GB/T 42457-2023Security for industrial automation and control systems - Secure product development lifecycle requirements (English PDF)

Foreword

This document was drafted in accordance with the rules provided in GB/T 1.1-2020 Directives

for Standardization - Part 1.Rules for the Structure and Drafting of Standardizing Documents.

This document identically adopts IEC 62443-4-1.2018 Security for Industrial Automation and

Control Systems - Part 4-1.Secure Product Development Lifecycle Requirements.

This document makes the following minimal editorial modification.

---In order to coordinate with the existing standards, the title of the Standard is modified

into Security for Industrial Automation and Control Systems - Secure Product

Development Lifecycle Requirements.

This document was proposed by China Machinery Industry Federation.

This document shall be under the jurisdiction of National Technical Committee 124 on

Industrial Process Measurement, Control and Automation of Standardization Administration of

China (SAC/TC 124).

The drafting organizations of this document. Beijing Winicssec Technologies Co., Ltd.;

Instrumentation Technology and Economy Institute; Electric Power Planning & Engineering

Institute; Schneider Electric (China) Co., Ltd.; SIEMENS (China) Co., Ltd.; Beijing Sifang

Automation Co., Ltd.; Beijing CHN Energy Zhishen Control Technologies Co., Ltd.; North

China Electric Power University; Chongqing Xin'an Network Security Classified Testing and

Evaluation Co., Ltd.; Chongqing University of Posts and Telecommunications; Southwest

University; Huazhong University of Science & Technology; The 30th Research Institute of

China Electronics Technology Group Corporation; China Techenergy Co., Ltd.; Liaoning

Datang International New Energy Co., Ltd.; Maintenance Branch of State Grid Liaoning

Electric Power Supply Co., Ltd.; CRRC Zhuzhou, Locomotive Co., Ltd.; Southwest Jiaotong

University Richsun Technologies Co., Ltd.; Traffic Control Technology Co., Ltd.; Hangzhou

Dianzi University; China First Automobile Group Co., Ltd.; Xi'an Thermal Power Research

Institute Co., Ltd.; Shanghai Institute of Process Automation & Instrumentation; The Fifth

Research Institute of Electronics, Ministry of Industry and Information Technology; China

Industrial Control Systems Cyber Emergency Response Team; Rockwell Automation

(Shanghai) Co., Ltd.; Shanghai Electrical Apparatus Research Institute (Group) Co., Ltd.;

HollySys Technology Group Co., Ltd.; Xi'an Space Radio Technology Research Institute.

1 Scope

This document specifies process requirements for the secure development of products used in

industrial automation and control systems. It defines a secure development lifecycle (SDL) for

the purpose of developing and maintaining secure products. This lifecycle includes security

requirements definition, secure design, secure implementation (including coding guidelines),

verification and validation, defect management, patch management and product end-of-life.

These requirements can be applied to new or existing processes for developing, maintaining

and retiring hardware, software or firmware for new or existing products. These requirements

apply to the developer and maintainer of the product, but not to the integrator or user of the

product. A summary list of the requirements in this document can be found in Appendix B.

2 Normative References

The contents of the following documents constitute indispensable clauses of this document

through the normative references in the text. In terms of dated references, only the version with

the specified date applies to this document. In terms of references without a specified date, the

latest version (including all the modifications) is applicable to this document.

IEC 62443-2-4 Security for Industrial Automation and Control Systems - Part 2-4.Security

Program Requirements for IACS Service Providers

NOTE. GB/T 40682-2021 Security for Industrial Automation and Control System - Security Program

Requirements for IACS Service Providers (IEC 62443-2-4.2015, IDT)

IEC TR 62443-1-2 Security for Industrial Automation and Control Systems - Part 1-2.Master

Glossary of Terms and Abbreviations

3 Terms, Definitions, Abbreviated Terms, Acronyms and

Conventions

The terminology databases for ISO and IEC can be accessed at the following URLs.

......