systems (IACS) system-type products
Type: Standard
Assurance Mechanism: Point-in-time third party formal certification
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, PR.AC Identity Management and Access Control, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, PR.PT Protective Technology, DE.AE Anomalies and Events, DE.CM Security Continuous Monitoring, DE.DP Detection Processes, RS.AN Analysis, RS.MI Mitigation

International Electrotechnical Commission (IEC), Technical Committee 65 – Part 4-1: Secure product development lifecycle requirements (IEC 62443-4-1:2018)

Applicability

Family: ISA/IEC 62443 Industrial communication networks - Network and system security
Type of Organization: Original Equipment Manufacturers
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Industrial Automation and Control Systems (IACS)
Type: Standard
Assurance Mechanism: Point-in-time third party formal certification to a specified Maturity Level
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, ID.GV Governance, ID.RA Risk Assessment, ID.SC Supply Chain Risk Management, PR.AC Identity Management and Access Control, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, PR.PT Protective Technology, DE.AE Anomalies and Events

International Electrotechnical Commission (IEC), Technical Committee 65 – Part 4-2: Technical security requirements for IACS components (IEC 62443-4-2:2019)

Applicability

Family: ISA/IEC 62443 Industrial communication networks - Network and system security
Type of Organization: Original Equipment Manufacturers
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Industrial Automation and Control Systems (IACS) component-type products
Type: Standard
Assurance Mechanism: Point-in-time third party formal certification to a specified Security Level
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

International Electrotechnical Commission (IEC), Technical Committee 65 – Industrial-process measurement, control and automation - Framework for functional safety and security (IEC TR 63069:2019)

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Original Equipment Manufacturers, OT Services Providers, Systems Integrators
Purpose: Document Good Practices
Geographic Scope: International
Functional Scope: Industrial Automation and Control Systems (IACS)
Type: Report
Assurance Mechanism: N/A
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

ID.BE Business Environment, ID.RA Risk Assessment, RC. RP Recovery Planning

International Organization for Standardization (ISO), Joint Technical Committee 1, Subcommittee 27 – Information technology — Security techniques — Information security management systems — Overview and vocabulary (ISO/IEC 27000)

Applicability

Family: ISO/IEC 27000-series ISMS Family of Standards
Type of Organization: General (Any Organization Type)
Purpose: Support Ownership and Operation
Geographic Scope: International
Functional Scope: Information technology
Type: Standard
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

Applicability

Family: ISO/IEC 27000-series ISMS Family of Standards
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Original Equipment Manufacturers, OT Services Providers, Systems Integrators, Third-Party Suppliers
Purpose: Support Ownership and Operation
Geographic Scope: International
Functional Scope: Information technology
Type: Standard
Assurance Mechanism: Three-year third party formal certification
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, ID.BE Business Environment, ID.GV Governance, ID.RA Risk Assessment, PR.AC Identity Management and Access Control, PR.AT Awareness and Training, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, PR.MA Maintenance, PR.PT Protective Technology, DE.AE Anomalies and Events, DE.CM Security Continuous Monitoring, DE.DP Detection Processes, RS.RP Response Planning, RS.CO Communications, RS.AN Analysis, RS.MI Mitigation, RS.IM Improvements, RC. RP Recovery Planning

International Organization for Standardization (ISO), Joint Technical Committee 1, Subcommittee 27 – Information technology — Security techniques — Code of practice for information security controls (ISO/IEC 27002)

Applicability

Family: ISO/IEC 27000-series ISMS Family of Standards
Type of Organization: General (Any Organization Type)
Purpose: Support Ownership and Operation
Geographic Scope: International
Functional Scope: Information technology
Type: Standard
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

International Organization for Standardization (ISO), Joint Technical Committee 1, Subcommittee 27 – Part 1: Introduction and general model (IEC 15408-1:2009)

Applicability

Family: ISO/IEC 15408 Information technology — Security techniques — Evaluation criteria for IT security
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Original Equipment Manufacturers
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Information technology products
Type: Standard
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, ID.RA Risk Assessment, ID.RM Risk Management Strategy

International Organization for Standardization (ISO), Joint Technical Committee 1, Subcommittee 27 – Part 2: Security functional components (IEC 15408-2:2009)

Applicability

Family: ISO/IEC 15408 Information technology — Security techniques — Evaluation criteria for IT security
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Original Equipment Manufacturers
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Information technology products
Type: Standard
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

PR.AC Identity Management and Access Control, PR.DS Data Security, PR.PT Protective Technology

International Organization for Standardization (ISO), Joint Technical Committee 1, Subcommittee 27 – Part 3: Security assurance components (IEC 15408-3:2009)

