Module 5: Standards and Regulation
Standards ISO/IEC 27001 and ISO/IEC 27001, NERC CIP, CFATS,
ISO/IEC 27002:2005, NRC RG 5.71, and NIST 800-82. Mapping
Industrial Network Security to Compliance, Mapping Compliance
Controls to Network Security, Common Criteria and FIPS Standards. FIPS
140-2.
ISO/IEC 27001
ISO/IEC 27001 is an international standard for information security management systems
(ISMS). It provides a systematic approach to managing sensitive company information,
ensuring its confidentiality, integrity, and availability. Here are some key points about ISO/IEC
27001:
Scope: ISO/IEC 27001 sets out the criteria for establishing, implementing, maintaining, and
continually improving an ISMS within the context of the organization's overall business risks.
Objective: The primary goal of ISO/IEC 27001 is to help organizations protect the
confidentiality, integrity, and availability of their information assets, whether digital or physical.
Risk Management: ISO/IEC 27001 emphasizes a risk-based approach to information security.
Organizations must identify and assess risks, implement controls to mitigate or manage those
risks, and regularly review and improve their ISMS.
Requirements: The standard provides a set of requirements that organizations must meet to
achieve certification. These requirements cover areas such as risk assessment, security policy,
asset management, access control, operations security, and more.
Certification: Organizations can seek ISO/IEC 27001 certification from accredited certification
bodies. Achieving certification demonstrates an organization's commitment to information
security and compliance with the standard.
Continuous Improvement: ISO/IEC 27001 follows the Plan-Do-Check-Act (PDCA) cycle. This
means that organizations must plan their ISMS, implement it, check its effectiveness, and
continually act to improve it.
Compatibility: ISO/IEC 27001 is compatible with other management system standards, such as
ISO 9001 (quality management) and ISO 14001 (environmental management). This allows
organizations to integrate their various management systems.
Benefits: Implementing ISO/IEC 27001 can provide various benefits, including improved
security posture, better risk management, compliance with legal and regulatory requirements,
enhanced customer trust, and competitive advantage.
Global Applicability: ISO/IEC 27001 is an international standard, making it suitable for
organizations of all sizes and industries worldwide. It's widely recognized and accepted.
Documentation: Organizations seeking certification must document their ISMS, including
policies, procedures, and records, to demonstrate compliance with ISO/IEC 27001
requirements.
ISO/IEC 27001 is a valuable framework for organizations looking to establish and maintain a
robust information security management system. It helps them protect their data and systems
from a wide range of threats and vulnerabilities while also enabling them to demonstrate their
commitment to information security to stakeholders.
============= ======================= ========================== ============
NERC CIP
NERC CIP stands for the North American Electric Reliability Corporation Critical Infrastructure
Protection. It is a set of mandatory standards designed to secure the critical assets and
information infrastructure of the North American bulk power system. These standards are
developed and enforced by NERC, an organization responsible for ensuring the reliability of the
North American power grid. NERC CIP standards aim to protect the power grid from cyber
threats and physical security risks. Here are some key points about NERC CIP:
Scope: NERC CIP standards apply to organizations and entities that are responsible for critical
assets and systems within the North American bulk power system. This includes utilities,
generators, transmission operators, and other entities involved in the electricity supply chain.
Categorization: NERC CIP standards are organized into several categories, with each category
addressing specific aspects of critical infrastructure protection. The categories include Cyber
Security, Physical Security, and Personnel and Training.
Requirements: NERC CIP standards set specific requirements for securing critical
infrastructure. These requirements cover areas such as access control, cybersecurity policies
and procedures, incident response planning, security awareness training, and more.
Compliance: Entities subject to NERC CIP standards must comply with the regulations and
undergo regular audits and assessments to ensure their compliance. Non-compliance can
result in penalties and fines.
Cybersecurity: NERC CIP standards place a strong emphasis on cybersecurity measures to
protect the bulk power system from cyber threats. This includes requirements for access
controls, system security, incident reporting, and recovery planning.
Physical Security: In addition to cybersecurity, NERC CIP standards also address physical
security measures to protect critical assets from physical threats, such as unauthorized access,
sabotage, and vandalism.
