GB/T 40682-2021Security for industrial automation and control system - Security program requirements for IACS service providers (English PDF)

Foreword

IEC 62443 is a series of international standards applied to the safety of industrial automation and control systems. At present, our country has adopted this series of standards.

Published GB/T 33007-2016 "Industrial Communication Network Network and System Security Establish Industrial Automation and Control System Security Procedures"

(IEC 62443-2-1.2010, IDT), GB/T 35673-2017 "Industrial communication network network and system security system security requirements and

Security Level" (IEC 62443-3-3.2013, IDT) and this standard, these standards together constitute the safety of industrial automation and control systems

Series of national standards.

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

This standard uses the translation method equivalent to IEC 62443-2-4.2015 "Industrial Automation and Control System Safety Part 2-4.IACS

Security Procedure Requirements for Service Providers.

This standard has made the following editorial changes.

---Modify the standard name to "Safety Procedure Requirements for IACS Service Providers of Industrial Automation and Control System Safety".

This standard was proposed by the China Machinery Industry Federation.

This standard is under the jurisdiction of the National Industrial Process Measurement Control and Automation Standardization Technical Committee (SAC/TC124).

Drafting organizations of this standard. Institute of Comprehensive Technology and Economics of Machinery Industry Instrumentation, China Electric Power Planning Institute Co., Ltd., China Nuclear Power Engineering

Co., Ltd., Hollysys Technology Group Co., Ltd., Beijing Water Supply Group Co., Ltd., Zhejiang University, Huazhong University of Science and Technology, Chongqing

University of Posts and Telecommunications, Computer and Microelectronics Development Research Center of the Ministry of Industry and Information Technology (China Software Evaluation Center), Siemens (China) Co., Ltd.

Division, Schneider Electric (China) Co., Ltd., Rockwell Automation (China) Co., Ltd., Shenyang Institute of Automation, Chinese Academy of Sciences, Beijing

Venus Star Information Security Technology Co., Ltd., Beijing Guodian Zhishen Control Technology Co., Ltd., Shenzhen Wanxun Automation Control Co., Ltd., China

The 30th Research Institute of Electronic Technology Group Corporation, the Fifth Research Institute of Electronics of the Ministry of Industry and Information Technology, Southwest University, China Dongfang Electric Group Co., Ltd.

Company, Beijing Sifang Relay Automation Co., Ltd., National Industrial Information Security Development Research Center, Beijing Rail Transit Design Research

Institute Co., Ltd., Shanghai Automation Instrumentation Co., Ltd., Chongqing Xin'an Network Security Rating and Evaluation Co., Ltd., the Third Research Institute of the Ministry of Public Security, China

Network Security Review Technology and Certification Center, Beijing Wangyu Nebula Information Technology Co., Ltd.

1 Scope

This standard defines what IACS service providers can provide to asset owners in the integration and maintenance activities of automation solutions.

A series of comprehensive requirements for safety capabilities. Because not all requirements apply to all industrial sectors and organizations, 4.1.4 is

Profile development provides a subset of these requirements. Profiles are used to apply this standard to specific environments, including environments not based on IACS.

Note 1.The term "automation solution" is used as a proper term in this standard to prevent confusion with other uses of this term. "Safety" in this standard refers to

"cyber security".

In short, the security capabilities provided by IACS service providers are called security procedures. In related specifications, IEC 62443-2-1 describes

Requirements for the safety management system of asset owners.

Note 2.These security capabilities usually refer to strategies, procedures, practices and related personnel.

Figure 1 illustrates how integration and maintenance capabilities are related to IACS and control system products integrated into automation solutions

of. Some capabilities refer to the security measures defined in IEC 62443-3-3, and service providers must ensure that they are included in the automation solution (including

Included in the control system product or added separately to the automation solution) supports these measures.

Figure 1 Scope of service provider's capabilities

In Figure 1, the illustration of the automation solution includes a basic process control system (BPCS) and an optional safety instrumented system (SIS)

And optional supporting applications, such as advanced control. The dashed box indicates that these components are "optional".

Note 3.The term "process" in BPCS can be used in a variety of industrial processes, including continuous processes and (discrete) manufacturing processes.