ICS/OT Cybersecurity as per NIST 800-82 Updated - Part1

Continuously monitor risk by tracking asset changes and selecting suitable monitoring techniques, balancing active and passive approaches. Prioritize threats by likelihood and impact to guide security measures and protect availability.

Develop a company-wide risk management strategy by creating a plan to identify, assess, and establish risk tolerance, especially for machinery control systems and proprietary computers, while aligning safety regulations.

Review and update the organization's risk assessment, checking the entire company for risks and refreshing any existing risk list to serve as a health check of safety.

Develop organizationally tailored control baselines and cybersecurity framework profiles to create customized safety guidelines aligned with a company's technologies, infrastructure, and business requirements.

Identify and rank systems by criticality ratings for PLCs and network devices, define impact levels, and prioritize actions based on safety and essential services.

Define the system’s mission by listing goals, operations, and processes, then map ot–it connections and how information flows under guiding rules to support inventory, maintenance, and supply chains.

Identify and list all system stakeholders with vested interest, including plant manager, process control engineer, operator, functional safety engineer, and process safety manager, ensuring their input and needs are considered.

Identify OT assets vital to stakeholders and rank them by significance using a criticality rating, then compile a physical and software asset list including I/O cards and DCS.

Identify and categorize operational technology information types, including process data and historian data. Determine whether confidentiality or integrity is priority and apply protections such as encryption or signature-based authentication.

Understand the information life cycle from creation to disposition, detailing processing, storage, transmission, use, and disposal, while aligning retention time with data security, integrity, and availability.

Conduct a comprehensive risk assessment of OT systems, evaluating vulnerabilities and potential threats. Update or create a new risk assessment, and include performance, loading, penetration tests, or audits where feasible.

Assess whether a system fits the enterprise architecture by categorizing components by function and data sensitivity, and implement the Purdue model from level zero to four to apply security controls.

Determine a system’s security level through categorization based on the information it handles. Align findings with the company’s risk strategy and assign labels for operator, engineering, calibration, and grid-related systems.

Allocate security controls across the system, ensuring suitable protection for all zones and aligning with enterprise architecture levels, then assess and allocate controls at both system and component levels.

Document planned control implementations with formal records and versioning for security controls and their customizations. Track changes such as antivirus upgrades or siem parsers to support security assessment.

Implement a continuous monitoring strategy as a periodic, continuous audit of system risk, focusing on new vulnerabilities and critical, high-availability systems via centralized security dashboards.

Select an independent assessor or assessment team with OT expertise to evaluate controls and ensure credibility. Prefer a third-party, oil and gas experienced assessor, supported by operators, engineers, and technicians.

Define and execute the assessment plan for ICS/OT cybersecurity by documenting scope and system context, developing and reviewing a detailed plan with stakeholders, and setting success criteria and roadmaps.

Craft a plan of action and milestones to remediate unacceptable risks, detailing antivirus updates, centralized application whitelisting for additional systems, and maintenance and shutdown constraints within the risk framework.

Analyze risk and determine risk tolerance to shape the organization's risk management strategy. In a factory example, defend against unauthorized remote access with firewalls, two-factor authentication, and regular vulnerability assessments.

Implement continuous 24/7 monitoring of systems and environments with dedicated personnel to detect changes and unusual activities. Ensure secure, correct operation across control networks, exemplified by water treatment plant software.

Monitor systems continuously to enable ongoing risk response, detect anomalies or deviations from baseline, and act using risk checks, threat hunting, and incident correlation informed by security camera alerts.

Establish a method to report security and privacy performance to top management, showing how well we keep information secure and private, with a weekly, biweekly, or monthly cadence.

Task M6 on ongoing authorization uses continuous monitoring to inform risk-based approval decisions, enabling risk managers to adjust controls and ensure safe cybersecurity operation of the plant.

Plan and execute safe disposal or replacement of legacy systems, software, licenses, credentials, and hardware. Prepare long-term parts stock to mitigate security risks and environmental impact.