Catalog of Control Systems Security: Recommendations for Standards Developers

Table 1. (continued).
Catalog of Recommendations Subsections NIST SP 800-53 Revision 3 Families
2.17 Monitoring and Reviewing Control System
Security Policy
4
Security Assessment and AuthorizationCA
2.18 Risk Management and Assessment Assessment and AuthorizationCA
Risk AssessmentRA
2.19 Security Program Management Program ManagementPM
This DHS catalog contains 250 recommended controls compared to 347 controls defined in
NIST SP 800-53 Revision 3. Of these controls, seven catalog of recommendation controls are not
specifically addressed in NIST SP 800-53 Revision 3. NIST SP 800-53 Revision 3 does not ignore these
seven controls; rather, they are implied within several other control families. This change is reflective of
the increased granularity for each control element within the NIST document. The new consensus audit
guidelines (CAG) and regulatory guide (RG) 5.71 guidelines also follow this trend. As an example,
catalog of recommendation control element 2.9.8, “Document Destruction,” addresses document retention
and destruction. However, areas, such as visitor control, incident management, and configuration
management, require different document retention and destruction requirements and policies. Other areas,
such as roles and responsibilities and access control, are also broken down and inserted as needed into
control elements to assist the user to understand and effectively deploy the security control being
discussed.
The “Requirement” section for each security control includes detailed recommended security
practices and mechanisms. The “Supplemental Guidance” section provides additional information that
may be beneficial for understanding and implementing the recommendation. The last section,
“Requirement Enhancements,” includes supplementary security constraints for the recommendation that
will result in a more secure environment based on the organization’s predetermined level of protection
required for the control system used for the critical process. Not all the recommendations are appropriate
for all applications, so it will be necessary to determine the level of protection needed and only apply the
guidance as appropriate. Industrial controls have an availability requirement that may require
compensating controls instead of following the recommendations (see Appendix I of NIST SP 800-53
Revision 3, “Industrial Control Systems”). A few examples of these areas may be password, multiple
session, and patch management controls where interference with operations becomes unacceptable
because of operational requirements, testing, and certification requirements (e.g., substation automation,
certain refinery operations, flight controls). The following recommendations were obtained from a review
of the controls found in various industry standards. Similar controls were identified, and a single
recommendation was prepared that addressed the intent of the original controls. Appendix A presents a
cross reference of standards and guidelines used to develop these recommendations.
2.1 Security Policy
Security policies are the specific controls and behavior expectations that each member of the
organization’s staff is required to meet in the daily operation of the control system. The development of
the organization’s security policy is the first and most important step in developing an organizational
security program. Security policies lay the groundwork for securing the organization’s physical,
enterprise, and control system assets. Security procedures define how an organization implements the
security policy. Using a predefined security policy best practices guide can help the organization to
develop a cogent security policy.