Sharing Indicator: White Essential Cybersecurity Controls 5 5-1 Industrial Control Systems Cybersecurity Industrial Control Systems (ICS) Protection To ensure the appropriate and effective cybersecurity management of Industrial Controls Systems and Objective Operational Technology (ICS/OT) to protect the confidentiality, integrity and availability of the organization’s assets against cyber attacks (e.g., unauthorized access, destruction, spying and fraud) in line with the organization’s cybersecurity strategy and related and applicable local and international laws and regulations. Controls 5-1-1 5-1-2 Cybersecurity requirements related to Industrial Controls Systems and Operational Technology (ICS/OT) must be defined, documented and approved. The cybersecurity requirements related to Industrial Controls Systems and Operational Technology (ICS/OT) must be implemented. In addition to the applicable ECC controls from the main domains (1), (2), (3) and (4), the cybersecurity requirements related to Industrial Controls Systems and Operational Technology (ICS/OT) must include at least the following: 5-1-3 5-1-3-1 Strict physical and virtual segmentation when connecting industrial production networks to other networks within the organization (e.g., corporate network). 5-1-3-2 Strict physical and virtual segmentation when connecting systems and industrial networks with external networks (e.g., Internet, wireless, remote access). 5-1-3-3 Continuous monitoring and activation of cybersecurity event logs on the industrial networks and its connections. 5-1-3-4 Isolation of Safety Instrumental Systems (SIS). 5-1-3-5 Strict limitation on the use of external storage media. 5-1-3-6 Strict limitation on connecting mobile devices to industrial production networks. 5-1-3-7 Periodic review and secure configuration and hardening of industrial, automated, support systems, and devices. 5-1-3-8 Vulnerability management for industrial control systems and operational technology (ICS/OT). 5-1-3-9 Patch management for industrial control systems and operational technology (ICS/OT). 5-1-3-10 Cybersecurity applications management related to the protection of the industrial systems from viruses and malware. 5-1-4 The cybersecurity requirements related to Industrial Controls Systems and Operational Technology (ICS/OT) must be reviewed periodically. Document Classification: Unclassified 29