Industrial cybersecurity
Industrial cybersecurity
Industrial cybersecurity governance
SEC-ICSF:2021 (Industrial Cybersecurity Framework)
The regulatory landscape in industrial cybersecurity is complex and even ambiguous. We are faced with different standards, sectorial norms, specific customer requirements, etc. For this reason, at Secure&IT we considered the need to define a set of cybersecurity controls that allow the industry to adequately manage the cybersecurity of its industrial processes, which conform to an adequate level of security. This is the origin of the SEC-ICSF:2021 standard.
SEC-ICSF:2021 (Industrial Cybersecurity Framework) provides a workable industrial cybersecurity regulatory framework. It is aimed at all types of companies. It allows to reach an adequate risk level with a minimum number of controls, and to obtain a certification by a recognized entity (OCA Global).
- Provides security for industrial control systems.
- It has a framework of fundamental controls.
- There is recognition of the proper application of the standard.
- It offers complementary industrial controls for the extension of the ISMS based on 27001.
SEC-ICSF:2021 has a set of 42 controls divided into 8 main categories. They are aligned with certain SRs of standards 62443, ISO27002 and the Center for Industrial Cybersecurity (CCI).
There are two possibilities for implementation: as a stand-alone framework (suitable for companies that do not have an Information Security Management System based on ISO 27001), or as a set of controls that extend the scope of an ISMS to the purely industrial environment (Industrial Cybersecurity Management System).
In short, SEC-ICSF:2021 is a private standard developed by Secure&IT, recognized and certifiable exclusively by OCA Global. It allows certification at three levels (high, medium and low), depending on the total score obtained according to the degree of implementation of each of the security controls.