text: European Union Agency for Network and Information Security ENISA - The EU Cyber Security Agency

text: Follow the EU cyber security affairs of ENISA: www.enisa.europa.eu & Facebook, Twitter, LinkedIn, YouTube, RSS feeds

text: th The NIS Directive was adopted by the European Parliament on the 6 of July, 2016 and entered into force in August 2016. Member States have 21 months to transpose the Directive into their national legislation and 6 more months to identify operators of essential services.

text: These documents were originally referred to as ANSI/ISA-99 or ISA99 standards, as they were created by the International Society for Automation (ISA) and publicly released as American National Standards Institute (ANSI) documents. In 2010, they were renumbered to be the ANSI/ISA-62443 series. This change was intended to align the ISA and ANSI document numbering with the corresponding International Electrotechnical Commission (IEC) standards https://en.wikipedia.org/wiki/Cyber_security_standards 4 https://www.isa.org/store/ansi/isa-62443-3-3-990303-2013-security-for-industrial-automation-and-control-systems-part-3-3system-security-requirements-and-security-levels/116785 The Version 1.0 of the NIST Cybersecurity Framework was taken into account for the mapping it, as the newest version of the framework is still in draft status. 6 https://www.nist.gov/sites/default/files/documents/cyberframework/cybersecurity-framework-021214.pdf

text: European Union Agency for Network and Information Security ENISA - The EU Cyber Security Agency Follow the EU cyber security affairs of ENISA: www.enisa.europa.eu & Facebook, Twitter, LinkedIn, YouTube, RSS feeds

text: https://www.enisa.europa.eu/publications/good-practices-recommendations 15 https://ics-cert.us-cert.gov/sites/default/files/documents/TransportationRoadmap20120831.pdf 16 http://www.icao.int/Security/SFP/Pages/SecurityManual.aspx 17 https://www.hklaw.com/publications/Coast-Guard-DHS-Mandate-Cybersecurity-Reporting-Move-to-Require-Maritime- Cybersecurity-Programs-07-20-2017/

text: European Union Agency for Network and Information Security

text: ENISA - The EU Cyber Security Agency

text: https://ec.europa.eu/info/law/payment-services-psd-2-directive-eu-2015-2366_en 35 https://www.pcisecuritystandards.org/documents/PCI%20SSC%20Quick%20Reference%20Guide.pdf

text: ENISA - The EU Cyber Security Agency

text: ENISA - The EU Cyber Security Agency

text: ENISA - The EU Cyber Security Agency

text: ENISA - The EU Cyber Security Agency

text: ENISA - The EU Cyber Security Agency

identifier: Mapping of OES Security Requirements to Specific Sectors

title: Mapping of OES Security Requirements to Specific Sectors

text: Mapping of OES Security Requirements to Specific Sectors DECEMBER 2017

text: www.enisa.europa.eu European Union Agency For Network and Information Security Mapping of OES Security Requirements to Specific Sectors December 2017

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and EU citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Contact For queries in relation to this paper, please use resilience@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu. Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Network and Information Security (ENISA), 2017 Reproduction is authorised provided the source is acknowledged. ISBN 978-92-9204-232-5, DOI 10.2824/844702 02 Mapping of OES Security Requirements to Specific Sectors December 2017

text: Table of Contents

text: Executive Summary 4 1 Introduction 5 1.1 Background 5 1.2 Target Audience 5 1.3 Goal and Scope of the report 6 1.4 Methodology 6 2 Mapping of Baseline Security Measures for OESs per sector 8 2.1 Energy 8 2.1.1 Electricity 9 2.1.2 Oil & Gas 14 2.2 Transport 19 2.2.1 Air Transport 20 2.2.2 Rail Transport 23 2.2.3 Water Transport 23 2.2.4 Road Transport 26 2.3 Financial and Banking 27 2.4 Healthcare 37 2.5 Drinking Water Supply & Distribution 42 2.6 Digital Infrastructures 42 2.7 Matching of baseline security measures with sectors 46 3 Mapping the Baseline Security Measures for OES to cross sector international standards 54 03 Mapping of OES Security Requirements to Specific Sectors December 2017

text: Executive Summary

text: According to the

text: Directive (EU) 2016/1148

text: issued by the European Parliament and the Council, hereafter referred to as ‘Network and Information Security (NIS) Directive’, specific types of entities which provide essential services to the European internal market, shall be identified by the Member States. The business sectors for these entities are depicted in Annex II of the NIS Directive. One of the main objectives of the NIS Directive is to enact security measures for operators of essential services (OES) across the European Union, in order to achieve a high common level of Security of Network and Information Systems. The current report provides a substantial and comprehensive mapping of the security requirements for OES, as they have been agreed in the NISD Cooperation Group, to sector specific information security standards. Initially, ENISA conducted desktop research on international security standards, guidelines and good practices per sector. Finally, the security requirements for OES were mapped to international standards used by operators covering all business sectors under scope. This report is a living document that we will augment on a regular basis to keep it up to date with the latest developments. 04 Mapping of OES Security Requirements to Specific Sectors December 2017

text: 1 Introduction

text: This report provides the mapping of security measures for OES to international standards used by operators in the business sectors mentioned in Annex II of the NIS Directive , namely energy, transport, banking, financial market infrastructures, health, drinking water supply & distribution and digital infrastructures. The current report involves the security requirements for OES, as they have been defined in the specific work stream of the Cooperation Group of the NIS Directive, and they are presented in details in ENISA’s deliverable “Baseline Security Requirements for OES”. The mapping of security requirements for OES to specific sector standards contributes to achieving a common and converged level of security in network and information systems (Article 3 of the NIS Directive) at EU level. This report is a ‘living document’ that we will augment on a regular basis to keep it up to date with the latest developments. It is important to note that the security measures described in this document derived from the work performed under the specific work stream of the NIS Directive Cooperation Group for the security measures for OES. The proposed security measures are not intended to replace existing standards, frameworks or good-practices in use by OES. However, operators could map the standards they use (internally) to the proposed security measures, and in this way assess their information security practices against the requirements adopted by the Cooperation Group. 1.1 Background The ultimate goal of the NIS Directive is to ensure a culture of network and information systems security across sectors (i.e. energy, transport, water, banking, financial market infrastructures, healthcare and digital infrastructure), vital for our society and economy and heavily dependent on ICT (

text: Article 5

text: §2-b, NISD). The operators identified by the Member States as OES should take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which they use in their operations (

text: Article 14

text: §1, NISD). Therefore, this mapping contributes to the establishment of a harmonised baseline security level of OES across EU. 1.2 Target Audience The intended audience of this report consists of the OES as well as the public authorities for the following (sub)sectors:  Energy o Electricity o Oil 05 Mapping of OES Security Requirements to Specific Sectors December 2017 o Gas  Transport o Air Transport o Rail Transport o Water Transport o Road Transport  Banking  Financial Market Infrastructures  Health  Drinking Water Supply & Distribution  Digital Infrastructures 1.3 Goal and Scope of the report The main goal of this report is to associate the security requirements for OES, adopted by the Cooperation Group, with information security standards applicable to the sectors of interest as mentioned above and referred to in the Annex II of the NIS Directive. In order to achieve a common, baseline, cross-sector (horizontal) framework of security measures for the OES at EU level, the security requirements for the OES are primarily mapped to the most frequently used international information security standards by operators in each of these sectors. 1.4 Methodology Initially, ENISA conducted a desktop research of international information security standards, guidelines and good practices, relevant to security measures applicable by OES of the business sectors in scope. The final output of the desktop research is contained in the tables [Table 1,Table 2,Table 4,Table 6,Table 8,Table 9, Table 11, Table 12, Table 14, Table 16 ,Table 17 ], depicting the existing information security standards and good practices for each sector, as found in section 2. The next step of the methodology was to map the identified and agreed by the Cooperation Group security measures for OES to the most commonly applicable sector specific standards by the operators of the business sectors. Finally, the security measures were mapped to the three (3) most frequently used international standards, across all the sectors of interest, as found below:  ISO 27001 ISO/IEC 27001 , part of the growing ISO/IEC 27000 family of standards, is an Information Security Management Systems (ISMS) standard published in October 2013 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). ISO/IEC 27001 formally specifies a management system that is intended to bring information security under explicit management control. 06 Mapping of OES Security Requirements to Specific Sectors December 2017  ANSI ISA/IEC 62443 ISA (International Society of Automation) and IEC have developed the IEC 62443 series of standards in order to address the need to design cybersecurity robustness and resilience into industrial automation control systems (IACS). The concept of industrial automation and control systems electronic security is applied in the broadest possible sense, encompassing all types of plants, facilities, and systems in all industries. IEC 62443 targets people, processes, systems, solutions and components/products.  NIST Framework for Improving Critical Infrastructure Cybersecurity This Framework enables organizations – regardless of size, degree of cybersecurity risk, or cybersecurity sophistication to apply the principles and best practices of risk management to improving the security and resilience of critical infrastructure. The Framework provides structure to today’s multiple approaches to cybersecurity by assembling standards, guidelines, and practices that are working effectively in industry today. Moreover, because it references globally recognized standards for cybersecurity, the Framework can also be used by organizations located outside the United States and can serve as a model for international cooperation on strengthening critical infrastructure cybersecurity. The above standards were selected according to:  the results of the survey that was filled in by the representatives of EU Member States, in the th th Cooperation Group. The survey was launched on 6 March 2017 and it was active until 15 May 2017. More specifically, ISO 27001 was emerged by the survey as the most commonly followed standard.  the input provided during phone interviews by EU operators in the sectors; referred to the NIS Directive. More specifically, o ANSI ISA/IEC 62443 is the most applicable international standard for IACS (Industrial Automation and Control Systems), as they constitute the core components of the OES; o NIST Cybersecurity Framework is followed by some European utilities which operate in U.S. and therefore they need a common denominator and ground policy. 07 Mapping of OES Security Requirements to Specific Sectors

text: December 2017

text: 2 Mapping of Baseline Security Measures for OESs per sector

text: With the adoption of the Directive on security of Network and Information Systems (NIS) in 2016, a baseline level of security in network and information systems is aimed to be achieved at EU level. This will support the broader vision of the EU Digital Single Market , whilst protecting the interests of the European society and the provision of essential services to European citizens. The following subsections present the mapping of the proposed security measures by the NIS Directive Cooperation Group to industry specific standards that are usually applied by operators covering the sectors under scope. 2.1 Energy The European Union's prosperity and security hinges on a stable and abundant supply of energy. As energy is a vital part of Europe's economy and of modern lifestyles, European citizens expect uninterrupted flows of energy and access to energy sources. Numerous policies have been introduced to secure and create a European sustainable energy network, like the NIS Directive. The NIS Directive distinguishes the subsectors of Electricity, Oil and Gas for the Energy sector. Table 1 below, lists international standards and good practices applicable across all the Energy subsectors of interest. It is the outcome of the conducted desktop research and it is not an all-inclusive table, as it is mainly based on bibliography.

