Security Profile for Advanced Metering Infrastructure - Open Smart ...

surrounding current AMI components and technology were taken in consideration such as key
management, firmware assurance and protection, and trust between intra- and interorganizational
users and objects.
Security controls were selected based on applicability to components and messages of AMI
scenarios that were studied. Security service domains were used as a tool to further characterize
these components with respect to additional security considerations. The assigning of
components to AMI security service domains, examination of processes, communication and
security considerations were used in the selection of requirements for each component.
3.4 Audience
The primary audience of this document is for organizations that are developing or implementing
AMI solutions. This document is written at the normal level of utility security experience for
system owners, system implementers and security engineers. The user is assumed to be
experienced at information asset risk estimation. The user is further assumed to be
knowledgeable in developing security requirements and guidance.
3.5 Disclaimer/Status
Please note that the recommended controls listed in this document are adaptations of the DHS
controls as appropriate for AMI security. The DHS control section numbers are only provided
for traceability, and not intended to indicate that the controls in this document are the DHS
controls themselves. When the ASAP-SG team created controls for which there was no DHS
counterpart, the "ASAP-" prefix is used instead of "DHS-".
Security Profile for Advanced Metering Infrastructure Version 1.0
UtiliSec Working Group (UCAIug) December 10, 2009
5