Incident Response: The standards require organizations to have incident response plans in
place to effectively respond to and recover from security incidents, including cyberattacks or
physical security breaches.
Training and Awareness: NERC CIP standards include requirements for personnel training and
security awareness programs to ensure that employees and contractors are knowledgeable
about security measures and protocols.
Enforcement: NERC has the authority to enforce these standards, and non-compliance can
result in penalties, fines, and other regulatory actions.
NERC CIP standards play a crucial role in safeguarding the reliability and security of the North
American power grid. They help protect critical infrastructure from a wide range of threats,
including cyberattacks, physical intrusions, and other security risks, which is essential for
maintaining the availability and stability of the electrical supply.
============= ======================= ========================== ============
Chemical Facility Anti-Terrorism Standards (CFATS)
The Chemical Facility Anti-Terrorism Standards (CFATS) is a set of regulations established by
the U.S. Department of Homeland Security (DHS) to enhance the security of high-risk chemical
facilities in the United States. CFATS was created in response to concerns about the potential
use of hazardous chemicals in terrorist attacks. The primary goal of CFATS is to reduce the risk
of such attacks by imposing security requirements on covered chemical facilities.
Key points about CFATS include:
Scope: CFATS applies to facilities that possess chemicals of interest in specified quantities and
concentrations. These chemicals are categorized into different risk tiers based on their
potential for harm if used in a terrorist attack.
Risk Assessment: Covered facilities are required to conduct a security vulnerability assessment
(SVA) to identify and assess the security risks associated with the storage and use of these
chemicals. The SVA helps determine a facility's risk tier.
Site Security Plans: Facilities in higher risk tiers are required to develop and implement Site
Security Plans (SSPs) to address security vulnerabilities and mitigate the identified risks. SSPs
outline specific security measures that the facility must adopt.
Compliance: Facilities subject to CFATS must comply with the regulations, which include not
only conducting SVAs and creating SSPs but also undergoing regular inspections and audits to
ensure ongoing compliance.
Security Measures: Security measures required under CFATS may include access controls,
perimeter security, employee training, cybersecurity protections, and more, depending on the
facility's specific vulnerabilities and risk tier.
Enforcement: The DHS enforces CFATS regulations and can take enforcement actions, including
fines and penalties, against facilities that do not comply with the requirements.
Sharing Information: CFATS also involves the sharing of information between the government
and regulated facilities. This information sharing helps identify security risks and develop
effective security measures.
CFATS is an essential component of national security, as it aims to protect critical infrastructure
and reduce the risk of chemical-related terrorist attacks. Facilities covered by CFATS play a
crucial role in ensuring the safety and security of the communities in which they operate and
the nation as a whole. The program continues to evolve as new threats and vulnerabilities are
identified and addressed.
======================= ================================ =============
ISO/IEC 27002:2005
ISO/IEC 27002:2005, also known as ISO/IEC 17799:2005, is an international standard for
information security management. It provides guidelines and best practices for establishing,
implementing, maintaining, and improving an information security management system (ISMS)
within an organization. While it has been replaced by ISO/IEC 27002:2013, the 2005 version is
still relevant and widely used in some contexts. Here are some key points about ISO/IEC
27002:2005:
Scope: ISO/IEC 27002:2005 provides detailed recommendations and controls for information
security. It is designed to assist organizations in managing and protecting their information
assets and addressing information security risks.
Compliance: The standard is not meant for certification or compliance assessment. Instead, it
serves as a reference guide for organizations seeking to enhance their information security
practices and develop security policies and procedures.
Applicability: ISO/IEC 27002:2005 is applicable to organizations of all sizes and types,
regardless of the industry or sector they operate in. It offers a flexible framework for improving
information security.
Content: The standard covers various aspects of information security, including but not limited
to access control, information classification, cryptography, incident management, physical and
environmental security, security policies and procedures, and more. It provides control
objectives and corresponding controls for each area.
Adoption: ISO/IEC 27002:2005 is often used in conjunction with ISO/IEC 27001:2005, which is
the standard for information security management systems (ISMS) certification. Organizations
use ISO/IEC 27002 as a reference to help them meet the requirements of ISO/IEC 27001.