Applicability

Family: ISO/IEC 15408 Information technology — Security techniques — Evaluation criteria for IT security
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Original Equipment Manufacturers
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Information technology products
Type: Standard
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, ID.RA Risk Assessment, ID.RM Risk Management Strategy

International Organization for Standardization (ISO), Technical Committee 199 – Part 4: Guidance to machinery manufacturers for consideration of related IT-security (cyber security) aspects (ISO/TR 22100-4:2018)

Applicability

Family: ISO/TR 22100 Safety of machinery — Relationship with ISO 12100
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Original Equipment Manufacturers, OT Services Providers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Smart manufacturing
Type: Standard
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

ID.BE Business Environment, ID.GV Governance, ID.RA Risk Assessment

National Institute of Standards and Technology (NIST) – Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy (NIST SP 800-37)

Applicability

Family: Special Publication (SP) 800-series Computer Security
Type of Organization: General (Any Organization Type)
Purpose: Document Good Practices
Geographic Scope: United States
Functional Scope: Information technology
Type: Recommended Practices
Assurance Mechanism: FISMA audits for US federal information systems
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, ID.GV Governance, ID.RA Risk Assessment, ID.RM Risk Management Strategy, ID.SC Supply Chain Risk Management, PR.IP Information Protection Processes and Procedures, DE.CM Security Continuous Monitoring, RS.AN Analysis, RS.IM Improvements

National Institute of Standards and Technology (NIST) – Guidelines for Smart Grid Cybersecurity (NISTIR 7628)

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Original Equipment Manufacturers, OT Services Providers, Systems Integrators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: United States
Functional Scope: Smart grid electric systems
Type: Guide
Assurance Mechanism: N/A
Obligation to Comply: Voluntary

Standard Information

Availability

NIST CSF Categories

National Institute of Standards and Technology (NIST) – Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53)

Applicability

Family: Special Publication (SP) 800-series Computer Security
Type of Organization: General (Any Organization Type)
Purpose: Document Good Practices
Geographic Scope: United States
Functional Scope: Information technology
Type: Recommended Practices
Assurance Mechanism: FIPS 200 assessments and and FISMA audits for US federal information systems
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

National Institute of Standards and Technology (NIST) – Guide to Industrial Control Systems (ICS) Security (NIST SP 800-82)

Applicability

Family: Special Publication (SP) 800-series Computer Security
Type of Organization: Asset Owners and Operators, Cybersecurity Services Providers, Government and Regulatory, Original Equipment Manufacturers, OT Services Providers, Systems Integrators, Third-Party Suppliers
Purpose: Document Good Practices
Geographic Scope: United States
Functional Scope: Industrial Automation and Control Systems (IACS)
Type: Recommended Practices
Assurance Mechanism: N/A
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

North American Electric Reliability Corporation (NERC) – Cyber Security - BES Cyber System Categorization (CIP-002-5.1a)

Applicability

Family: NERC Critical Infrastructure Protection (CIP) Standards
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: Continental US, most of Canada, part of Mexico
Functional Scope: Bulk Electric System (BES) facilities
Type: Standard
Assurance Mechanism: Compliance Audits, Self-Certification, Spot Checks, Compliance Investigations, Self- Reports and Self-Logging, Periodic Data Submittals, Complaints
Obligation to Comply: Mandatory

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, ID.BE Business Environment, ID.RA Risk Assessment

North American Electric Reliability Corporation (NERC) – Cyber Security - Security Management Controls (CIP-003-8)

Applicability

Family: NERC Critical Infrastructure Protection (CIP) Standards
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: Continental US, most of Canada, part of Mexico
Functional Scope: Bulk Electric System (BES) facilities
Type: Standard
Assurance Mechanism: Compliance Audits, Self-Certification, Spot Checks, Compliance Investigations, Self- Reports and Self-Logging, Periodic Data Submittals, Complaints
Obligation to Comply: Mandatory

Standard Information

Availability

NIST CSF Categories

ID.GV Governance, PR.AC Identity Management and Access Control, PR.AT Awareness and Training, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, DE.AE Anomalies and Events, DE.CM Security Continuous Monitoring, DE.DP Detection Processes, RS.CO Communications, RS.AN Analysis, RS.IM Improvements

North American Electric Reliability Corporation (NERC) – Cyber Security - Personnel and Training (CIP-004-6)

Applicability

Family: NERC Critical Infrastructure Protection (CIP) Standards
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: Continental US, most of Canada, part of Mexico
Functional Scope: Bulk Electric System (BES) facilities
Type: Standard
Assurance Mechanism: Compliance Audits, Self-Certification, Spot Checks, Compliance Investigations, Self- Reports and Self-Logging, Periodic Data Submittals, Complaints
Obligation to Comply: Mandatory

