GB/T 40682-2021Security for industrial automation and control system - Security program requirements for IACS service providers (English PDF)

Foreword

IEC 62443 is a series of international standards applied to the safety of industrial automation and control systems. At present, our country has adopted this series of standards. Published GB/T 33007-2016 "Industrial Communication Network Network and System Security Establish Industrial Automation and Control System Security Procedures" (IEC 62443-2-1:2010, IDT), GB/T 35673-2017 "Industrial communication network network and system security system security requirements and Security Level" (IEC 62443-3-3:2013, IDT) and this standard, these standards together constitute the safety of industrial automation and control systems Series of national standards.

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

This standard uses the translation method equivalent to IEC 62443-2-4:2015 "Industrial Automation and Control System Safety Part 2-4: IACS Security Procedure Requirements for Service Providers.

This standard has made the following editorial changes:

---Modify the standard name to "Safety Procedure Requirements for IACS Service Providers of Industrial Automation and Control System Safety".

1 Scope

This standard defines what IACS service providers can provide to asset owners in the integration and maintenance activities of automation solutions. A series of comprehensive requirements for safety capabilities. Because not all requirements apply to all industrial sectors and organizations, 4.1.4 is Profile development provides a subset of these requirements. Profiles are used to apply this standard to specific environments, including environments not based on IACS.

Note 1. The term "automation solution" is used as a proper term in this standard to prevent confusion with other uses of this term. "Safety" in this standard refers to "cyber security".

In short, the security capabilities provided by IACS service providers are called security procedures. In related specifications, IEC 62443-2-1 describes Requirements for the safety management system of asset owners.

Note 2. These security capabilities usually refer to strategies, procedures, practices and related personnel.

Figure 1 illustrates how integration and maintenance capabilities are related to IACS and control system products integrated into automation solutions of. Some capabilities refer to the security measures defined in IEC 62443-3-3, and service providers must ensure that they are included in the automation solution (including Included in the control system product or added separately to the automation solution) supports these measures.

In Figure 1, the illustration of the automation solution includes a basic process control system (BPCS) and an optional safety instrumented system (SIS) And optional supporting applications, such as advanced control. The dashed box indicates that these components are "optional".

Note 3. The term "process" in BPCS can be used in a variety of industrial processes, including continuous processes and (discrete) manufacturing processes.