Implementing Cybersecurity for Industrial Connected Products: How to use Standards to Protect Operational Technology

This article provides an overview of current cybersecurity standards. It presents a case study on applying cybersecurity standards, practices, and certifications to a cybersecurity program covering a range of industrial connected products. It reflects on where the industry is regarding cybersecurity risk, highlighting current standards and certification programs and looking at upcoming standards and the regulations related to them. <p xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">As part of the overview of cybersecurity standards, this article examines current and upcoming region-specific requirements, the complexities these cause, efforts to harmonize relevant standards, and how to best focus on meeting those requirements as a global manufacturer. Particular attention is paid to the requirements of the International Society of Automation (ISA)/International Electrotechnical Commission (IEC) 62443 [when used within the framework of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53] and the specific obligations that need to be met by component and equipment manufacturers. <p xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">The case study examines how manufacturers can use certifications to minimize risk by demonstrating alignment with security best practices and standards. It also reflects on how to use a certification program to help manufacturers streamline compliance burdens while meeting customers’ needs, concentrating on significant challenges, strategies for implementation, and how the certification bodies involved in these regulations can assist in overcoming challenges through training and awareness.