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, ID.BE Business Environment, ID.GV Governance, PR.AC Identity Management and Access Control, PR.AT Awareness and Training, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, RS.CO Communications

North American Electric Reliability Corporation (NERC) – Cyber Security - Electronic Security Perimeter(s) (CIP-005-6)

Applicability

Family: North American Electric Reliability Corporation (NERC)
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: Continental US, most of Canada, part of Mexico
Functional Scope: Bulk Electric System (BES) facilities
Type: Standard
Assurance Mechanism: Compliance Audits, Self-Certification, Spot Checks, Compliance Investigations, Self- Reports and Self-Logging, Periodic Data Submittals, Complaints
Obligation to Comply: Mandatory

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, PR.AC Identity Management and Access Control, PR.DS Data Security, PR.MA Maintenance, PR.PT Protective Technology, DE.AE Anomalies and Events, DE.CM Security Continuous Monitoring, DE.DP Detection Processes

North American Electric Reliability Corporation (NERC) – Cyber Security - Physical Security of BES Cyber Systems (CIP-006-6)

Applicability

Family: NERC Critical Infrastructure Protection (CIP) Standards
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: Continental US, most of Canada, part of Mexico
Functional Scope: Bulk Electric System (BES) facilities
Type: Standard
Assurance Mechanism: Compliance Audits, Self-Certification, Spot Checks, Compliance Investigations, Self- Reports and Self-Logging, Periodic Data Submittals, Complaints
Obligation to Comply: Mandatory

Standard Information

Availability

NIST CSF Categories

PR.AC Identity Management and Access Control, PR.AT Awareness and Training, PR.MA Maintenance, PR.PT Protective Technology, DE.CM Security Continuous Monitoring, DE.DP Detection Processes

North American Electric Reliability Corporation (NERC) – Cyber Security - System Security Management (CIP-007-6)

Applicability

Family: NERC Critical Infrastructure Protection (CIP) Standards
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: Continental US, most of Canada, part of Mexico
Functional Scope: Bulk Electric System (BES) facilities
Type: Standard
Assurance Mechanism: Compliance Audits, Self-Certification, Spot Checks, Compliance Investigations, Self- Reports and Self-Logging, Periodic Data Submittals, Complaints
Obligation to Comply: Mandatory

Standard Information

Availability

NIST CSF Categories

ID.RA Risk Assessment, PR.AC Identity Management and Access Control, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, PR.PT Protective Technology, DE.CM Security Continuous Monitoring, DE.DP Detection Processes, RS.AN Analysis, RS.MI Mitigation

North American Electric Reliability Corporation (NERC) – Cyber Security - Incident Reporting and Response Planning (CIP-008-6)

Applicability

Family: NERC Critical Infrastructure Protection (CIP) Standards
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: Continental US, most of Canada, part of Mexico
Functional Scope: Bulk Electric System (BES) facilities
Type: Standard
Assurance Mechanism: Compliance Audits, Self-Certification, Spot Checks, Compliance Investigations, Self- Reports and Self-Logging, Periodic Data Submittals, Complaints
Obligation to Comply: Mandatory

Standard Information

Availability

NIST CSF Categories

ID.BE Business Environment, ID.RA Risk Assessment, PR.IP Information Protection Processes and Procedures, DE.AE Anomalies and Events, DE.DP Detection Processes, RS.RP Response Planning, RS.CO Communications, RS.AN Analysis, RS.IM Improvements

North American Electric Reliability Corporation (NERC) – Cyber Security - Recovery Plans for BES Cyber Systems (CIP-009-6)

Applicability

Family: NERC Critical Infrastructure Protection (CIP) Standards
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: Continental US, most of Canada, part of Mexico
Functional Scope: Bulk Electric System (BES) facilities
Type: Standard
Assurance Mechanism: Compliance Audits, Self-Certification, Spot Checks, Compliance Investigations, Self- Reports and Self-Logging, Periodic Data Submittals, Complaints
Obligation to Comply: Mandatory

Standard Information

Availability

NIST CSF Categories

ID.BE Business Environment, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, RS.AN Analysis, RC. RP Recovery Planning, RC.IM Improvements, RC.CO Communications

North American Electric Reliability Corporation (NERC) – Cyber Security - Configuration Change Management and Vulnerability Assessments (CIP-010-3)

Applicability

Family: NERC Critical Infrastructure Protection (CIP) Standards
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: Continental US, most of Canada, part of Mexico
Functional Scope: Bulk Electric System (BES) facilities
Type: Standard
Assurance Mechanism: Compliance Audits, Self-Certification, Spot Checks, Compliance Investigations, Self- Reports and Self-Logging, Periodic Data Submittals, Complaints
Obligation to Comply: Mandatory

