ISASecure Embedded Device Security Assurance Certification
Membership Prospectus - PDF Download
Providing Industrial Control Systems Security Standards Compliance
Program Overview
Industry leaders from a number of major control system users and manufacturers have investigated the feasibility of creating an organization to establish a set of well-engineered specifications and processes for the testing and certification of critical control systems products. The mission of the proposed organization is:
"The organization's mission is to decrease the time, cost, and risk of developing, acquiring, and deploying control systems by establishing a collaborative industry-based program among asset owners, suppliers, and other stakeholders to:
The standards, tests, and conformance processes for control systems products will allow the products to be securely integrated. An ultimate goal is to push the conformance testing into the product development life cycle so that the products are intrinsically secure."
Current members of the ISA Security Compliance Institute include:
Founding Members
Technical Members
Informational Members
ISCI Governing Board
For more details on the history of the ISA Security Compliance Institute initiative, including the feasibility study describing the market needs, visit www.isa.org/isasecure/history.
The rewards to the automation controls industry and your company are significant.
For asset owners, a well designed and managed product security certification process results in reduced costs and time commitment in product selection and deployment. Key benefits include:
For suppliers and integrators, the certification process provides a single compliance framework and an industry stamp of approval, resulting in faster time to market and lower development and integration costs. Key benefits include:
Finally, for the standards bodies and government agencies developing industrial security specifications, the result will be better, field-tested standards that are clearly being followed by industry.
The ISA Security Compliance Institute establishes an ISASecure designation which identifies and promotes security standards compliant products and systems. Certification provides the formal recognition of a product's compliance to an industry standard security specification, creating a key differentiator for the product. Compliant products are entitled to carry the ISASecure designation, providing instant recognition of the product's security characteristics to asset owners, integrators, and the buying public.
ISA Security Compliance Institute members, working with technical staff retained by the ISA Security Compliance Institute, are developing a set of compliance requirements based on ISA99 security standards and other relevant standards (such as IEC or DHS recommendations). Using the compliance requirements, the ISA Security Compliance Institute will derive and publish compliance test specifications.
In addition to establishing a way of certifying compliant products, the ISA Security Compliance Institute will establish a means of certifying compliant tests and test agencies. Compliance testing approaches will be determined for each product based upon the cost effectiveness and assurances for maintaining the integrity of the compliance designation. Options include self-assessments by suppliers as well as testing by independent test agencies.
The ISA Security Compliance Institute will establish a means for registering compliant products and tests, such as a web portal listing compliant products.
As part of the specification development process, the Institute’s working groups may uncover gaps, deficiencies, and/or clarifications needed in the existing security standards used to derive the compliance requirements. Through the use of appropriate technical experts retained by the ISA Security Compliance Institute, the findings and recommendations will be conveyed to the appropriate standards organizations, including ISA99 with the goal of more rapidly facilitating development of relevant, comprehensive international consensus standards.
Strategically, the technical scope of the program extends from the device level to the gateways (Level 0 to Level 3 plus the gateway interface between Level 3 and Level 4) as reflected by this ISA99 reference model.
ISA Security Compliance Institute compliance requirements development and testing will be deployed in phases starting with the following devices in priority sequence:
Commencing with the second year of operations, the ISA Security Compliance Institute compliance profiles will be expanded based on tactical (near term) and strategic (long term) compliance topics.
Program milestones and dates for the launch and operations phases are:
Q1 2009 - Certification Program Operations Polices, and Processes CompleteQ4 2009 - Embedded Controller Certification Program Operational
Q4 2009 - Process Early Adopter Certifications
Q1 2010 - ISASecure Certification open to public
The membership fee structure is designed to fund the work necessary to continue the ISA Security Compliance Institute's strategic objectives, such as broadening coverage of standards in the compliance certification program.
The ISA Security Compliance Institute strives to represent a cross section of the automation controls community, using policies and guidelines to ensure that the organization maintains a balance of asset owners, suppliers, and other significant stakeholders. To this end, the ISA Security Compliance Institute offers membership levels and fees to encourage full participation from the automation controls community.
A membership prospectus describing the ISASecure program is available for download at: www.isa.org/ISASecure/history.
Voting Member - Appeals to companies who wish to set the strategic objectives of the consortium.
Entitlements
Strategic Members are entitled to a voting seat o the Institute’s Governing Board, set the strategic objectives of the consortium and, provide leadership and guidance for the Institute. Strategic Members also enjoy all privileges of lower categories of membership.
Founding Strategic Members joined ISCI during 2007 and committed to a two year membership at the Strategic level and provided the vision and guidance to the Institute during the development phase.
Annual Dues
$50,000 |
Corporate Membership regardless of company revenues |
$133,650 |
Discounted multi-year Corporate Membership for 3 years paid in full |
Voting Member - Appeals to companies who wish to influence compliance specifications and processes. Technical members determine and manage the detailed tasks necessary to develop specifications for compliance programs, develop procedures and software tools needed for compliance testing, establish technical support programs for suppliers and asset owners, and promote outreach activities necessary to operate the ISASecure compliance program.
Entitlements
Technical Committee Members receive full, voting participation in all technical processes and enjoy all privileges of all categories of membership other than Strategic Membership. Annual membership dues are based on corporate revenues according to the table below:
Annual Dues |
Annual Corporate Revenues |
$25,000 |
Over $1,000,000,000 |
$20,000 |
$500,000,000 - $1,000,000,000 |
$15,000 |
$100,000,000 - $500,000,000 |
$10,000 |
$50,000,000 - $100,000,000 |
$ 5,000 |
Less than $50,000,000 |
Non-voting Member - Appeals to academics, consultants, analysts, and individuals
Entitlements
Informational Members receive periodic information regarding technical specifications and other ISASecure program updates, but may not actively engage in formal technical meetings of the ISA Security Compliance Institute.
Annual Dues
$1,500
Contact us for more information on this prospectus. Interested organizations may join at any time. Organizations who desire to join at the Founding Strategic Membership level must return completed membership applications with payment to ASCI by December 31, 2007.
Membership application forms, showing member fees and mailing instructions, are available for download at http://www.isa.org/ISASecure/join.
Andre Ristaino
Managing Director, Automation Standards Compliance Institute
ISA
67 Alexander Drive
PO Box 12277
Research Triangle Park, NC 27709
Direct (919)-990-9222
Fax (919)-549-8288
Email: aristaino@isa.org
www.isa.org