text: STANDARDS GOOD PRACTICES

text:  Detailed Measures – Cybersecurity for Industrial Control Systems – ANSSI (France)  Good Practice Guide Process Control and SCADA Security – CPNI  AMI System Security Requirements updated – UCAIUG:  ISO 27001 Information technology — Security AMI‐SEC‐ASAP techniques — Information security management  BDEW whitepaper – Requirements for secure controls systems — Requirements and telecommunications systems – Bundesverband der  ANSI/ISA, Series “ISA-62443: Security for industrial energie un Wasserwirtschaft automation and control system”  Information security baseline requirements for process  NIST Framework for Improving Critical Infrastructure control, safety and support ICT systems – OLF Cybersecurity  Twenty Critical Controls for Effective Cyber Defence: Consensus Audit Guidelines  Catalog of Control Systems Security: Recommendations for Standards Developers – USA DHS  21 Steps to Improve Cyber Security of SCADA Networks – US DOE

text: Table 1: International standards and good practices applicable across the Energy sector.

text: According to feedback provided by Energy operators, the most frequently applicable standards for the energy sector, in its entirety, are ISO 27001 and ISA/IEC 62443. The mapping of the security measures to the above listed standards is depicted in section 3, Table 22.

text: 08 Mapping of OES Security Requirements to Specific Sectors

text: December 2017

text: In the following subsections, electricity, oil and gas specific standards and good practices along with the mapping to the security measures are presented. 2.1.1 Electricity Table 2 below, lists international standards and good practices applicable across the Electricity subsector. SUB- STANDARDS GOOD PRACTICES SECTOR

text:  NIST SP800-82 Guide to Industrial Control  Cybersecurity model electricity subsector Systems (ICS) Security cybersecurity capability maturity model (es-  ISO 27019 -- Information security management c2m2) - U.S. Department of Energy guidelines based on ISO/IEC 27002 for process  NISTR 7628 - Guidelines for Smart Grid Cyber control systems specific to the energy utility Security: Vol. 1, Smart Grid Cyber Security industry Strategy, Architecture, and High-Level

text: Electricity

text:  NERC CIP Series "Critical Infrastructure Requirements Protection Cyber Security": CIP–002 to CIP-011.  ENISA Appropriate security measures for Smart  IEEE STANDARD 1402-2000 - IEEE Guide for Grids - ENISA Electric Power Substation Physical and Electronic  Best practices for handling smart grid cyber Security security - California Energy Commission  IEC 61850 - Power Utility Automation

text: Table 2: International standards and good practices applicable across the Electricity subsector

text: Table 3 illustrates the mapping of security measures with Electricity specific standards, such as:  NIST SP 800-82 Rev. 2 (Guide to Industrial Control Systems (ICS) Security) provides guidance on how to secure Industrial Control Systems (ICS) and is usually followed by EU operators as a good practice;  ISO 27019 is the information security management guidelines based on ISO/IEC 27002 for process control systems specific to the energy utility industry;  NERC CIP (North American Electric Reliability Corporation Critical Infrastructure Protection) is a set of requirements for North America's bulk electric system. Nevertheless, it is followed as well by EU operators that extend their business in U.S.

text: SECURITY D/N DOMAIN NAME NIST SP-800-82 ISO 27019 NERC CIP MEASURE

text: Part 1 – Governance and Ecosystem

text: Information 3. ICS Risk Management Information 14.1.4 Business CIP-002-3 Critical System Security and Assessment 1.1 system security continuity planning Cyber Asset

text: Governance &

text: risk analysis 4.5 Implement an ICS framework Identification

text: Risk Management

text: Security Risk

text: https://csrc.nist.gov/csrc/media/publications/sp/800-82/rev-2/final/documents/sp800_82_r2_second_draft.pdf https://www.iso.org/standard/43759.html http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx

text: 09 Mapping of OES Security Requirements to Specific Sectors

text: December 2017

text: Management 6.2.1 Identification of CIP-002-5 BES Cyber Framework risks related to external System parties Categorization 6.1 Executing the Risk Management CIP-010-2Table R3 – Framework Tasks for Vulnerability Assessments Industrial Control Systems

text: 6.2.14 Risk Assessment

text: CIP-003-6 Cyber Security - Security Management Information 3.3.1 Policy and Controls system security Procedure 5. Security policy policy Vulnerabilities CIP-011-2Table R1 – Information Protection

text: Information 6.1.1 Security system security Assessment and ─ ─ accreditation Authorization

text: Information 3.3 Potential ICS system security ─ ─ Vulnerabilities indicators

text: 10.10.1 Audit logging CIP-003-6—Cyber 6.2.3 Information Security —Security system security 15.3 Information Management Audit and audit systems audit Controls, Compliance Accountability considerations Monitoring Process

text: CIP-004 Cyber Security - Personnel & Training

text: CIP-004-6 Table R1 – Human resource 6.2.1 Personnel 8. Human resource Security Awareness security Security security Program

text: CIP-004-6Table R3– Personnel Risk Assessment Program

text: CIP-002-5.1a Cyber Asset #6.2.7 Media Security — BES Cyber 8. Asset Management Management Protection System Categorization

text: Ecosystem Ecosystem 1.2 ─ 6.2 External parties ─ Management mapping

text: Mapping of OES Security Requirements to Specific Sectors

text: December 2017

text: 6.2.2 Addressing security when dealing Ecosystem with customers ─ ─ relations 6.2.3 Addressing

text: security in third-party agreements

text: Part 2 – Protection

text: CIP-007-6Table R1– 11.4.4 Remote Ports and Services Systems 6.2.4 Configuration diagnostic and configuration Management configuration port CIP-010-2Table R1 – protection Configuration Change Management

text: 5.1 Network 10.6 Network security Segmentation and management CIP-005-5 Table R1 – System Segregation Electronic Security segregation 11.4.5 Segregation in 5.5 Network Perimeter networks IT Security Segregation 2.1

text: Architecture

text: 6.3.3 Audit and Accountability 10.10.2 Monitoring Traffic filtering ─ 6.1.1 Security system use Assessment and Authorization

text: 12.3 Cryptographic controls CIP-011-2 Cyber Cryptography 6.3.4.1 Encryption Security - Information 15.1.6 Regulation of Protection cryptographic controls

text: CIP-007-6Table R5 – System Access Control Administration 6.3.1 Identification and 11.5 Operating system accounts Authentication access control CIP-004-6Table R4– Access Management Program

text: IT Security

text: Administration

text: CIP-007-6Table R5 – System Access Administration Control 10.10.4 Administrator information ─ and operator logs CIP-004-6Table R4– systems Access Management Program

text: December 2017

text: CIP-007-6Table R5 – System Access 6.3.2 Access Control Authentication Control 11. Access control and identification 6.3.1 Identification and CIP-004-6Table R4– Authentication Access Management Program

text: Identity and

text: 2.3 access CIP-007-6Table R5 – management System Access Control

text: CIP-004-6Table R4– Access rights 6.3.2 Access Control 11. Access control Access Management Program

text: CIP-004-6Table R5– Access Revocation

text: 9.2.4 Equipment maintenance IT security CIP-007-6Table R2 – maintenance 6.2.9 Maintenance 12 Information systems Security Patch procedure acquisition, Management development and maintenance

text: IT security

text: maintenance

text: 11.4 Network access control CIP-005-5 Table R2 – 6.3.2 Access Control Interactive Remote access 11.4.4 Remote 6.3.1 Identification and diagnostic and Remote Access Authentication configuration port Management protection

text: Physical and CIP-006-6 Cyber environmental 6.2.2 Physical and Security - Physical Physical and 9. Physical and security Environmental Security of BES Cyber environmental security 2.5 environmental Protection Systems security 9.2 Equipment security 6.2.7 Media Protection CIP-014-1 Physical Security

text: Part 3 - Defence

text: CIP-007-6 Table R4 – Security Event 3.3 Potential ICS Monitoring 3.1 Detection Detection ─ Vulnerabilities CIP-007-6 Table R3 –

text: Malicious Code Prevention

text: December 2017

text: 11.5.1 Secure log-on CIP-007-6 Table R4 – 5.16 Monitoring, procedures Logging Security Event Logging,and Auditing Monitoring

text: 10.2.2 Monitoring and review of third party CIP-007-6 Table R4 – Logs correlation 5.16 Monitoring, services Security Event and analysis Logging, and Auditing 10.10.2 Monitoring Monitoring

text: system use

text: CIP-008-5 Table R1 – Cyber Security Incident Response Information 5.17 Incident Detection, Plan Specifications 13 Information security system security Response, and System CIP-008-5 Table R2 – incident management incident response Recovery Cyber Security

text: Incident Response Plan Implementation and Testing

text: Computer security

text: CIP-008 Cyber 3.2 incident Security - Incident

text: management

text: 13.1 Reporting Reporting and Incident report 6.2.8 Incident Response information security Response Planning events and weaknesses CIP-001 Sabotage Reporting

text: 6.1.6 Contact with CIP-008-5 Table R3 – Communication authorities Cyber Security with competent ─ Incident Response authorities 6.1.7 Contact with Plan Review, Update, special interest groups and Communication

text: Part 4 - Resilience

text: 6.1.2 Planning CIP-013-1 Cyber Business 6.1.3 Risk Assessment 14. Business continuity Security - Supply continuity management Chain Risk management 6.1.5 Program Management Management

text: Continuity of

text: 4.1 Operations CIP-009-1 Cyber 14.1 Information Security - Recovery Disaster recovery 6.2.3 Contingency security aspects of Plans for Critical management Planning business continuity Cyber Assets management CIP-009-5 Cyber Security - Recovery

text: December 2017

text: Plans for BES Cyber Systems

text: CIP-009-6Table R1 – Recovery Plan Specifications Crisis management 6.2.6 Contingency 14.2 Essential organization Planning emergency services CIP-009-6Table R2 – Recovery Plan Crisis Implementation and 4.2 Management Testing

text: CIP-009-6Table R3 – Crisis management 6.2.6 Contingency 14.2.1 Emergency Recovery Plan process Planning communication Review, Update and Communication

text: Table 3: Mapping of security measures with electricity subsector specific standards

text: 2.1.2 Oil & Gas Protection of the Oil and Gas subsector within EU, but also globally, is considered of highly strategic and economic importance in the light of emerging hybrid threats targeting energy utilities. Table 4 below lists international standards and good practices applicable across the Oil and Gas sectors of interest.

