The ISA-62443 series of standards, being developed by the ISA99 committee of the International Society of Automation (ISA) and adopted globally by the International Electrotechnical Commission (IEC), is designed to provide a flexible framework to address and mitigate current and future vulnerabilities in industrial automation and control systems (IACS).
A newly published standard in the series, ISA-62443-3-3-2013, Security for Industrial Automation and Control Systems Part 3-3: System Security Requirements and Security Levels, addresses risks arising from the growing use of business information technology (IT) cyber security solutions to address IACS cyber security in complex and dangerous manufacturing and processing applications.
IACS security goals typically focus on control system availability, plant protection, plant operations and time-critical system response. IT security goals, in contrast, often focus more on protecting information than physical assets. For this reason, use of IT cyber security solutions to address IACS security must be implemented knowledgably to prevent unintended vulnerabilities that could lead to potentially disastrous health, safety, environmental, financial, and/or reputational impacts in deployed control systems.
The new ISA99 standard addresses this concern with an approach to defining system requirements that is based on a combination of functional requirements and risk assessment and an awareness of operational issues. The standard provides detailed technical control system requirements associated with seven foundational requirements described in the first ISA99 standard, ISA‑62443‑1‑1 (99.01.01). ANSI/ISA-62443-3-3-2013 was approved as an American National Standard on Aug. 13. An essentially identical version will be published by the IEC later this year as IEC 62443-3-3.
For more information, visit www.isa.org/findstandards.
