1、 IEC 62443-2-4 Edition 1.0 2015-06 INTERNATIONAL STANDARD NORME INTERNATIONALE Security for industrial automation and control systems Part 2-4: Security program requirements for IACS service providers Scurit des automatismes industriels et des systmes de commande Partie 2-4: Exigences de programme d
2、e scurit pour les fournisseurs de service IACS IEC 62443-2-4:2015-06(en-fr) colourinsideTHIS PUBLICATION IS COPYRIGHT PROTECTED Copyright 2015 IEC, Geneva, Switzerland All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any mea
3、ns, electronic or mechanical, including photocopying and microfilm, without permission in writing from either IEC or IECs member National Committee in the country of the requester. If you have any questions about IEC copyright or have an enquiry about obtaining additional rights to this publication,
4、 please contact the address below or your local IEC member National Committee for further information. Droits de reproduction rservs. Sauf indication contraire, aucune partie de cette publication ne peut tre reproduite ni utilise sous quelque forme que ce soit et par aucun procd, lectronique ou mcan
5、ique, y compris la photocopie et les microfilms, sans laccord crit de lIEC ou du Comit national de lIEC du pays du demandeur. Si vous avez des questions sur le copyright de lIEC ou si vous dsirez obtenir des droits supplmentaires sur cette publication, utilisez les coordonnes ci-aprs ou contactez le
6、 Comit national de lIEC de votre pays de rsidence. IEC Central Office Tel.: +41 22 919 02 11 3, rue de Varemb Fax: +41 22 919 03 00 CH-1211 Geneva 20 infoiec.ch Switzerland www.iec.ch About the IEC The International Electrotechnical Commission (IEC) is the leading global organization that prepares a
7、nd publishes International Standards for all electrical, electronic and related technologies. About IEC publications The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the latest edition, a corrigenda or an amendment might have been pub
8、lished. IEC Catalogue - webstore.iec.ch/catalogue The stand-alone application for consulting the entire bibliographical information on IEC International Standards, Technical Specifications, Technical Reports and other documents. Available for PC, Mac OS, Android Tablets and iPad. IEC publications se
9、arch - www.iec.ch/searchpub The advanced search enables to find IEC publications by a variety of criteria (reference number, text, technical committee,). It also gives information on projects, replaced and withdrawn publications. IEC Just Published - webstore.iec.ch/justpublished Stay up to date on
10、all new IEC publications. Just Published details all new publications released. Available online and also once a month by email. Electropedia - www.electropedia.org The worlds leading online dictionary of electronic and electrical terms containing more than 30 000 terms and definitions in English an
11、d French, with equivalent terms in 15 additional languages. Also known as the International Electrotechnical Vocabulary (IEV) online. IEC Glossary - std.iec.ch/glossary More than 60 000 electrotechnical terminology entries in English and French extracted from the Terms and Definitions clause of IEC
12、publications issued since 2002. Some entries have been collected from earlier publications of IEC TC 37, 77, 86 and CISPR. IEC Customer Service Centre - webstore.iec.ch/csc If you wish to give us your feedback on this publication or need further assistance, please contact the Customer Service Centre
13、 csciec.ch. A propos de lIEC La Commission Electrotechnique Internationale (IEC) est la premire organisation mondiale qui labore et publie des Normes internationales pour tout ce qui a trait llectricit, llectronique et aux technologies apparentes. A propos des publications IEC Le contenu technique
14、des publications IEC est constamment revu. Veuillez vous assurer que vous possdez ldition la plus rcente, un corrigendum ou amendement peut avoir t publi. Catalogue IEC - webstore.iec.ch/catalogue Application autonome pour consulter tous les renseignements bibliographiques sur les Normes internation
15、ales, Spcifications techniques, Rapports techniques et autres documents de lIEC. Disponible pour PC, Mac OS, tablettes Android et iPad. Recherche de publications IEC - www.iec.ch/searchpub La recherche avance permet de trouver des publications IEC en utilisant diffrents critres (numro de rfrence, te
16、xte, comit dtudes,). Elle donne aussi des informations sur les projets et les publications remplaces ou retires. IEC Just Published - webstore.iec.ch/justpublished Restez inform sur les nouvelles publications IEC. Just Published dtaille les nouvelles publications parues. Disponible en ligne et aussi
