Skip to main content

Global OT & ICS Cybersecurity Standards Handbook

Global OT & ICS Cybersecurity Standards Handbook:

Chapter 1: Cross-Industry & Foundational Standards

Chapter 2: Energy, Oil & Gas, and Power Utilities

Chapter 3: Transportation Systems (Maritime, Rail, Aviation, Automotive)

Chapter 4: Healthcare, Medical Devices & Pharmaceuticals

Chapter 5: Nuclear, Water & Critical Infrastructure Regulations

Chapter 6: Regional & National Statutory Mandates

Chapter 7: Comparative Matrix & Global Mapping

Chapter 8: Engineering Implementation Roadmap


1. Cross-Industry & Foundational OT Standards

IEC 62443 Series: The definitive global benchmark for industrial cybersecurity. It defines a lifecycle framework dividing systems into Zones and Conduits and assigns Security Levels (SL 1–4) based on adversary capability.   

PDF

+ 4


NIST SP 800-82 (Rev. 3): Comprehensive guidance by the US NIST on securing Operational Technology (SCADA, DCS, PLCs) while addressing OT-specific constraints like real-time availability and process safety.   

PDF

+ 2


NIST Cybersecurity Framework (CSF 2.0): A high-level risk management framework built around six core functions: Govern, Identify, Protect, Detect, Respond, and Recover.


ISO/IEC 27001 & ISO/IEC 27019: ISO 27001 sets requirements for an Information Security Management System (ISMS), while ISO 27019 adapts these controls specifically for energy and process control domains.   

PDF

+ 1


2. Energy, Oil & Gas, and Power Utilities

NERC CIP (002–014): Mandatory, strictly enforced regulatory standards for North American Bulk Electric Systems, covering electronic perimeters, incident response, and supply chain risk management.


IEEE 1686: Technical specifications for Intelligent Electronic Devices (IEDs) in electrical substations, mandating access control, audit logging, and cryptographic security.


API STD 1164: American Petroleum Institute framework providing cybersecurity practices for pipeline control systems, supervisory systems, and leak detection networks.


DNV-RP-G108: Recommended practices by DNV for managing cyber risk across offshore oil and gas production platforms and marine facilities.


IEC 62351: Protocols and security controls designed to protect smart grids, substation automation, and communication channels (such as IEC 60870-5 and IEC 61850).


3. Transportation (Maritime, Rail, Aviation, Automotive)

IMO MSC.428(98): International Maritime Organization mandate requiring cyber risk management to be integrated directly into shipboard Safety Management Systems (SMS).


IACS UR E26 & UR E27: Mandatory unified requirements from classification societies for the cyber resilience of ships, navigation hardware, and onboard OT networks.


ISO 21434 / UNECE R155: Global automotive engineering standards establishing mandatory Cybersecurity Management Systems (CSMS) throughout vehicle design, production, and lifecycle software updates.


CLC/TS 50701: European railway cybersecurity specification adapting IEC 62443 principles to trackside signaling, train control, and rolling stock OT networks.


DO-326A / ED-202A: Avionics security guidelines focused on protecting airborne systems against intentional unauthorized electronic interaction (IUEI).


4. Healthcare, Medical Devices & Pharmaceuticals

ANSI/AAMI SW96: Standardized security risk management framework specifically for medical device manufacturers covering threat modeling and post-market monitoring.


IEC 80001-1: Framework addressing risk management for clinical IT/OT networks that incorporate connected medical equipment to ensure patient safety and data confidentiality.


FDA Cyber Content Guidance: Regulatory expectations issued by the US FDA for pre-market cybersecurity submissions and post-market vulnerability handling of connected healthcare equipment.


ISPE GAMP 5 (Rev. 2): Standard guidance for validating computerized systems in pharmaceutical manufacturing to maintain data integrity and strict regulatory compliance.


5. Nuclear, Water & Critical Infrastructure Regulations

IAEA NSS No. 17-T / NSS No. 33-T: International Atomic Energy Agency technical guidance for defending nuclear facilities and safety control systems against physical and cyber threats.


