Final Version of Industrial Control Systems Security Guide Published

From NIST Tech Beat: June 21, 2011
Contact: Mark Bello
301-975-3776

The National Institute of Standards and Technology (NIST) has issued the final version of its Guide to Industrial Control Systems (ICS) Security (SP 800-82),* intended to help pipeline operators, power producers, manufacturers, air traffic control centers and other managers of critical infrastructures to secure their systems while addressing their unique performance, reliability, and safety requirements.

Pipelines and power transmission systems are key components of the nation’s vast critical infrastructure. NIST’s new Guide to Industrial Control Systems Security provides specific guidance on how to reduce the vulnerability of this infrastructure to malicious attacks, equipment failures, and other threats to the operation and reliable performance of underpinning control systems. Copyright: Shutterstock/LiteChoices

Finalized after three rounds of public review and comment, the guide is directed specifically to federally owned or operated industrial control systems (ICS), including those run by private contractors on behalf of the federal government. Examples include the mail handling operations, air traffic control towers, and some electricity generation and transmission facilities and weather observation systems. However, the guide's potential audience is far larger and more diverse than the federal government, since about 90 percent of the nation's critical infrastructure is privately owned.
The guide responds to responsibilities assigned to NIST under the Federal Information Security Management Act (FISMA). The law directs NIST to develop information security standards and guidelines for non-national security federal information systems. While these FISMA-related specifications are not mandatory for the private sector or state and local governments, many businesses and other organizations have adopted the NIST-developed standards and guidelines. Drafts of the new document have been downloaded more than 1,000,000 times, and the guide already is referenced in industry-specific security publications.

Read more....