Standard Information

Availability

NIST CSF Categories

ID.RA Risk Assessment, PR.DS Data Security, PR.IP Information Protection Processes and Procedures, PR.MA Maintenance, PR.PT Protective Technology, DE.CM Security Continuous Monitoring, RS.AN Analysis, RS.MI Mitigation

North American Electric Reliability Corporation (NERC) – Cyber Security - Information Protection (CIP-011-2)

Applicability

Family: NERC Critical Infrastructure Protection (CIP) Standards
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: Continental US, most of Canada, part of Mexico
Functional Scope: Bulk Electric System (BES) facilities
Type: Standard
Assurance Mechanism: Compliance Audits, Self-Certification, Spot Checks, Compliance Investigations, Self- Reports and Self-Logging, Periodic Data Submittals, Complaints
Obligation to Comply: Mandatory

Standard Information

Availability

NIST CSF Categories

ID.AM Asset Management, PR.DS Data Security, PR.IP Information Protection Processes and Procedures

North American Electric Reliability Corporation (NERC) – (CIP-012-1)

Applicability

Family: NERC Critical Infrastructure Protection (CIP) Standards
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: Continental US, most of Canada, part of Mexico
Functional Scope: Bulk Electric System (BES) facilities
Type: Standard
Assurance Mechanism: Compliance Audits, Self-Certification, Spot Checks, Compliance Investigations, Self- Reports and Self-Logging, Periodic Data Submittals, Complaints
Obligation to Comply: Mandatory

Standard Information

Availability

NIST CSF Categories

PR.DS Data Security, PR.IP Information Protection Processes and Procedures

North American Electric Reliability Corporation (NERC) – Cyber Security - Supply Chain Risk Management (CIP-013-1)

Applicability

Family: NERC Critical Infrastructure Protection (CIP) Standards
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: Continental US, most of Canada, part of Mexico
Functional Scope: Bulk Electric System (BES) facilities
Type: Standard
Assurance Mechanism: Compliance Audits, Self-Certification, Spot Checks, Compliance Investigations, Self- Reports and Self-Logging, Periodic Data Submittals, Complaints
Obligation to Comply: Mandatory

Standard Information

Availability

NIST CSF Categories

ID.BE Business Environment, ID.RA Risk Assessment, ID.RM Risk Management Strategy, ID.SC Supply Chain Risk Management, PR.AC Identity Management and Access Control, PR.AT Awareness and Training, PR.DS Data Security, PR.MA Maintenance, RS.AN Analysis

North American Electric Reliability Corporation (NERC) – Physical Security (CIP-014-2)

Applicability

Family: NERC Critical Infrastructure Protection (CIP) Standards
Type of Organization: Asset Owners and Operators
Purpose: Preserve and Protect Society's Needs
Geographic Scope: Continental US, most of Canada, part of Mexico
Functional Scope: Bulk Electric System (BES) facilities
Type: Standard
Assurance Mechanism: Compliance Audits, Self-Certification, Spot Checks, Compliance Investigations, Self- Reports and Self-Logging, Periodic Data Submittals, Complaints
Obligation to Comply: Mandatory

Standard Information

Availability

NIST CSF Categories

ID.RA Risk Assessment, DE.CM Security Continuous Monitoring

RTCA, Inc. (formerly Radio Technical Commission for Aeronautics) and European Organization for Civil Aviation Equipment (EUROCAE) – Software Considerations in Airborne Systems and Equipment Certification (DO-178C/ED-12C)

Applicability

Family: N/A
Type of Organization: Asset Owners and Operators, Original Equipment Manufacturers, Systems Integrators
Purpose: Support Design and Manufacturing
Geographic Scope: International
Functional Scope: Avionics
Type: Recommended Practices
Assurance Mechanism: Non-exclusive means of securing FAA approval of software components demonstrating conformance
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

ID.BE Business Environment, ID.RA Risk Assessment, ID.SC Supply Chain Risk Management, PR.DS Data Security, PR.IP Information Protection Processes and Procedures

UL, LLC (formerly Underwriters Laboratories) – Outline for Software Cybersecurity for Network-Connectable Products, Part 2-2: Particular Requirements for Industrial Control Systems (UL 2900-2-2)

Applicability

Family: UL 2900 Software Cybersecurity for Network-Connectable Products
Type of Organization: Cybersecurity Services Providers
Purpose: Promote Economic Efficiency
Geographic Scope: International
Functional Scope: Industrial Automation and Control Systems (IACS) component-type products
Type: Standard
Assurance Mechanism: N/A
Obligation to Comply: N/A

Standard Information

Availability

NIST CSF Categories

ID.SC Supply Chain Risk Management, PR.AC Identity Management and Access Control, PR.DS Data Security, PR.IP Information Protection Processes and Procedures

For questions or comments on this standards search, please contact us at [email protected].