text: SUB-SECTORS STANDARDS GOOD PRACTICES

text:  API STD 1164 - Pipeline SCADA Security  Oil and Natural Gas subsector cybersecurity capability maturity model - (ONG-C2M2)  Chemical Facility Anti-Terrorism  GIE - Gas Infrastructure Europe Security Risk Assessment Oil & Gas 11 Standards (CFATS) Methodology  Control Systems Cyber Security Guidelines for the Natural Gas Pipeline Industry - Interstate Natural Gas Association of America (INGAA)

text: Table 4: International standards and good practices applicable across the Oil and Gas subsectors

text: The most known security framework related to the Oil and Gas subsector is the Chemical Facility Anti-Terrorism Standards (CFATS) program, which is a risk-based performance program that sets the standards for security at the United States highest risk chemical facilities. The CFATS program covers equally both subsectors, while it identifies and regulates ensuring that high-risk chemical facilities have in place security measures to reduce the risks posed against these chemicals. However, the CFATS program does not consider cybersecurity, but safety.

text: December 2017

text: Table 5 illustrates the mapping of security measures with Oil and Gas specific good practices, such as:  API STD 1164 - Pipeline SCADA Security good practice provides guidance to the operators of oil and gas liquids pipeline systems for managing SCADA system integrity and security.  ONG-C2M2 good practice assist oil and natural gas organizations of all types to evaluate and make improvements to their cybersecurity programs.

text: D/N DOMAIN NAME SECURITY MEASURE API STD 1164 ONG-C2M2

text: Part 1 – Governance and Ecosystem

text: 3.4 Risk and Vulnerability Risk Management Information system Assessment Threat and Vulnerability security risk analysis 3.8 Asset Inventory/Categorizing/Tracking Management

text: 1.3 Roles and Responsibilities Information system Cybersecurity Program 3.1 Security Plan security policy Management 3.3 Security Policies

text: Information system security ─ ─ Information System accreditation 1.1 Security Governance

text: & Risk Management

text: Information system ─ ─ security indicators

text: Information system 7.2.2.6 File Audit and Control ─ security audit

text: Human resource 3.2 Personnel Workforce Management security 5.12 Personnel Administration

text: Asset, Change, and Configuration 3.8 Asset Inventory/ Management Asset Management Categorizing/Tracking Situational Awareness

text: 7.3.4 Connections to Third Parties Supply Chain and External Ecosystem mapping for Support Dependencies Management

text: Ecosystem

text: 1.2 Management 3.11 Procurement Supply Chain and External Ecosystem relations 7.3.4 Connections to Third Parties Dependencies Management for Support

text: https://global.ihs.com/doc_detail.cfm?document_name=API%20STD%201164 https://energy.gov/sites/prod/files/2014/03/f13/ONG-C2M2-v1-1_cor.pdf

text: December 2017

text: Part 2 – Protection

text: 3.9 Change Management 3.10.1 System Hardening 3.10.2 Software Patching and Updates 3.10.3 Proper Disposal of Equipment and Media. 5.9 Disabled Non-Required Systems Asset, Change, and Configuration Services configuration Management 5.10 Operating System Tools 7.1.6 Defense in Depth 7.2.2.4 White Listing 7.2.2.5 Host/Endpoint Security 7.2.2.6 File Audit and Control 8.2.1 Network Protocols 7 Network Design/Security and Data Interchange 7.1 Network Design

text: IT Security

text: 2.1 Architecture 7.1.1 Interconnected Business and SCADA Networks 7.1.2 Communication Demarcation Points 7.1.3 Firewalls 7.1.4 Demilitarized Zone (DMZ) 7.1.5 Dual-Homed Computers System segregation 7.1.7 Firewall Management ─ 7.1.8 Virtualization 7.1.8.2 Hypervisor and Virtual Machine Services 7.1.8.3 Networking 7.1.8.4 Resource Allocation 7.2 Network Management 7.3.1 Connections Between the SCADA Control Center Operational Facilities, Data Center, and Telecommunications Center

text: December 2017

text: 7.3.2 Connections Between the SCADA System and Business Networks 7.3.3 Connections Between the SCADA System and Business Partners SCADA Systems

text: 7.3.5 Internet and Business Network Access

text: 7.3.6 Voice Over IP/IP telephony (VoIP/IPT)

text: 7.3.7 Instant Messaging (IM) 7.3.8 Wireless Networking

text: 7.3.9 Audio/Video Conferencing 7.3.10 Video Surveillance

text: 7.3.11 Cloud Computing 8 Field Communication 8.1 Field Device Technology

text: 7.1.7 Firewall Management

text: Traffic filtering 7.1.8.3 Networking ─ 7.3 Data Interchange

text: 7 Network Design/Security and Data Interchange Cryptography 7.3 Data Interchange ─

text: 8.2.2 Encryption of Data on Accessible Paths

text: 5.3 User Accounts Administration 5.4 Operating System Accounts Identity and Access Management accounts IT Security 5.5 SCADA Accounts 2.2

text: Administration

text: 5.4 Operating System Accounts Administration ─ information systems 5.5 SCADA Accounts

text: 5.3 User Accounts 5.6 Password Controls Authentication and Identity and Access Management Identity and access identification 5.7 Multi-factor Authentication 2.3

text: management

text: 5.8 Biometrics

text: Access rights 5.1 Restricted Access Identity and Access Management

text: December 2017

text: 5.2 Logical Access Control to Control Systems and Control Networks 5.11 Device Access

text: 7.1.8.1 Permissions 7.2 Network Management

text: 8.2 System Access 8.2.3 Casual User Access to Network

text: 3.5 New or Replacement System Security Design 3.10 Operating System and Application Updates IT security 3.10.2 Software Patching and maintenance ─ Updates procedure 3.10.3 Proper Disposal of Equipment and Media. 9 Annual Review, Reassessment, and Update

text: IT security 5.1 Restricted Access 2.4

text: maintenance

text: 5.2 Logical Access Control to Control Systems and Control Networks

text: 5.11 Device Access 7.2 Network Management Remote access ─ 7.3.4 Connections to Third Parties for Support

text: 8.2.4 Remote Access to SCADA Components

text: 8.2.5 Dial-up Modem Access for Maintenance

text: Physical and Physical and 2.5 environmental environmental 4 Physical Security ─ security security

text: Part 3 - Defence

text: 7.2.2 Network Security 3.1 Detection Detection 7.2.2.1 Intrusion Detection and Situational Awareness Prevention Systems (IDPS)

text: December 2017

text: 7.2.2.2 Malware Detection and Avoidance

text: 7.2.1 Network Monitoring & Logging Advanced Threat Protection Situational Awareness

text: 7.2.2 Network Security

text: 7.2.2 Network Security

text: 7.2.2.1 Intrusion Detection and Logs correlation and Prevention Systems (IDPS) ─ analysis 7.2.2.3 Security Information and Event Management (SIEM)

text: Information system Event and Incident Response, security incident 3.7 Incident Response Plan (IRP) Continuity of Operations response

text: Event and Incident Response, Incident report ─ Continuity of Operations

text: Computer security

text: 3.2 incident 6 Information Distribution

text: management

text: 6.1 Confidential Communication with Information Sharing and competent 6.2 Restricted Communications authorities 6.3 Internal Use Only

text: 6.4 Public

text: Part 4 - Resilience

text: Business continuity Event and Incident Response, 3.6 Business Continuity Plan (BCP) management Continuity of Operations

text: Continuity of

text: Operations

text: Disaster recovery ─ ─ management

text: Crisis management ─ ─ organization 4.2 Crisis Management Crisis management ─ ─ process

text: Table 5: Mapping of security measures with Oil and Gas subsector specific standards

text: Finally, according to the input gathered by Oil and Gas operators in EU, the most applicable information security standards are ISO 27001, the NIST Cybersecurity Framework and ISA/IEC 62443. The mapping of security measures to these standards is presented in section 3, Table 22. 2.2 Transport According to the NIS Directive, the Transport sector is divided in the following subsectors: Mapping of OES Security Requirements to Specific Sectors December 2017  Air Transport;  Rail Transport;  Water Transport;  Road Transport. Due to a great range of threats, cyber security and physical safety of the transport sector can no longer be treated separately . Among the good practices for the transport sector, the “Roadmap to Secure Control Systems in the Transportation Sector” is included, while there are no specific cybersecurity standards. Therefore, risk management methodologies and security standards usually incorporate measures of both natures, cyber and physical as well. Besides ISO 27001 and ISA/IEC 62443 standards that are mainly followed by transport operators, in the following sections, the mapping of security measures to specific subsector standards is presented respectively. 2.2.1 Air Transport Table 6 lists international standards and good practices applicable across the Air Transport sector.