17、 une fois par mois par email. Electropedia - www.electropedia.org Le premier dictionnaire en ligne de termes lectroniques et lectriques. Il contient plus de 30 000 termes et dfinitions en anglais et en franais, ainsi que les termes quivalents dans 15 langues additionnelles. Egalement appel Vocabulai
18、re Electrotechnique International (IEV) en ligne. Glossaire IEC - std.iec.ch/glossary Plus de 60 000 entres terminologiques lectrotechniques, en anglais et en franais, extraites des articles Termes et Dfinitions des publications IEC parues depuis 2002. Plus certaines entres antrieures extraites des
19、publications des CE 37, 77, 86 et CISPR de lIEC. Service Clients - webstore.iec.ch/csc Si vous dsirez nous donner des commentaires sur cette publication ou si vous avez des questions contactez-nous: csciec.ch. IEC 62443-2-4 Edition 1.0 2015-06 INTERNATIONAL STANDARD NORME INTERNATIONALE Security for
20、 industrial automation and control systems Part 2-4: Security program requirements for IACS service providers Scurit des automatismes industriels et des systmes de commande Partie 2-4: Exigences de programme de scurit pour les fournisseurs de service IACS INTERNATIONAL ELECTROTECHNICAL COMMISSION CO
21、MMISSION ELECTROTECHNIQUE INTERNATIONALE ICS 25.040.40; 35.040; 35.100 ISBN 978-2-8322-2767-1 Registered trademark of the International Electrotechnical Commission Marque dpose de la Commission Electrotechnique Internationale Warning! Make sure that you obtained this publication from an authorized d
22、istributor. Attention! Veuillez vous assurer que vous avez obtenu cette publication via un distributeur agr. colourinside 2 IEC 62443-2-4:2015 IEC 2015 CONTENTS FOREWORD. 3 INTRODUCTION . 5 1 Scope 6 2 Normative references 7 3 Terms, definitions, abbreviated terms and acronyms 7 3.1 Terms and defini
23、tions 7 3.2 Abbreviations 10 4 Concepts . 11 4.1 Use of IEC 62443-2-4 11 Use of IEC 62443-2-4 by IACS service providers 11 4.1.1Use of IEC 62443-2-4 by IACS asset owners 12 4.1.2Use of IEC 62443-2-4 during negotiations between IACS asset owners 4.1.3and IACS service providers 12 Profiles 12 4.1.4IAC
24、S integration service providers 13 4.1.5IACS maintenance service providers 13 4.1.64.2 Maturity model 14 5 Requirements overview 15 5.1 Contents . 15 5.2 Sorting and filtering . 15 5.3 IEC 62264-1 hierarchy model 16 5.4 Requirements table columns . 16 5.5 Column definitions 16 Req ID column . 16 5.5
25、1BR/RE column . 16 5.5.2Functional area column 17 5.5.3Topic column . 18 5.5.4Subtopic column 19 5.5.5Documentation column . 21 5.5.6Requirement description. 21 5.5.7Rationale . 21 5.5.8Annex A (normative) Security requirements 22 Bibliography . 85 Figure 1 Parts of the IEC 62443 Series . 5 Figure
26、2 Scope of service provider capabilities . 6 Table 1 Maturity levels . 15 Table 2 Columns 16 Table 3 Functional area column values . 18 Table 4 Topic column values 19 Table 5 Subtopic column values . 20 Table A.1 Security program requirements . 22 IEC 62443-2-4:2015 IEC 2015 3 INTERNATIONAL ELECTROT
27、ECHNICAL COMMISSION _ SECURITY FOR INDUSTRIAL AUTOMATION AND CONTROL SYSTEMS Part 2-4: Security program requirements for IACS service providers FOREWORD 1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising all national electrotechnical com
28、mittees (IEC National Committees). The object of IEC is to promote international co-operation on all questions concerning standardization in the electrical and electronic fields. To this end and in addition to other activities, IEC publishes International Standards, Technical Specifications, Technic
29、al Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested in the subject dealt with may participate in this preparatory work. International, governmenta
30、l and non-governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely with the International Organization for Standardization (ISO) in accordance with conditions determined by agreement between the two organizations. 2) The formal decisions or agre
31、ements of IEC on technical matters express, as nearly as possible, an international consensus of opinion on the relevant subjects since each technical committee has representation from all interested IEC National Committees. 3) IEC Publications have the form of recommendations for international use
32、and are accepted by IEC National Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any misinterpretation by any end user. 4) In order to promot
33、e international uniformity, IEC National Committees undertake to apply IEC Publications transparently to the maximum extent possible in their national and regional publications. Any divergence between any IEC Publication and the corresponding national or regional publication shall be clearly indicat
