Protected environment assumptions

Cybersecurity governance – available and up-to-date guidance on governing the use of information and technology assets in your company.

Perimeter security – installed devices, and devices that are not in service, are in an access-controlled or monitored location.

Emergency power – the control system provides the capability to switch to and from an emergency power supply without affecting the existing security state or a documented degraded mode.

Firmware upgrades – device upgrades are implemented consistently to the current version of firmware.

Controls against malware – detection, prevention, and recovery controls to help protect against malware are implemented and combined with appropriate user awareness.

Physical network segmentation – the control system provides the capability to:

• Physically segment control system networks from non-control system networks.

• Physically segment critical control system networks from non-critical control system networks.