text: SUB-SECTOR STANDARDS GOOD PRACTICES

text:  ICAO Aviation Security Manual - Document 8973  AIAA (The American Institute of Aeronautics and

text: (Restricted Access) Astronautics) The Connectivity Challenge:

text:  ARINC 811 Commercial aircraft information Protecting Critical Assets in a Networked World security concepts of operations and process  Information Security Certification and framework Accreditation (C&A) Handbook – FAA

text: Air Transport

text:  EUROCAE ED-201 – 204 Aeronautical Information  FAA Issue Paper, Aircraft Electronic Systems System Security (AISS) Framework Security Protection from Unauthorized External Access  RTCA DO-326 Airworthiness security process  FAA Aircraft systems information security specifications protection overview

text: Table 6: International standards and good practices applicable across the Air Transport sector

text: Airports, Airlines and Air Navigation Service providers mainly use a risk based approach to security and rely on international information security standards, such as ISO27001 and NIST Cybersecurity Framework. Table 7 illustrates the mapping of security measures to Air transport specific standards and good practices, such as:  ICAO Aviation Security Manual - Document 8973 (Restricted Access) gives a layout on cyber threats to critical aviation information and communication technology systems. Guidance material on areas such as unpredictability, behaviour detection techniques, landside security, and screening of persons other than passengers have been incorporated in the latest version.  AIAA (The American Institute of Aeronautics and Astronautics) The Connectivity Challenge: Protecting Critical Assets in a Networked World outlines a framework for helping the aviation Mapping of OES Security Requirements to Specific Sectors

text: December 2017

text: community build a roadmap for ensuring that aviation’s critical infrastructure is secure and able to withstand and rapidly recover from the evolving threats. This framework addresses all security levels including know, prevent, detect, respond and recover.

text: D/N DOMAIN NAME SECURITY MEASURE ICAO AIAA

text: Part 1 – Governance and Ecosystem

text: Information system #3 Security Measures for #3 Define Operational Principals security risk analysis Infrastructure

text: Information system #3 Security Measures for #3 Define Operational Principals security policy Infrastructure

text: Information system #3 Security Measures for #5 Establish common cyber security Infrastructure standards for aviation systems accreditation

text: Information System

text: 1.1 Security Governance Information system & Risk Management ─ ─ security indicators

text: Information system ─ ─ security audit

text: Human resource #6 Establish a Cybersecurity ─ security Culture

text: Asset Management #4 Define Design Principals #4 Define Design Principals

text: #1 Supply Chain Security for #7 Strengthen the defensive Ecosystem mapping Hardware and Software system

text: Ecosystem

text: Management

text: #1 Supply Chain Security for #7 Strengthen the defensive Ecosystem relations Hardware and Software system

text: Part 2 – Protection

text: Systems #1 Supply Chain Security for ─ configuration Hardware and Software

text: System segregation #3 Security Measures for #4 Define Design Principals Infrastructure

text: IT Security

text: Architecture

text: Traffic filtering #3 Security Measures for #7 Strengthen the defensive

text: Infrastructure system

text: Cryptography #3 Security Measures for #7 Strengthen the defensive

text: Infrastructure system

text: IT Security Administration #7 Strengthen the defensive 2.2 ─ Administration accounts system

text: December 2017

text: Administration ─ ─ information systems

text: Authentication and #3 Security Measures for ─ identification Infrastructure

text: Identity and access

text: management

text: Access rights #3 Security Measures for ─ Infrastructure

text: IT security #3 Security Measures for maintenance ─ Infrastructure IT security procedure 2.4

text: maintenance

text: Remote access #3 Security Measures for ─ Infrastructure

text: Physical and Physical and

text: 2.5 environmental environmental ─ ─

text: security security

text: Part 3 - Defence

text: Detection #7 Strengthen the defensive #2 Cyber Attack Incident Records system

text: Logging #7 Strengthen the defensive 3.1 Detection ─ system

text: Logs correlation and #7 Strengthen the defensive ─ analysis system

text: Information system

text: security incident #2 Cyber Attack Incident Records #2 Provide incident response

text: response

text: Computer security

text: 3.2 incident Incident report #2 Cyber Attack Incident Records #2 Provide incident response

text: management

text: Communication with

text: competent #2 Cyber Attack Incident Records #2 Provide incident response

text: authorities

text: Part 4 - Resilience

text: Business continuity #3 Security Measures for ─ management Infrastructure

text: Continuity of

text: Operations

text: Disaster recovery #3 Security Measures for ─ management Infrastructure

text: Crisis management #3 Security Measures for 4.2 Crisis Management ─ organization Infrastructure

text: December 2017

text: Crisis management #3 Security Measures for ─ process Infrastructure

text: Table 7: Mapping of security measures with the Air Transport sector specific standards

text: 2.2.2 Rail Transport The majority of security standards and frameworks in the domain of Rail Transport is dealing mainly with safety aspects, rather than cybersecurity challenges which may affect eventually the safety and security of modern signalling and train control systems. Table 8 below, lists international information security standards and good practices applicable to the Rail Transport subsector.

text: SUB-SECTOR STANDARDS GOOD PRACTICES

text:  ISO 27001 Information technology — Security techniques — Information security management  UK Rail Cyber Security Guidance to Rail Transport systems — Requirements Industry  ANSI/ISA, Series “ISA-62443: Security for industrial automation and control system”

text: Table 8: International standards and good practices applicable across the Rail Transport subsector

text: According to the feedback taken by EU rail operators, the most commonly applicable standards regarding network and information systems security are ISO 27001 and ANSI ISA/IEC 62443. The mapping of the proposed security measures with the above mentioned standards is presented in section 3, Table 22. 2.2.3 Water Transport ICT systems supporting maritime operations, extending from port management to ship communication, are generally highly complex and employ a variety of ICT technologies. There is lack of holistic consideration of cybersecurity in this particular working environment. Table 9 lists some international standards and good practices applicable in the Water Transport subsector taking into account security and mainly safety aspect.

text: SUB-SECTOR STANDARDS GOOD PRACTICES

text: 18  BIMCO Guidelines on Cyber Security on  International Safety Management (ISM) Code)  IMO interim guidelines on maritime cyber risk board Ships - The Guidelines on Cyber management security on board ships

text: Water

text:  International Ship and Port Facility Security (ISPS) Code Transport  DNVGL-RP-0496 (DNV-GL, 2016) Cyber  ISO 27001— Information security management systems security resilience management for  ANSI/ISA, Series “ISA-62443: Security for industrial ships and mobile offshore units in automation and control system operation

text: http://www.imo.org/en/Publications/PublishingImages/PagesfromEB117E.pdf & http://www.imo.org/en/OurWork/humanelement/safetymanagement/pages/ismcode.aspx

text: December 2017

text:  IEC 62351:2017 SER - Power systems management and  Cyber-enabled ships: ShipRight associated information exchange - Data and procedure – autonomous ships communications security  Cyber-enabled ships: Deploying  IEC 61162 - Digital interfaces for navigational information and communications equipment within a ship technology in shipping – Lloyd’s  ISO 13613:2011 - Ships and marine technology -- Register’s approach to assurance Maintenance and testing to reduce losses in critical  United States coast guard – Cyber systems for propulsion Strategy Draft guidelines on maritime  ISO 14885:2014 - Large yachts -- Diesel engines for cyber risk management main propulsion and essential auxiliaries -- Safety  The Tanker Management and Self requirements Assessment (TMSA) is a best practice guide for ship operators whose latest version (TMSA 3) includes a new element about cybersecurity for both vessels and onshore

text: Table 9: International standards and good practices applicable in the Water Transport subsector

text: In the current regulatory context for the water transport subsector, either at regional or national level, there is very little consideration given to cyber security elements . According to the input taken by Water Transport operators, Table 10 illustrates the mapping of security measures to Water transport specific standards and good practices, such as:  Cybersecurity On-board Ships is a guideline for cybersecurity on board and it is made by the cooperation of BIMCO, CLIA, ICS, INTERCARGO, INTERTANKO, OCIMF and IUMI.

text: CYBERSECURITY ONBOARD SHIPS (BIMCO, CLIA, ICS, INTERCARGO, D/N DOMAIN NAME SECURITY MEASURE INTERTANKO, OCIMF AND IUMI)

text: Part 1 – Governance and Ecosystem

text: Information system # 2.1 Determination of vulnerability security risk analysis # 2.2 Risk assessment made by the company

text: Information system ─ security policy

text: Information System

text: 1.1 Security Governance ─ Information system

text: & Risk Management

text: security accreditation

text: ─ Information system security indicators

text: https://www.hklaw.com/publications/Coast-Guard-DHS-Mandate-Cybersecurity-Reporting-Move-to-Require-Maritime- Cybersecurity-Programs-07-20-2017/ & http://www.ubak.gov.tr/BLSM_WIYS/DISGM/tr/HTML/20130304_142647_66968_1_67502.pdf The Guidelines on Cybersecurity onboard ships refer exclusively to cybersecurity for vessels | http://www.icsshipping.org/docs/default-source/resources/safety-security-and-operations/guidelines-on-cyber-security-onboardships.pdf?sfvrsn=16

text: December 2017

text: ─ Information system security audit

text: Human resource # 3.2.1 Training and awareness security

text: #1.1 Plans and procedures Asset Management #3.1 Ship to shore interface

text: Ecosystem mapping # 2.3 Third party risk assessments

text: Ecosystem

text: Management

text: Ecosystem relations # 2.3 Third party risk assessments

text: Part 2 – Protection

text: # 3.1.1 Limitation to and control of network ports, protocols and Systems services configuration # 3.1.2 Configuration of network devices such as firewalls, routers and

text: switches

text: # 3.1.3 Secure configuration for hardware and software

text: # 3.1.4 Email and web browser protection

text: IT Security

text: 2.1 # 3.1.10 Secure network design

text: Architecture

text: System segregation # 3.1.10 Secure network design

text: Traffic filtering # 3.1.5 Satellite and radio communication

text: Cryptography ─

text: IT Security Administration # 3.1.3 Secure configuration for hardware and software

text: Administration accounts # 3.2.4 Use of administrator privileges

text: Administration # 3.1.3 Secure configuration for hardware and software information systems

text: Authentication and # 3.1.12 Boundary defence Identity and access identification 2.3

