Communicating Cybersecurity Decisions and Their Rationales Explicitly During and After CPS Design

Security by design for cyber-physical systems (CPS) is not just an engineering problem, but also a communication problem. The state of the art is to communicate cybersecurity through lists of requirements and how they are met. However, communicating merely requirements does not suffice for users, auditors, management, or the interested public to understand how a security feature impacts the system's cybersecurity resilience, and it does not enable collaboration of the many engineering domains needed to engineer a CPS's cybersecurity. This work introduces a model-based, visualized concept called “Cyber Decision Diagrams” for efficiently documenting cybersecurity decisions, their rationales, and the decision base to improve cybersecurity communication. The concept was implemented in a software demonstrator and validated with a CPS user (INEOS) and a CPS manufacturer (HIMA). With the concept, manufacturers can tap into the knowledge of more domains during the design process, make implicit cybersecurity characteristics of their products explicit, and explain “hard to sell” cybersecurity decisions. Users can make cybersecurity priorities clearer to manufacturers. Users, the public and policymakers can take it as guidance for cybersecurity information they should request from manufacturers – for example in information and instructions to the user mandated by the EU Cyber Resilience Act (CRA).