Revision: In 2013, ISO/IEC 27002 was revised and published as ISO/IEC 27002:2013. The 2013
version provides an updated and more comprehensive set of guidelines and controls for
information security management.
Updates and Evolution: ISO/IEC standards, including those related to information security, are
periodically updated to reflect changes in technology, threats, and best practices.
Organizations are encouraged to stay current with the latest versions of relevant standards.
ISO/IEC 27002:2005 has been an important reference for organizations looking to improve
their information security practices. It offers a framework for addressing a wide range of
security concerns and risks, and it remains a valuable resource for organizations working to
protect their information assets. However, organizations are encouraged to consider using the
more recent ISO/IEC 27002:2013 for the most up-to-date guidance on information security
management.
================== ========================== ======================
NRC RG 5.71
NRC RG 5.71 refers to "Regulatory Guide 5.71," which is a document issued by the U.S. Nuclear
Regulatory Commission (NRC). Regulatory guides are published by the NRC to provide
guidance and recommendations to licensees, applicants, and other stakeholders regarding
regulatory matters, particularly related to the licensing and regulation of nuclear materials and
facilities.
The specific content and focus of Regulatory Guide 5.71 would depend on its subject matter, as
each regulatory guide is created to address a particular aspect of nuclear regulation or safety.
To get detailed information on the content and purpose of Regulatory Guide 5.71, you would
need to refer to the specific edition of the document issued by the NRC.
The content of Regulatory Guides can cover a wide range of topics related to nuclear safety,
security, and licensing, and they are an important resource for organizations and individuals
involved in the nuclear industry to ensure compliance with regulatory requirements and best
practices. If you have a specific question or need detailed information about the content of
Regulatory Guide 5.71, I would recommend referring to the NRC's official documents or
contacting the NRC directly for clarification.
================== ========================== ================================
NIST 800-82
NIST Special Publication 800-82, titled "Guide to Industrial Control Systems (ICS) Security," is a
document published by the National Institute of Standards and Technology (NIST) in the United
States. This document provides guidelines and recommendations for securing industrial control
systems (ICS) used in critical infrastructure sectors, such as energy, water, transportation, and
manufacturing. ICS are used to control and automate industrial processes, and their security is
vital to ensure the reliable and safe operation of critical infrastructure.
Key points about NIST SP 800-82 include:
Scope: NIST SP 800-82 focuses on the security of ICS, including supervisory control and data
acquisition (SCADA) systems, distributed control systems (DCS), and other automation systems
used in critical infrastructure. It is primarily designed for organizations responsible for
managing and securing these systems.
Risk Management: The document emphasizes the importance of risk management in ICS
security. It provides guidance on conducting risk assessments and applying security controls to
mitigate identified risks.
Security Controls: NIST SP 800-82 outlines a set of security controls specific to ICS
environments. These controls are designed to address the unique security challenges posed by
ICS and to protect against potential cyber threats and vulnerabilities.
Zones and Conduits: The guide introduces the concept of security zones and conduits within
an ICS architecture. Security zones help define areas with similar security requirements, while
conduits represent the pathways connecting these zones.
Security Policies and Procedures: The document recommends developing and implementing
security policies and procedures tailored to the organization's ICS environment. This includes
incident response, access control, and personnel training policies.
Security Best Practices: NIST SP 800-82 provides a wealth of best practices and
recommendations for securing ICS, including network security, access control, monitoring, and
more.
Security Awareness: The document underscores the importance of creating a culture of
security awareness within the organization, involving all personnel who interact with ICS.
Incident Response: Guidance on developing and testing incident response plans is included to
help organizations respond effectively to security incidents.
Compliance: While NIST SP 800-82 is not a regulation, it serves as a reference for organizations
seeking to comply with various ICS security requirements, regulations, and industry standards.
Updates: NIST updates its publications periodically to reflect changes in technology and
security threats. Therefore, it's essential to use the most recent version of NIST SP 800-82 for
the latest guidance.
NIST SP 800-82 is a valuable resource for organizations operating critical infrastructure that
relies on ICS. It helps these organizations understand and implement effective security
practices to safeguard their industrial control systems from cyber threats and vulnerabilities.