text: management

text: Access rights ─

text: IT security # 3.1.9 Application software security

text: maintenance # 3.2.2 Upgrades and software maintenance

text: IT security

text: 2.4 procedure # 3.2.3 Anti-virus and anti-malware tool updates

text: maintenance

text: Remote access # 3.1.8 Wireless access control

text: Physical and Physical and # 3.1.11 Physical security 2.5 environmental environmental # 3.1.12 Boundary defence security security

text: Part 3 - Defence

text: December 2017

text: Detection # 3.1.6 Malware defences

text: ─ Logging 3.1 Detection ─ Logs correlation and analysis

text: ─ Information system security incident response

text: Computer security

text: ─ 3.2 incident Incident report

text: management

text: Communication with competent # 4.3 Investigate cyber incidents authorities

text: Part 4 - Resilience

text: Business continuity # 3.1.7 Data recovery capability management # 4.1 Response Plan

text: Continuity of

text: Operations

text: Disaster recovery # 4.2 Recovery management

text: Crisis management # 3.2.7 Obtaining support from ashore and contingency plans organization 4.2 Crisis Management Crisis management # 4.2 Recovery process

text: Table 10: Mapping of security measures with the Water Transport sector specific standard

text: ISO 27001 and ANSI ISA/IEC 62443 are among the most applicable standards for network and information systems security in the domain. The mapping with these standards is provided below in section 3, Table 22. 2.2.4 Road Transport Several initiatives led to defining guidelines or rules to implement security in the automotive industry , and other initiatives asked for collaboration on the security topics from the automotive industry . Although some of them are well under development, like ISO/AWI 21434 (Road Vehicles -- Automotive Security

text: https://www.automotiveisac.com/best-practices/ https://wiki.unece.org/download/attachments/40009763/%28ITS_AD-10-11- Rev1%29%20Revised%20draft%20of%20guideline%20on%20cybersecurity%20and%20data%20protection.pdf?api=v2 https://www.iamthecavalry.org/domains/automotive/5star/

text: December 2017

text: Engineering) , safety and security considerations are currently handled by the TC22/SC3/WG16 committee under the development of ISO 26262 . Table 11 lists international standards and good practices applicable across the Road Transport subsector.

text: SUB-SECTOR STANDARDS GOOD PRACTICES

text:  SAE J3061 Cybersecurity Guidebook for Cyber- Physical Vehicle Systems  SAE J3101 Requirements for Hardware- Protected Security for Ground Vehicle Applications (WiP)  ISO 15031 Road Vehicles - Communication between. vehicle and external equipment for  ENISA Cyber Security and Resilience of smart emissions-related diagnostics. Part 7: Data link cars – ENISA security  Auto ISAC, Automotive Information Sharing and  ISO 15764 Road Vehicles - Extended data link Analysis Center, Best Practices Road security  Five Star Automotive Cyber Safety Program, I Transport  ISO/AWI 21434 - Road Vehicles -- Automotive Am The Cavalry Security Engineering  Guideline on cybersecurity and data protection  ISO 26262-1:2011 - Road vehicles -- Functional of connected vehicles and vehicles with ADT – safety UNECE  TS 102 940 Intelligent Transport Systems (ITS); Security; ITS communications security architecture and security management  TS 103 096-1 to TS 103 096-3: Intelligent Transport Systems (ITS);  TR 103 061-6 Intelligent Transport Systems (ITS); Testing; Conformance test specifications for ITS Security; Part 6: Validation report

text: Table 11: International standards and good practices applicable across the Road Transport subsector

text: According to the input taken by EU road transport operators, SAE J3061 - Cybersecurity Guidebook for Cyber- Physical Vehicle Systems has a predominant position, as it describes a cybersecurity process framework according to which an organization can develop an internal process for designing and building cybersecurity in-vehicle systems. As this standard is not publicly available, the mapping of security measures to this standard is not presented. Nevertheless, ISO 27001 is the most applicable standard for both vehicle and road-side infrastructure, while ANSI ISA/IEC 62443 is usually applied in the road side infrastructure. The mapping of the security measures to these two standards is provided below in section 3, Table 22. 2.3 Financial and Banking Table 12 lists international standards and good practices applicable across the Financial and Banking sector.

text: https://www.iso.org/standard/70918.html https://www.iso.org/obp/ui/#iso:std:iso:26262:-1:en

text: December 2017

text: SECTOR STANDARDS GOOD PRACTICES

text:  ISO/TR 13569:2005  Gramm–Leach–Bliley Act  Payment Card Industry Data Security Standard  Sarbanes–Oxley Act (PCI DSS)  27  Payment services (PSD 2) - Directive (EU) Basel II 2015/2366  Draft Guidelines on the security measures for Financial &  26 operational and security risks of payment services EBA on the security of internet payments Banking 28  ISO/IEC 27015:2012 Information technology - under PSD2 Security techniques – Information security  CPMI-IOSCO Guidance on cyber resilience for management guidelines for financial services financial market infrastructure  30]  American National Standards Institute (ANSI) X9 SEC OCIE Cybersecurity series

text: Table 12: International standards and good practices applicable across the Financial and Banking sector

text: According to input taken by Financial and Banking institutions in EU, Table 13, illustrates the mapping of security measures to sector specific standards and good practices, such as:  ISO/TR 13569:2005 Financial services -- Information security guidelines provides guidelines on the development of an information security programme for institutions in the financial services industry. Considerations for the selection and implementation of security controls, and the elements required to manage information security risk within a modern financial services institution are discussed.  Gramm-Leach-Bliley Act (GLB Act or GLBA) , also known as the Financial Modernization Act of 1999, is a federal law enacted in the United States to control the ways that financial institutions deal with the private information of individuals. It requires financial institutions – companies that offer consumers financial products or services like loans, financial or investment advice, or insurance – to explain their information-sharing practices to their customers and to safeguard sensitive data.  Sarbanes-Oxley Act of 2002 (SOX) is an act passed by U.S. Congress in 2002 to protect investors from the possibility of fraudulent accounting activities by corporations. The SOX Act mandated strict reforms to improve financial disclosures from corporations and prevent accounting fraud.

text: Basel II or International Convergence of Capital Measurement and Capital Standards is a set of recommendations issued by the Basel Committee on Banking Supervision. Basel II is considered by the Basel Committee to be instrumental in assessments of risk provided by banks’ internal systems as inputs to capital calculations. Its relevance is complicated, since it is partially dependant on whether or not local governments have adopted it into their local regulations (or if Basel I has), and how this adoption has occurred. [https://www.enisa.europa.eu/topics/threat-risk-management/riskmanagement/current-risk/laws-regulation/corporate-governance/basel-ii] The mapping to Basel II will be added in the next version of this document.

text: http://www.eba.europa.eu/documents/10180/1836621/Consultation+Paper+on+the+security+measures+for+operational+and+ security+risks+of+payment+services+under+PSD2+%28EBA-CP-2017-04%29.pdf http://www.bis.org/cpmi/publ/d146.pdf https://www.sec.gov/spotlight/cybersecurity https://www.iso.org/standard/37245.html https://www.gpo.gov/fdsys/pkg/PLAW-106publ102/pdf/PLAW-106publ102.pdf http://www.ey.com/Publication/vwLUAssets/ey-the-sarbanes-oxley-act-at-15/$File/ey-the-sarbanes-oxley-act-at-15.pdf

text: Mapping of OES Security Requirements to Specific Sectors December 2017  Payment services (PSD 2) -

text: Directive (EU) 2015/2366

text: seeks to improve the existing EU rules for electronic payments. It takes into account emerging and innovative payment services, such as internet and mobile payments. It sets out rules concerning strict security requirements for electronic payments and the protection of consumers' financial data, guaranteeing safe authentication and reducing the risk of fraud; the transparency of conditions and information requirements for payment services; the rights and obligations of users and providers of payment services.  Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations that handle branded credit cards from the major card schemes. The PCI Standard is mandated by the card brands and administered by the Payment Card Industry Security Standards Council. The standard was created to increase controls around cardholder data to reduce credit card fraud. Mapping of OES Security Requirements to Specific Sectors

text: December 2017

text: DOMAIN SECURITY D/N PSD2 PCI-DSS ISO/TR 13569:2005 GLBA SOX NAME MEASURE

text: Part 1 – Governance and Ecosystem

text: 8.1 Processes

text: Information 8.2 Risk assessment system security ─ § 314.1 (a) Purpose ─ 36: process risk analysis Guideline 1

text: Governance 9.1 Risk mitigation

text: 5.1 Purpose Operational and security risk 5.2 Legal and regulatory Information Security Requirement 12 § 314.1 (b) Scope Information Information management Maintain a policy that compliance Policy System system security framework addresses information § 314.3 (a) Information Security policy 5.3 Development Records Retention 1.1 security for all personnel Security Program Governance & Policy and Procedures 5.4 Documentation

text: Risk

text: hierarchy

text: Management

text: Information 8.3 Security Acquisition and Guideline 6: Testing of § 314.3 (b) (1) Security of planning process system security ─ recommendations and Customer Information security measures accreditation risk acceptance Security Standards

text: Information Guideline 7: Situational Requirement 11 § 314.3 (a) Information Policy and Procedure system security awareness and Regularly test security 13.2 Security compliance Security Program Compliance indicators continuous learning systems and processes

text: Taken from Art 95 Management of operational and Security risks Mapping of OES Security Requirements to Specific Sectors

text: December 2017

text: Threat landscape and

text: situational awareness

text: Guideline 1: Post Implementation

text: Governance Reviews

text: Information Operational and Review of Security system security ─ 12.2 Audit § 314.1 (b) Scope security risk Tests audit management Policy and Procedure framework Compliance

text: Guideline 2: Risk

text: assessment 9.6 Information security Human resource ─ awareness § 314.1 (a) Purpose ─ Identification of security functions, processes 9.7 Human factors

text: and assets

text: Guideline 2: Risk

text: assessment Requirement 6: Develop Asset and maintain secure Management Identification of functions, processes systems and applications

text: and assets

text: Guideline 2: Risk § 314.1 (b) Scope Monitoring Third Party

text: assessment Services § 314.2 (b) Customer Ecosystem Ecosystem 12.4 External service 1.2 ─ Information Third Party Contracting  Identification of Management mapping providers Procedures functions, processes § 314.2 (d) Service Third Party and assets Provider Qualification

