The ISA99 standards committee has been at the forefront of developing standards and practices for industrial automation and control system (IACS) security since its formation by the International Society of Automation (ISA) in 2002. The committee developed—and currently works closely with IEC Technical Committee 65 Working Group 10 to maintain and update—the widely used ISA/IEC 62443 series of standards.
A founding principle of ISA/IEC 62443 is the concept of shared responsibility as an essential building block of automation cybersecurity. Everyone benefits when key stakeholder groups align to ensure the safety, integrity, reliability, and security of control systems. With use cases from more than 20 different industries, the ISA/IEC 62443 international standards have demonstrated their utility in all industry verticals that use operational technology (OT).
The ISA99 committee has recently discussed the formation of two new work groups, each focused on a specific area of need and interest. “The subject of automation and control systems security is always changing in response to new developments, increased awareness, and deeper understanding,” said Eric Cosman, ISA99 co-chair. “Maintaining leadership on this subject requires attention to these developments and a timely response.”
Implications of supply chain requirements on IACS security
The first of these work groups involves a detailed assessment of the implications of supply chain requirements on effective automation and control systems security. The committee voting members recently approved the formation of Work Group 17 to focus on this topic. The group is in the preliminary stages of formation. Anyone interested in contributing to this effort may apply on this web page. Current ISA99 committee members should contact the committee chairs.
Confirmation of shared concerns and interest in developing standards for supply chain cybersecurity and the formation of this new work group came from supplier members of the ISA Global Cybersecurity Alliance (ISAGCA), who have also discussed the need for the group. “This effort will focus on supply chain security practices across three key stakeholder roles: suppliers, system integrators, and asset owners,” said Alex Boesenberg, ISA and ISAGCA advocacy manager. “This role-based articulation mirrors the successful structure of the ISA/IEC 62443 family and reinforces the principle of shared responsibility across the industrial ecosystem. The work is expected to draw upon principles of the MITRE System of Trust framework, ISO 22373, and ISA/IEC 62443-4-1.”
The effort has the potential to help clarify how cybersecurity responsibilities and information should move across the industrial supply chain—from those who develop and supply products, to those who integrate them into automation systems, to the asset owners responsible for operating and maintaining those systems. Areas such as component and software transparency, third-party dependencies, vulnerability information, product integrity, and lifecycle security increasingly require coordination among multiple organizations rather than action by any single stakeholder.
Implications of AI on IACS security
ISA99 continues to evolve with global and technological advancements. ISA99 is considering how emerging issues fit into the established ISA/IEC 62443 lifecycle and shared-responsibility framework. ISA describes the series as addressing cybersecurity robustness and resilience throughout the IACS lifecycle.
Based on this, the ISA99 committee is also investigating the feasibility of forming a new work group to address the implications of the application of artificial intelligence (AI) on securing automation and control systems. This is but one aspect of the much broader ISA response to the application of AI in the practice of automation. The scope and description of this group are still being developed by the committee chairs and are subject to approval by the committee voting members. Anyone interested in this subject may apply to participate in the group on this web page, and current ISA99 committee members should contact the committee chairs.
New issues, not new standards topics
With the establishment of the two work groups described above, it is important to note that the ISA99 committee is not interested in creating unrelated new standards on these issues. General information about the committee is available here. For additional questions, please contact the ISA standards staff at [email protected].
