Industrial control systems (ICS) are essential for the operation of critical infrastructure sectors such as energy, water, transportation, manufacturing, and healthcare. However, these systems also face increasing cyber threats from malicious actors who seek to disrupt, damage, or compromise them. Therefore, it is vital for ICS owners and operators to comply with relevant regulatory and legal requirements that aim to protect the security and resilience of these systems.
However, meeting ICS/OT compliance can be challenging, as there are various standards and regulations that apply to different sectors, regions, and systems. Moreover, ICS/OT environments have unique characteristics and constraints that differ from traditional IT environments, such as performance, reliability, and safety requirements. Therefore, ICS/OT compliance requires a tailored and holistic approach that considers the specific needs and risks of each system.
In this article, we will discuss some of the best practices and recommendations for achieving ICS/OT compliance, based on the latest guidance and resources from industry experts and authorities.
1) Keep on top of regulatory changes
One of the first steps to meet ICS/OT compliance is to be aware of the applicable standards and regulations that affect your system. These may vary depending on the sector, region, and system type of your ICS/OT environment. For example, some of the common ICS/OT-specific regulations and guidance include:
- NERC CIP: A set of cybersecurity requirements for the bulk electric system in North America, enforced by the North American Electric Reliability Corporation (NERC).
- NIST SP 800-82: A guide to operational technology security, published by the National Institute of Standards and Technology (NIST), that provides recommendations on how to improve the security of ICS/OT systems while addressing their unique performance, reliability, and safety requirements.
- CPNI: The Centre for the Protection of National Infrastructure (CPNI) in the UK, which provides advice and guidance on protecting critical infrastructure from physical and cyber threats.
- BSI and BDEW: The Federal Office for Information Security (BSI) and the German Association of Energy and Water Industries (BDEW) in Germany, which provide standards and guidelines for the security of energy and water systems.
- CPG: The Cross-Sector Cybersecurity Performance Goals (CPG), published by the Cybersecurity and Infrastructure Security Agency (CISA) in the US, which provide a voluntary framework for critical infrastructure owners and operators to measure and improve their cybersecurity posture.
It is important to keep track of the changes and updates in these and other relevant standards and regulations, as they may introduce new requirements or best practices that affect your system. You can use various sources of information, such as official websites, newsletters, webinars, or industry associations, to stay informed and up to date.
2) Make sure your employees understand the importance of compliance
Another key factor for achieving ICS/OT compliance is to ensure that your employees, especially those who work with or manage ICS/OT systems, understand the importance and benefits of compliance. Compliance is not only a legal obligation, but also a strategic advantage that can help you improve your system security, performance, and resilience, as well as your reputation and customer trust.
Therefore, you should provide regular training and awareness programs for your employees, covering topics such as:
- The applicable standards and regulations for your system, and how to comply with them.
- The common threats and risks to your system, and how to prevent, detect, and respond to them.
- The best practices and policies for securing your system, such as password management, access control, patching, backup, incident response, etc.
- The roles and responsibilities of each employee for maintaining compliance, and the consequences of non-compliance.
You should also encourage a culture of compliance within your organization, by rewarding good behavior, providing feedback, and soliciting input from your employees. By doing so, you can foster a sense of ownership and accountability among your staff, and motivate them to comply with the standards and regulations.
3) Designate a compliance champion
A third best practice for meeting ICS/OT compliance is to designate a compliance champion, who is a person or a team responsible for leading and coordinating the compliance efforts within your organization. The compliance champion should have the authority, resources, and expertise to:
- Establish, enforce, and maintain policies and procedures for ICS/OT compliance, based on the applicable standards and regulations, and the specific needs and risks of your system.
- Conduct regular audits and assessments of your system, to identify and prioritize gaps and issues, and to measure and report on your compliance status and progress.
- Implement and test technical and organizational controls, such as firewalls, encryption, segmentation, monitoring, logging, etc., to enhance the security and resilience of your system, and to meet the compliance requirements.