text: December 2017

text:  Classification of Vendor Management

text: functions, processes Policy and assets Third Party Risk assessments of Qualification functions, processes and assets § 314.1 (b) Scope Ecosystem 12.4 External service Addressing Risks in ─ relations providers § 314.2 (b) Customer Third Party Contracts Information

text: Part 2 – Protection

text: 10.1 Protecting IT Guideline 2: Risk Requirement 1 Install and maintain a firewall systems assessment configuration to protect 10.3 Software systems Systems cardholder data § 314.3 (a) Information security ─ configuration Security Program Identification of Requirement 6 Develop 10.4 Network and functions, processes and maintain secure network systems and assets systems and applications controls

text: IT Security

text: Architecture

text: Guideline 3: Protection 10.4 Network and System § 314.3 (a) Information Data and Systems ─ network systems ─ segregation Integrity and Security Program controls Confidentiality

text: Guideline 3: Protection § 314.3 (a) Information Traffic filtering ─ 12.2 Audit ─ Security Program

text: December 2017

text: Requirement 4 Encrypt 12.6 Cryptographic

text: transmission of operations § 314.3 (b) (2) Protect

text: Cryptography ─ cardholder data across against Threats or ─ 12.7 Key management open, public networks hazards

text: 12.8 Privacy

text: Guideline 3: Protection Requirement 2 Do not § 314.3 (b) (1) Security of

text: use vendor-supplied Customer Information

text: Administration defaults for system 9.3 Logical access § 314.3 (b) (3) Protect ─ accounts passwords and other control against Unauthorized security parameters Access

text: IT Security

text: Administration

text: Guideline 3: Protection § 314.3 (b) (1) Security of

text: Customer Information Administration 9.3 Logical access information ─ § 314.3 (b) (3) Protect ─ control systems against Unauthorized

text: Access

text: Requirement 8 Identify § 314.1 (b) Scope Authentication and authenticate access 9.3 Logical access § 314.3 (b) (3) Protect and to system components ─ control identification Guideline 3: Protection against Unauthorized Identity and Access

text: 2.3 access

text: management

text: Access control Requirement 3 Protect

text: stored cardholder data 9.3 Logical access Review of Access Access rights § 314.1 (b) Scope control Rights Requirement 7 Restrict

text: access to cardholder

text: December 2017

text: data by business need to § 314.3 (b) (3) Protect know against Unauthorized Access

text: Guideline 2: Risk Requirement 5 Protect assessment all systems against IT security 9.5 Change control malware and regularly § 314.2 (c) Information maintenance ─ Risk assessments of Security Program IT security update anti-virus 13.1 Maintenance 2.4 procedure functions, processes maintenance software or programs and assets

text: Remote access Guideline 3: Protection ─ ─ ─ ─

text: Guideline 3: Protection Requirement 9 Restrict § 314.1 (a) Purpose Physical and Physical and physical access to Physical Protection 11.1 Financial § 314.1 (b) Scope 2.5 environmental environmental cardholder data ─ transaction cards security security § 314.2 (c) Information Security Program

text: Part 3 – Defense

text: Guideline 2: Risk § 314.3 (a) Information Detection ─ 8.1 Detection 13.3 Monitoring assessment Security Program

text: 3.1 Detection Requirement 10 Track § 314.1 (b) Scope Classification of and monitor all access to Logging 8.2 Logging 9.4 Audit journals functions, processes network resources and § 314.3 (a) Information and assets cardholder data Security Program

text: December 2017

text: Logs 8.3 Logs correlation and § 314.3 (a) Information correlation and ─ ─ analysis Security Program analysis

text: 14.1 Managing Events Information § 314.3 (b) (2) Protect system security 14.3 Incident handling Security Incident ─ against Threats or incident Response 14.4 Emergency hazards response problems

text: Computer § 314.3 (b) (2) Protect security

text: Article 96

text: (Incident 14.2 Investigations and Security Incident 3.2 Incident report ─ against Threats or incident Reporting) forensics Response hazards

text: management

text: § 314.3 (b) (2) Protect Communication against Threats or

text: with hazards Security Incident ─ 14.3 Incident handling competent Response authorities § 314.2 (c) Information

text: Security Program

text: Part 4 – Resilience

text: § 314.3 (b) (2) Protect Guideline 5: Business against Threats or Business continuity Continuity of hazards 4.1 continuity ─ ─ ─ Operations Business continuity management § 314.3 (b) (1) Security of management Customer Information

text: December 2017

text: Disaster § 314.3 (b) (2) Protect 12.3 Disaster recovery recovery ─ against Threats or ─ planning management hazards

text: Crisis Guideline 5: Business § 314.3 (b) (2) Protect 6.5 Incident management continuity ─ against Threats or ─ management organization hazards Business continuity Crisis 4.2 management Management Crisis § 314.3 (b) (2) Protect Incident management 6.5 Incident management ─ against Threats or ─ and crisis management process hazards communication

text: Table 13: Mapping with the security measures of the Financial and Banking sector specific standards

text: December 2017

text: 2.4 Healthcare Table 14 lists international standards and good practices applicable across healthcare sector.

text: SECTOR STANDARDS GOOD PRACTICES

text:  ISO 27799:2008 Health informatics - Information security management in health using ISO/IEC 27002  Health Insurance Portability and Accountability Act (HIPPA)  ISO 13485:2003 Medical devices -- Quality management systems – Requirements for regulatory purposes  ISO 80001-1:2010 Application of risk management for IT networks incorporating medical devices  Royal Australian College of General  ETSI eHealth Standard TR 102 764 eHEALTH; Architecture; Healthcare Practitioners (RACGP) Computer Analysis of user service models, technologies and 37 Information Security Standards (CISS) applications supporting eHealth  Digital Imaging and Communications in Medicine (DICOM)  EC Medical Devices Regulation (text agreed by EP and Council – in adoption process)  NIST SP 800-66 An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Guide

text: Table 14: International standards and good practices applicable across Healthcare sector

text: According to input taken by healthcare operators in EU, Table 15, illustrates the mapping of security measures to sector specific standards and good practices, such as:  ISO 27799:2016 gives guidelines for organizational information security standards and information security management practices including the selection, implementation and management of controls taking into consideration the organization's information security risk environment(s). It defines guidelines to support the interpretation and implementation in health informatics of ISO/IEC 27002 and is a companion to that International Standard.  Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the Secretary of the U.S. Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information. The Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) establish a national set of security standards for protecting certain health information that is held or transferred in electronic form. The Security Rule operationalizes the protections contained in the Privacy Rule by addressing the technical and non-technical safeguards that organizations called “covered entities” must put in place to secure individuals’ “electronic protected health information” (e-PHI).

text: http://www.etsi.org/technologies-clusters/technologies/ehealth https://www.iso.org/standard/62777.html https://www.hhs.gov/hipaa/for-professionals/security/index.html?language=es https://www.hhs.gov/hipaa/for-professionals/privacy/index.html?language=es https://www.awwa.org/store/productdetail.aspx?productid=20779

text: December 2017

text: D/N DOMAIN NAME SECURITY MEASURE ISO 27799 HIPAA

text: Part 1 – Governance and Ecosystem

text: 5.1 Management direction for Assigned Security Responsibility information security Information Security Activity 6.1 Internal organization Review Information system security risk analysis Assigned Security Responsibility

text: Risk analysis

text: Risk management

text: 5.1 Management direction for Assigned Security Responsibility information security Information system Information Security Activity security policy 6.1 Internal organization Review

text: Assigned Security Responsibility

text: 5.1 Management direction for Assigned Security Responsibility information security Information Security Activity Information system 6.1 Internal organization Review security 8.1 Responsibility for assets Assigned Security Responsibility accreditation 8.2 Information classification Risk analysis

text: Risk management 1.1 Information System Security Governance 5.1 Management direction for Assigned Security Responsibility & Risk Management information security Information Security Activity 6.1 Internal organization Review Information system security indicators 18.1 Compliance with legal and Assigned Security Responsibility contractual requirements Sanction policy 18.2 Information security reviews Evaluation

text: 5.1 Management direction for Assigned Security Responsibility information security Information Security Activity 6.1 Internal organization Review Information system 7.1 Prior to employment Assigned Security Responsibility security audit 7.2 During employment

text: 7.3 Termination and change of employment

text: 5.1 Management direction for Assigned Security Responsibility information security Information Security Activity Human resource 6.1 Internal organization Review security 7.1 Prior to employment Workforce clearance procedure

text: 7.2 During employment Termination procedures

text: December 2017

text: 7.3 Termination and change of Sanction policy employment Security Training 15.2 Supplier service delivery Response and reporting management Protection from malicious 18.1 Compliance with legal and software contractual requirements Written Contract or Other Arrangement

text: 8.1 Responsibility for assets Integrity Controls 8.2 Information classification Mechanism to Authenticate Electronic Protected Health 8.3 Media Handling Information Accountability Asset Management Device and Media Controls

text: Disposal Encryption and Decryption

text: Encryption

text: 15.1 Information security in supplier relationships Ecosystem mapping ─ 15.2 Supplier service delivery management

text: Ecosystem

text: Management

text: 15.1 Information security in supplier relationships Ecosystem relations ─ 15.2 Supplier service delivery management

text: Part 2 – Protection

text: Systems 13.1 Network security configuration management ─ 13.2 Information transfer

text: System segregation 13.1 Network security management ─ IT Security 13.2 Information transfer 2.1

text: Architecture

text: Traffic filtering 13.1 Network security management ─ 13.2 Information transfer

text: Cryptography 13.1 Network security ─ management

text: December 2017

text: 13.2 Information transfer

text: IT Security Administration ─ ─ Administration accounts 2.2 Administration ─ ─ information systems

text: Authentication and 9.1 Business requirements of Access authorization identification access control Termination Procedures 9.2 User access management Unique User Identification 9.3 User responsibilities Access Establishment and 9.4 System and application access Modification control Authorization and/or supervision

text: Unique User Identification

text: Person or Entity Authentication

text: Automatic Logoff

text: Workstation use

text: Identity and access

text: management

text: Access rights 9.1 Business requirements of Access authorization access control Termination Procedures 9.2 User access management Unique User Identification 9.3 User responsibilities Access Establishment and 9.4 System and application access Modification control Authorization and/or supervision