34、ed in the latter. 5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any services carried out by independent certification bodies. 6) A
35、ll users should ensure that they have the latest edition of this publication. 7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and members of its technical committees and IEC National Committees for any personal injury, property damage
36、or other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC Publications. 8) Attention is drawn to the Normative references cited in this publica
37、tion. Use of the referenced publications is indispensable for the correct application of this publication. 9) Attention is drawn to the possibility that some of the elements of this IEC Publication may be the subject of patent rights. IEC shall not be held responsible for identifying any or all such
38、 patent rights. International Standard IEC 62443-2-4 has been prepared by IEC technical committee 65: Industrial-process measurement, control and automation. The text of this standard is based on the following documents: CDV Report on voting 65/545/CDV 65/561A/RVC Full information on the voting for
39、the approval of this standard can be found in the report on voting indicated in the above table. This publication has been drafted in accordance with the ISO/IEC Directives, Part 2. 4 IEC 62443-2-4:2015 IEC 2015 A list of all parts in the IEC 62443 series, published under the general title Security
40、for industrial automation and control systems, can be found on the IEC website. Future standards in this series will carry the new general title as cited above. Titles of existing standards in this series will be updated at the time of the next edition. The committee has decided that the contents of
41、 this publication will remain unchanged until the stability date indicated on the IEC web site under “http:/webstore.iec.ch“ in the data related to the specific publication. At this date, the publication will be reconfirmed, withdrawn, replaced by a revised edition, or amended. IMPORTANT The colour
42、inside logo on the cover page of this publication indicates that it contains colours which are considered to be useful for the correct understanding of its contents. Users should therefore print this document using a colour printer. IEC 62443-2-4:2015 IEC 2015 5 INTRODUCTION This standard is the par
43、t of the IEC 62443 series that contains security requirements for providers of integration and maintenance services for Industrial Automation and Control Systems (IACS). It has been developed by IEC Technical Committee 65 in collaboration with the International Instrumentation Users Association, ref
44、erred to as the WIB from its original and now obsolete Dutch name, and ISA 99 committee members. Figure 1 illustrates the relationship of the different parts of IEC 62443 being developed. Those that are normatively referenced are included in the list of normative references in Clause 2, and those th
45、at are referenced for informational purposes or that are in development are listed in the Bibliography. Figure 1 Parts of the IEC 62443 Series IEC IEC 62443-1.1 IEC TR-62443-1.2 IEC 62443-1.3 IEC TR-62443-1.4 IEC 62443-2.1 IEC TR-62443-2.2 IEC TR-62443-2.3 IEC 62443-2.4 IEC TR-62443-3.1 IEC 62443-3.
46、2 IEC 62443-3.3 IEC 62443-4.1 IEC 62443-4.2 ComponentSystemPoliciesandproceduresGeneralTerminology, concepts and models Security program requirements for IACS service providers Master glossary of terms and abbreviations System security compliance metrics IACS security lifecycle and use-case Requirem
47、ents for an IACS security management system Implementation guidance for an IACS security management system Patch management in the IACS environment Security technologies for IACS Security levels for zones and conduits System security requirements and security levels Product development requirements
48、Technical security requirements for IACS components 6 IEC 62443-2-4:2015 IEC 2015 SECURITY FOR INDUSTRIAL AUTOMATION AND CONTROL SYSTEMS Part 2-4: Security program requirements for IACS service providers 1 Scope This part of IEC 62443-2-4 specifies requirements for security capabilities for IACS ser
49、vice providers that they can offer to the asset owner during integration and maintenance activities of an Automation Solution. NOTE 1 The term “Automation Solution” is used as a proper noun (and therefore capitalized) in this part of IEC 62443 to prevent confusion with other uses of this term. Collectively, the security capabilities offered by an IACS service provider are referred to as its Security Program. In a r
