Catalog of Control Systems Security: Recommendations for Standards Developers

2.5.3.3 Requirement Enhancements
None
2.5.3.4 References
NIST SP 800-53r3 SA-3
CAG CC-7
NRC RG 5.71 C.4, C.4.1, C.4.2.1
2.5.4 Acquisitions
2.5.4.1 Requirement
The organization includes the following requirements and specifications, explicitly or by reference, in
control system acquisition contracts based on an assessment of risk and in accordance with applicable
laws, directives, policies, regulations, and standards:
Security functional requirements/specifications
Security-related documentation requirements
Developmental and evaluation-related assurance requirements.
2.5.4.2 Supplemental Guidance
The acquisition documents for control systems and services include, either explicitly or by reference,
security requirements that describe: (1) required security capabilities (security needs and, as necessary,
specific security controls), (2) required design and development processes, (3) required test and
evaluation procedures, and (4) required documentation. The requirements in the solicitation documents
permit updating security controls as new threats/vulnerabilities are identified and as new technologies are
implemented.
2.5.4.3 Requirement Enhancements
1. The organization requires in acquisition documents that vendors/contractors provide information
describing the functional properties of the security controls employed within the control system.
2. The organization requires in acquisition documents that vendors/contractors provide information
describing the design and implementation details of the security controls employed within the control
system (including functional interfaces among control components).
3. The organization limits the acquisition of commercial technology products with security capabilities
to products that have been evaluated and validated through a government-approved process.
2.5.4.4 References
NIST SP 800-53r3 SA-4
CAG CC-3, CC-7
NRC RG 5.71 C.3.3.3, App. B.5.4, App. C.12.4
2.5.5 Control System Documentation
2.5.5.1 Requirement
The organization:
1. Obtains, protects as required, and makes available to authorized personnel, administrator and user
guidance for the control system that includes information on: (a) configuring, installing, and operating
the system and (b) using the system’s security features
26