text: Unique User Identification

text: Person or Entity Authentication

text: Automatic Logoff

text: Workstation use

text: IT security 12.5 Control of operational Integrity Controls maintenance software Mechanism to Authenticate procedure 12.6 Technical vulnerability Electronic Protected Health IT security management Information 2.4

text: maintenance

text: Remote access 13.1 Network security Person or Entity Authentication management

text: 13.2 Information transfer

text: Physical and Physical and 11.1 Secure areas Physical Safeguards environmental 2.5 environmental 11.2 Equipment Access Control and Validation security security Procedures

text: December 2017

text: Authorization and/or supervision Workstation Use

text: Workstation Security Disposal

text: Media Re-use Accountability

text: Part 3 - Defence

text: Detection 12.4 Logging and monitoring Information Security Activity Review

text: Logging 12.4 Logging and monitoring Audit controls 12.7 Information systems audit 3.1 Detection considerations

text: Logs correlation and 12.4 Logging and monitoring  Audit controls analysis 12.7 Information systems audit considerations

text: Information system 16.1 Management of information Information Security Activity security incident security incidents and Review response improvements Protection Against Malicious Software

text: Data Backup Plan Computer security Testing and Revision Procedures 3.2 incident

text: management

text: Incident report 16.1 Management of information Information Security Activity security incidents and Review improvements

text: Communication with competent ─ ─ authorities

text: Part 4 - Resilience

text: Business continuity 17.1 Information security Contingency Plan management continuity Testing and Revision Procedures 17.2 Redundancies Disaster Recovery Plan

text: Continuity of

text: 4.1 Applications and Data Criticality

text: Operations

text: Analysis

text: Disaster recovery 17.1 Information security Disaster Recovery Plan management continuity

text: December 2017

text: 17.2 Redundancies

text: Crisis management 17.1 Information security Contingency Plan organization continuity Testing and Revision Procedures 17.2 Redundancies Disaster Recovery Plan Applications and Data Criticality Analysis 4.2 Crisis Management Crisis management 17.1 Information security Contingency Plan process continuity Testing and Revision Procedures 17.2 Redundancies Disaster Recovery Plan Applications and Data Criticality Analysis

text: Table 15: Mapping of security measures with Healthcare sector specific standards

text: 2.5 Drinking Water Supply & Distribution Table 16 below, lists international information security standards and good practices applicable to the Drinking Water Supply and Distribution sector.

text: SECTOR STANDARDS GOOD PRACTICES

text:  ISO 27001 Information technology — Security techniques — Drinking  ANSI/AWWA G430-09/“Security Water Information security management systems — Requirements Practices for Operations and  ANSI/ISA, Series “ISA-62443: Security for industrial Supply and Management” Distribution automation and control system”

text: Table 16: International standards and good practices specific to the Drinking Water Supply & Distribution sector

text: According to the input by EU drinking water operators, the most applicable standards for this sector are ISO-27001 and ISA/IEC62443, for which the mapping with the security measures is presented in section 3, Table 22. Nevertheless, it’s worth mentioning the standard ANSI/AWWA G430-09/“Security Practices for Operations and Management” published by the American Water Works Association which purpose is to define the minimum requirements for a protective security program for a water or wastewater utility, that will promote the protection of employee safety, public health, public safety, and public confidence. The ANSI/AWWA G430-09 standard is applied in United States and it is not publicly available. 2.6 Digital Infrastructures Table 17 lists international standards and good practices specific to the Digital Infrastructures.

text: December 2017

text: SECTOR STANDARDS GOOD PRACTICES

text:  Technical guidance on the security  ISO/IEC 27011:2008 Information technology -- Security Digital measures for Telcos in

text: Article 13

text: a, techniques -- Information security management guidelines ENISA Infrastructure for telecommunications organizations based on ISO/IEC  Best Practices – IX-F 27002

text: Table 17: International standards and good practices specific to the Digital Infrastructures sector

text: According to input taken by Digital Infrastructures operators in EU, Table 18, illustrates the mapping of security measures to sector specific standards, such as:  ISO/IEC 27011:2008 which refers to Information security management guidelines for telecommunications organizations and it is based on ISO/IEC 27001:2013.

text: D/N DOMAIN NAME SECURITY MEASURE ISO 27011

text: Part 1 – Governance and Ecosystem

text: Information system ─ security risk analysis

text: # 4.2 Information security management systems in telecommunications Information system business security policy # 5. Security Policy

text: Information system ─ security accreditation

text: Information System

text: 1.1 Security Governance Information system ─

text: & Risk Management

text: security indicators

text: Information system ─ security audit

text: # 8.1 Prior to employment Human resource # 8.2 During employment security # 8.3 Termination or change of employment

text: Asset Management 7. Asset management

text: # 6.1 Internal organization Ecosystem mapping # 6.2 External Parties

text: Ecosystem

text: Management

text: # 6.2 External Parties Ecosystem relations # 10.2 Third party service delivery management

text: Part 2 – Protection

text: ISO/IEC 27011:2008 - Information security management guidelines for telecommunications organizations based on ISO/IEC 27002; URL: https://www.iso.org/standard/43751.html Mapping of OES Security Requirements to Specific Sectors

text: December 2017

text: Systems # 12.1 Security requirements of information systems configuration # 12.2 Correct processing in applications

text: IT Security System segregation # 10.6 Network security management 2.1

text: Architecture

text: Traffic filtering # 10.8 Exchange of information

text: Cryptography # 12.3 Cryptographic controls

text: Administration # 11.2 User access management accounts

text: IT Security

text: Administration

text: Administration # 11.2 User access management information systems

text: Authentication and # 11.1 Business requirement for access control identification # 11.4 Network access management # 11.5 Operating system access control

text: Identity and access

text: 2.3 # 11.6 Application and information access control

text: management

text: Access rights # 11.2 User access management # 11.3 User responsibilities

text: IT security maintenance ─

text: IT security

text: 2.4 procedure

text: maintenance

text: Remote access # 11.7 Mobile Computing and teleworking

text: Physical and Physical and # 9.1 Secure areas 2.5 environmental environmental security security # 9.2 Equipment security

text: Part 3 - Defence

text: Detection # 10.10 Monitoring

text: Logging # 10.10 Monitoring 3.1 Detection

text: Logs correlation and # 10.10 Monitoring analysis

text: Information system # 13.2 Management of information security incidents and Computer security security incident improvements 3.2 incident response

text: management

text: Incident report # 13.1 Reporting information security events and weaknesses

text: December 2017

text: Communication with competent ─ authorities

text: Part 4 - Resilience

text: Business continuity # 14.1 Information security aspects of business continuity management management

text: Continuity of

text: Operations

text: Disaster recovery # 14.1 Information security aspects of business continuity management management

text: Crisis management ─ 4.2 organization

text: Crisis Management

text: Crisis management ─ process

text: Table 18: Mapping of security measures with Digital Infrastructure sector specific standard

text: Mapping of OES Security Requirements to Specific Sectors 2.7 Matching of baseline security measures with sectors Table 19 summarizes the matching of the proposed security measures with sector-specific international standards, regulations and well accepted good practices of Energy and Transport sector, that were presented in more details above.

text: ENERGY TRANSPORT

text: DOMAIN SECURITY ELECTRICITY OIL & GAS AIR RAIL WATER ROAD NAMES MEASURES NIST SP API STD ONG- (TABLE (TABLE ISO 27019 NERC CIP ICAO AIAA BIMCO 800-82 1164 C2M2 22) 22)

text: Part 1 – Governance and Ecosystem

text: Information system security ● ● ● ● ● ● ● ─ ● ─ risk analysis

text: Information system security ● ● ● ● ● ● ● ─ ─ ─ policy

text: Information

text: Information

text: system security ● ─ ─ ─ ─ ● ● ─ ─ ─

text: System Security

text: accreditation

text: Governance & Risk

text: Information

text: Management

text: system security ● ─ ─ ─ ─ ─ ─ ─ ─ ─ indicators

text: Information system security ● ● ● ● ─ ─ ─ ─ ─ ─ audit

text: Human resource ● ● ● ● ● ─ ● ─ ● ─ security

text: ENERGY TRANSPORT

text: Asset ● ● ● ● ● ● ● ─ ● ─ Management

text: Ecosystem ─ ● ─ ● ● ● ● ─ ● ─ mapping

text: Ecosystem Management

text: Ecosystem ─ ● ─ ● ● ● ● ─ ● ─ relations

text: Part 2 – Protection

text: Systems ● ● ● ● ● ● ─ ─ ● ─ configuration

text: System IT Security ● ● ● ● ─ ● ● ─ ● ─ segregation

text: Architecture

text: Traffic filtering ● ● ─ ● ─ ● ● ─ ● ─

text: Cryptography ● ● ● ● ─ ● ● ─ ─

text: Administration ● ● ● ● ● ─ ● ─ ● ─ accounts

text: IT Security

text: Administration Administration information ─ ● ● ● ─ ─ ─ ─ ● ─ systems

text: ENERGY TRANSPORT

text: Authentication Identity and and ● ● ● ● ● ● ─ ─ ● ─ access identification

text: management

text: Access rights ● ● ● ● ● ● ─ ─ ─

text: IT security maintenance ● ● ● ● ─ ● ── ─ ● ─

text: IT security

text: procedure

text: maintenance

text: Remote access ● ● ● ● ─ ● ─ ─ ● ─

text: Physical and Physical and environmental environmental ● ● ● ● ─ ─ ─ ─ ● ─ security security