- Communicate and collaborate with internal and external stakeholders, such as IT and OT teams, management, vendors, regulators, auditors, etc., to ensure alignment and support for the compliance objectives and activities.
The compliance champion should also be able to adapt and respond to the changing regulatory landscape, and to the evolving threats and risks to your system. Therefore, they should have access to the latest information and tools, and be able to update and improve your policies and procedures accordingly.
4) Build a bridge between your security team and legal team
A fourth recommendation for achieving ICS/OT compliance is to build a bridge between your security team and your legal team, as they are both essential for ensuring the compliance of your system. The security team is responsible for implementing and maintaining the technical and operational controls that protect your system from cyber threats, while the legal team is responsible for interpreting and applying the legal and regulatory requirements that govern your system.
However, these two teams may have different perspectives and priorities, and may not always communicate or collaborate effectively. For example, the security team may focus on the technical aspects of compliance, such as patching, encryption, or segmentation, while the legal team may focus on the contractual and liability aspects of compliance, such as agreements, warranties, or indemnities. This may lead to misunderstandings, conflicts, or gaps in your compliance efforts.
Therefore, you should establish a regular and open dialogue between your security team and your legal team, to:
- Share information and knowledge about the applicable standards and regulations, and how they affect your system and your organization.
- Align and coordinate your compliance goals and strategies, and define clear roles and responsibilities for each team.
- Resolve any issues or disputes that may arise, and seek mutual agreement and support for the compliance decisions and actions.
By building a bridge between your security team and your legal team, you can ensure that your compliance efforts are consistent, comprehensive, and effective, and that you can meet the expectations and obligations of your regulators, customers, and partners.
5) Constantly monitor for compliance with the right tools
A fifth and final best practice for meeting ICS/OT compliance is to constantly monitor for compliance with the right tools. Compliance is not a one-time event, but an ongoing process that requires continuous attention and improvement. Therefore, you should use various tools and technologies to:
- Collect and analyze data from your system, such as configuration, performance, events, logs, alerts, etc., to detect and respond to any anomalies, incidents, or breaches that may affect your system security and compliance.
- Measure and report on your compliance status and progress, using metrics, indicators, dashboards, etc., to evaluate and demonstrate your compliance performance and achievements, and to identify and address any gaps or issues.
- Automate and streamline your compliance tasks and workflows, such as scanning, testing, auditing, reporting, etc., to reduce the manual effort and human error, and to increase the efficiency and accuracy of your compliance activities.
Some of the tools and technologies that you can use for ICS/OT compliance include:
- Microsoft 365: A cloud-based suite of productivity and collaboration applications, such as Word, Excel, PowerPoint, Teams, etc., that can help you create, manage, and share documents, spreadsheets, presentations, etc., related to your compliance efforts.
- Azure Sentinel: A cloud-native security information and event management (SIEM) and security orchestration, automation, and response (SOAR) solution, that can help you collect, analyze, and respond to data from your system, and to automate and orchestrate your compliance tasks and workflows.
- Azure Defender for IoT: A cloud-based solution that provides agentless, network-based monitoring and threat detection for your ICS/OT devices and protocols, and that integrates with Azure Sentinel and other security tools to provide a unified view and response for your system security and compliance.
- Azure Security Center: A cloud-based solution that provides unified security management and advanced threat protection for your hybrid cloud workloads, and that helps you meet the compliance requirements for your system, such as encryption, backup, identity, etc
By using these and other tools, you can enhance your visibility and control over your system, and ensure that you are always compliant with the standards and regulations that apply to your system.
Conclusion
ICS/OT compliance is a critical and complex challenge for critical infrastructure owners and operators, as they have to meet various standards and regulations that aim to protect the security and resilience of their systems. However, by following the best practices and recommendations discussed in this article, such as keeping on top of regulatory changes, making sure your employees understand the importance of compliance, designating a compliance champion, building a bridge between your security team and legal team, and constantly monitoring for compliance with the right tools.
