Security for industrial automation and control systems — Part 2-1: Security program requirements for IACS asset owners
Security policies and procedures for owners and operators of industrial control systems in operation.
Overview
Specifies security-program requirements for operational IACS; asset owners include system operators.
Key points
01
Operational security responsibilities
Establish security policies and procedures for operating control systems.
Basis: IEC scope02
Legacy-system limitations
Include compensating measures where legacy systems lack capabilities such as patching or backup.
Basis: IEC scope03
Security-program maturity
The 2024 edition introduces a maturity model for evaluating requirements.
Basis: IEC edition changesApplication to overseas operations
During plant handover and operation, use it to clarify owner/operator responsibilities and plan controls for legacy equipment.