10 CFR 73.54: US Nuclear Regulatory Commission rule requiring nuclear power plants to maintain a comprehensive digital computer and communication security program.


AWWA G430: American Water Works Association standard for establishing cybersecurity governance and operational controls across water and wastewater treatment plants.


IEC 62645 / IEC 62859: International standards for nuclear power plant instrumentation and control (I&C) systems, establishing security programs and physical-cyber co-assurance.


6. Regional & National Statutory Mandates

UAE IAS / NESA: The United Arab Emirates statutory Information Assurance Standard establishing mandatory baseline security controls for national critical infrastructure operators.   

PDF

+ 2


ADNOC AGES-SP-04-013: Abu Dhabi National Oil Company's mandatory OT cybersecurity specification for project engineering, package integrations, and asset operations.   

PDF

+ 1


EU NIS 2 Directive (2022/2555): European Union legislation enforcing strict risk management, supply chain security, and incident notification mandates across essential infrastructure sectors.


Saudi NCA ECC / CSCC: National Cybersecurity Authority of Saudi Arabia's baseline controls specifically designed to defend essential and industrial control environments.

Comments

Post a Comment

Popular posts from this blog

Telecom OSS and BSS: A Comprehensive Guide

  Telecom OSS and BSS: A Comprehensive Guide Table of Contents Part I: Foundations of Telecom Operations Chapter 1: Introduction to Telecommunications Networks A Brief History of Telecommunications Network Architectures: From PSTN to 5G Key Network Elements and Protocols Chapter 2: Understanding OSS and BSS Defining OSS and BSS The Role of OSS in Network Management The Role of BSS in Business Operations The Interdependence of OSS and BSS Chapter 3: The Telecom Business Landscape Service Providers and Their Business Models The Evolving Customer Experience Regulatory and Compliance Considerations The Impact of Digital Transformation Part II: Operations Support Systems (OSS) Chapter 4: Network Inventory Management (NIM) The Importance of Accurate Inventory NIM Systems and Their Functionality Data Modeling and Management Automation and Reconciliation Chapter 5: Fault Management (FM) Detecting and Isolating Network Faults FM Systems and Alerting Mecha...
1 comment
Read more

"Depth-Guard" – 3D Spatial Occupancy monitor Challenge -2

  Project Title: "Depth-Guard" – 3D Spatial Occupancy Monitor 1. The Problem In a smart warehouse, a robot needs to know if a loading zone is clear or occupied. A 2D camera alone can’t tell the difference between a "flat picture of a box" on the floor and an "actual 3D box." The Goal: Build a Python-based system that uses Computer Vision and Depth Perception (AI 3D) to identify objects and determine their 3D volume (Size) and Distance from the camera. 2. Intern Tasks Object Detection: Use a pre-trained model (like YOLOv8) to draw 2D boxes around objects. Depth Mapping: Use a depth estimation model (like MiDaS or a simulated Stereo-depth feed) to calculate how far each object is. Occupancy Logic: If an object is closer than 1 meter and larger than a specific volume, mark the zone as "BLOCKED." Alert System: Print a warning if the 3D space is too crowded. 3. Sample Datasets (Simulation) Since interns may not have 3D cameras (LiDAR/RGB-D), pr...
Post a Comment
Read more

Simple Virtual Waiting Room -Challenge 1

   Simple Virtual Waiting Room (VWR) 1. The Problem Our website can only handle 10 users per minute . If more than 10 people try to access it at once, the server will crash. We need a system that: Counts incoming users. Redirects "overflow" users to a waiting page. Admits them back to the main site one by one as space becomes available. 2. Intern Tasks Create a Gateway: A simple script that checks: if (active_users < 10) { allow } else { send to queue } . Build the Queue: Use a simple list (FIFO) to store user IDs. The Wait Page: A basic HTML page that says: "You are number X in line. Estimated wait: Y minutes." Admission Logic: Every 30 seconds, pull the next user from the queue and "admit" them. 3. Sample Datasets (Simulation) Provide these two datasets to the interns. They should write a script to "read" these files and simulate how their system reacts. Dataset A: The Traffic Surge (Input) This file simulates users arriving at the ...
Post a Comment
Read more