Catalog of Control Systems Security: Recommendations for Standards Developers

2.5.12.4 References
NIST SP 800-53r3 SA-12
CAG CC-17
NRC RG 5.71 App. C.12.2
2.5.13 Trustworthiness
2.5.13.1 Requirement
The organization requires that the control system meet an organization-defined level of
trustworthiness.
2.5.13.2 Supplemental Guidance
The level of trustworthiness for organizational control systems is defined in terms of degree of
correctness for intended functionality and of degree of resilience to attack by explicitly identified levels of
adversary capability. In addition, but not as a replacement for this expression of degree of correctness and
resilience, the level of trustworthiness may also be described in terms of levels of developmental
assurance, that is, actions taken in the specification, design, development, implementation, and
operation/maintenance of the control system that impact the degree of correctness and resilience achieved.
Trustworthiness may be defined as different levels on the basis of component-by-component,
subsystem-by-subsystem, function-by-function, or a combination of the above. However, typically
functions, subsystems, and components are highly interrelated, making separation by trustworthiness
perhaps problematic and, at a minimum, something that likely requires careful attention in order to
achieve practically useful results.
2.5.13.3 Requirement Enhancements
The organization requires that software developers employ software quality and validation methods to
minimize flawed or malformed software.
2.5.13.4 References
NIST SP 800-53r3 SA-13
NRC RG 5.71 App. C.12.3
2.5.14 Critical Information System Components
2.5.14.1 Requirement
The organization:
1. Defines and documents all critical hardware and software system components that are in service
2. Upgrade existing limited legacy equipment with current or custom developed information system
components.
2.5.14.2 Supplemental Guidance
The assumption is that information technology products defined by the organization cannot be trusted
due to unacceptable threat potential from the supply chain. Examples would be legacy systems with no
viable alternatives, or existing components that cannot be hardened or enhanced to the required level of
high security assurance. The organization can deploy custom developed or compensating controls to
achieve high assurance security requirements.
2.5.14.3 Requirement Enhancements
The organization:
1. Identifies information system components for which alternative sourcing is not possible
32