ISA99, Industrial Automation and Control System Security
ISA99 published its Part 1 standard, ANSI/ISA-99.00.01-2007, Security for Industrial Automation and Control Systems: Concepts, Terminology and Models, in late 2007. This Part 1 standard serves as the foundation for all subsequent standards in the ISA99 series.
Also in late 2007, ISA99 published an updated version of its technical report, ANSI/ISA-TR99.00.01-2007, Security Technologies for Manufacturing and Control Systems. This technical report provides an assessment of cyber security tools, mitigation countermeasures, and technologies that may be applied to industrial automation and control systems regulating and monitoring numerous industries and critical infrastructures.
Currently, ISA99 is conducting a committee ballot on the Part 2 standard in the ISA99 series, Security for Industrial Automation and Control Systems: Establishing an Industrial Automation and Control Systems Security Program. The most recent committee voting was in October 2007. Also underway is work to develop a Part 4 standard, Technical Requirements for Industrial Automation and Control Systems, and to develop a technical report on patch management.
The Co-Chairs of ISA99 are Bryan Singer and Eric Cosman. If you are interested in assisting in the work of ISA99, or would like more information, please contact Charley Robinson, ISA Standards.
ISA99 Scope
The ISA99 Committee addresses manufacturing and control systems whose compromise could result in any or all of the following situations:
endangerment of public or employee safety
loss of public confidence
violation of regulatory requirements
loss of proprietary or confidential information
economic loss
impact on national security
The concept of manufacturing and control systems electronic security is applied in the broadest possible sense, encompassing all types of plants, facilities, and systems in all industries. Manufacturing and control systems include, but are not limited to:
hardware and software systems such as DCS, PLC, SCADA, networked electronic sensing, and monitoring and diagnostic systems
associated internal, human, network, or machine interfaces used to provide control, safety, and manufacturing operations functionality to continuous, batch, discrete, and other processes.
Physical security is an important component in the overall integrity of any control system environment, but it is not specifically addressed in this series of documents.
ISA99 Purpose
The ISA99 Committee will establish standards, recommended practices, technical reports, and related information that will define procedures for implementing electronically secure manufacturing and control systems and security practices and assessing electronic security performance. Guidance is directed towards those responsible for designing, implementing, or managing manufacturing and control systems and shall also apply to users, system integrators, security practitioners, and control systems manufacturers and vendors.
The Committee s focus is to improve the confidentiality, integrity, and availability of components or systems used for manufacturing or control and provide criteria for procuring and implementing secure control systems. Compliance with the Committee s guidance will improve manufacturing and control system electronic security, and will help identify vulnerabilities and address them, thereby reducing the risk of compromising confidential information or causing Manufacturing Control Systems degradation or failure.