text: Part 3 - Defence

text: Detection ● ─ ● ● ● ● ● ─ ● ─

text: Logging ● ● ● ● ● ● ─ ─ ─

text: Detection

text: Logs correlation ● ● ● ● ─ ● ─ ─ ─ and analysis

text: Information

text: Computer

text: system security security incident ● ● ● ● ● ● ● ─ ─ ─ incident

text: management

text: response

text: ENERGY TRANSPORT

text: Incident report ● ● ● ─ ● ● ● ─ ─ ─

text: Communication with competent ─ ● ● ● ● ● ● ─ ● ─ authorities

text: Part 4 - Resilience

text: Business continuity ● ● ● ● ● ● ─ ─ ● ─ management

text: Continuity of Operations

text: Disaster recovery ● ● ● ─ ─ ● ─ ─ ● ─ management

text: Crisis management ● ● ● ─ ─ ● ─ ─ ● ─ organization

text: Crisis Management

text: Crisis management ● ● ● ─ ─ ● ─ ─ ● ─ process

text: Table 19: Overview of the proposed security measures with Energy and Transport sector-specific international standards, regulations and good-practices

text: Table 20 summarizes the matching of the proposed security measures with sector-specific international standards, regulations and well accepted good practices of Financial & Banking, Healthcare, Drinking Water and Digital Infrastructures sectors, that were presented in more details above. Mapping of OES Security Requirements to Specific Sectors

text: DRINKING WATER SUPPLY DIGITAL FINANCIAL AND BANKING HEALTHCARE AND INFRASTRUCTURES DOMAIN SECURITY DISTRIBUTION NAMES MEASURES

text: ISO/TR PSD2 PCI-DSS 13569:20 GLBA ISO2779 ISO 27011 SOX HIPAA (Table 22) 05 9

text: Part 1 – Governance and Ecosystem

text: Information system security ● ─ ● ● ─ ● ● ─ ─ risk analysis

text: Information system security ● ● ● ● ● ● ● ─ ● policy

text: Information system security ● ─ ● ● ● ● ● ─ ─ Information accreditation

text: System

text: Security Information Governance & system security ● ● ● ● ● ● ● ─ ─ Risk indicators

text: Management

text: Information system security ● ─ ● ● ● ● ● ─ ─ audit

text: Human resource ● ─ ● ● ─ ● ● ─ ● security

text: Asset ● ● ● ● ─ ● Management

text: Ecosystem ● ─ ● ● ● ● ─ ─ ● mapping

text: Ecosystem Management

text: Ecosystem ● ─ ● ● ● ● ─ ─ ● relations

text: Part 2 - Protection

text: Systems ● ● ● ● ─ ● ─ ─ ● configuration

text: System IT Security ● ─ ● ● ─ ● ─ ─ ● segregation

text: Architecture

text: Traffic filtering ● ─ ● ● ─ ● ─ ─ ●

text: Cryptography ● ● ● ─ ● ─ ─ ●

text: Administration ● ● ● ● ─ ─ ─ ─ ● accounts

text: IT Security

text: Administration Administration information ● ─ ● ● ─ ─ ─ ─ ● systems

text: Authentication Identity and and ● ● ● ● ─ ● ● ─ ● access identification

text: management

text: Access rights ● ● ● ● ● ● ● ─ ●

text: IT security maintenance ● ● ● ● ─ ● ● ─ ─

text: IT security

text: procedure

text: maintenance

text: Remote access ● ─ ─ ─ ─ ● ● ─ ●

text: Physical and Physical and environmental environmental ● ● ● ● ─ ● ● ─ ● security security

text: Part 3 - Defence

text: Detection ● ─ ● ● ● ● ● ─ ●

text: Logging ● ● ● ● ● ● ● ─ ●

text: Detection

text: Logs correlation ● ─ ● ─ ● ● ● ─ ● and analysis

text: Information system security ● ─ ● ● ● ● ● ─ ● incident Computer response

text: security

text: incident Incident report ● ─ ● ● ● ● ● ─ ●

text: management

text: Communication with competent ● ─ ● ● ● ─ ─ ─ ─ authorities

text: Part 4 - Resilience

text: Business continuity ● ─ ─ ● ─ ● ● ─ ● management

text: Continuity of Operations

text: Disaster recovery ● ─ ● ● ─ ● ● ─ ● management

text: Crisis

text: Crisis

text: management ● ─ ● ● ─ ● ● ─ ─

text: Management

text: organization

text: Crisis management ● ─ ● ● ─ ● ● ─ ─ process

text: Table 20: Overview of the proposed security measures with Energy and Transport sector-specific international standards, regulations and good-practices

text: 3 Mapping the Baseline Security Measures for OES to cross sector international standards

text: Table 21 lists international standards and good practices applicable across all the sectors referred to in the NIS Directive.

text: SECTOR STANDARDS GOOD PRACTICES

text:  ANSI/ISA, Series “ISA-62443: Security for industrial

text: automation and control system”

text:  ISO 27001 Information Technology Security

text: Techniques Information Security Management Systems Requirements

text:  NIST Framework for Improving Critical Infrastructure

text: Cybersecurity

text:  ISO/IEC 27002:2013: Code of practice for information security controls  ISO 27003 - Information technology -- Security techniques -- Information security management system  The CIS Critical Security Controls for implementation guidance Effective Cyber Defence Version 6.1  ISO/IEC 27004:2016 Information technology -- Security  Organisation for Economic Co-operation techniques -- Information security management -- and Development (OECD), Guidelines for Monitoring, measurement, analysis and evaluation the Security of Information Systems and  ISO/IEC 20000-1:2011 Information technology -- Service Networks, 2002, management -- Part 1: Service management system  Generally Accepted Information Security requirements Principles (GAISP) – ISSA  ISO/IEC 27010:2015 Information technology -- Security  The Open Group Open Information techniques -- Information security management for Security Management Maturity Model inter-sector and inter-organizational communications (O-ISM3) Cross sector  ISO/IEC 21827:2008 Information technology -- Security  ISACA BMIS techniques -- Systems Security Engineering -- Capability  IT Baseline Protection Manual Standard Maturity Model® (SSE-CMM®) Security Measures – BSI  ISO/IEC 10181-2:1996 Information technology -- Open  UK Cyber Essentials (CREST) Systems Interconnection -- Security frameworks for  Cyber Defence Capability Assessment open systems: Authentication framework Tool (CDCAT®) – CESG  ISO/IEC 27013:2015 Information technology -- Security  HMG Security Policy Framework (SPF) – techniques -- Guidance on the integrated CESG implementation of ISO/IEC 27001 and ISO/IEC 20000-1  NIST/NSA/DISA/DoD Security Technical  ISO/IEC 27014:2013 Information technology — Security Implementation Guides (STIGs) techniques — Governance of information security  Carnegie Melon Capability Maturity  ISO/IEC 27032:2012 Information technology -- Security Model (CMM) techniques -- Guidelines for cybersecurity  ISO/IEC 27033-1:2015 Information technology -- Security techniques -- Network security -- Part 1: Overview and concepts  ISO/IEC 27034-1:2011 Information technology -- Security techniques -- Application security -- Part 1: Overview and concepts  ISO/IEC TR 19791:2010 Information technology -- Security techniques -- Security assessment of operational systems

text:  European Telecommunications Standards Institute (ETSI) Cybersecurity Standards  TR 103 303 - TR 103 309 CYBER series  TR 103 331 CYBER; Structured threat information sharing  TR 103 369 CYBER; Design requirements ecosystem  TS 103 487 CYBER; Baseline security requirements regarding sensitive functions for NFV and related platforms  IT Infrastructure Library (ITIL) v3  NIST SP 800-53  Information Assurance for SMEs (IASME)  ISF Standard of Good Practice for Information Security  ITU X series : Information security management framework

text: Table 21: International standards and good practices applicable across all the sectors

text: The Table 22 depicts the mapping of the information security measures identified and agreed in the NIS Directive Cooperation Group to the international information security standards applied to all the sectors referred to in the NIS Directive. The standards and good practices, that are usually applied by the operators of all the sectors referred to in the NIS Directive, were identified through the survey filled in by the Cooperation Group representatives, as well as by the feedback provided by EU operators, are:  ISO 27001 Revision 2013, which is the most globally widespread standard covering all aspects of information security management systems across all the sectors.  ISA/IEC 62443, which is a series of standards that define procedures for implementing electronically secure Industrial Automation and Control Systems (IACS). This guidance applies to end-users (i.e. asset owner), system integrators, security practitioners, and control systems manufacturers responsible for manufacturing, designing, implementing, or managing industrial automation and control systems.  NIST Cybersecurity Framework, which despite the fact that is not compulsory even in the U.S., it is usually followed by EU operators that work beyond EU’s territory as it is a good point of reference for cybersecurity requirements.

text: NIST CYBER D/N DOMAIN NAME SECURITY MEASURE ISO 27001:2013 SECURITY ISA/IEC 62443 3-3 FRAMEWORK

text: Part 1 – Governance and Ecosystem

text: # 8.2 Information security risk assessment (ISO ID.GV-4 Information system 27001) ID.RA-1,2,3,4,5,6 SR 5.2, 5.3, security risk analysis # 8.3 Information D.RM-1,2,3

text: Information System

text: security risk PR.AT-2 1.1 Security Governance treatment (ISO

text: & Risk Management

text: # 5.1 Management Information system direction for ID.GV-1,2,3 ─ security policy information security

text: Information system # 12.7.1 Information security systems audit ─ SR 2.8, 2.9, 2.10, 2.12 accreditation controls

text: Information system # 12.1.3.Capacity ─ SR 1.4, 3.9, 6.1 security indicators Management

text: Information system # 9.2 Internal Audit SR 2.8, 2.9, 2.10, PR.PT-1 security audit (ISO 27001) 2.11, 2.12, 3.9,

text: # 7.1 Prior to employment # 7.2 During Human resource employment PR.AT-1,2,3,4,5 SR 1.1 security # 7.3 Termination and change of employment

text: PE-20 Asset Monitoring and A.8 Asset Tracking SR 7.2 – Resource Asset Management management CM-8 Information management System Component Inventory

text: # 15.1 Information Ecosystem mapping security in supplier ID.BE-1,2 ─ relationships

text: Ecosystem

text: Management

text: # 15.2 Supplier ID.BE-3,4 Ecosystem relations service delivery SR 1.1, 1.13, 2.6 PR.AT-3 management

text: Part 2 – Protection

text: Systems # 12.1.1 configuration Documented SR 2.5, 2.6, 2.7, 3.4, operating procedures PR.IP-1,3 3.5, 3.6, 3.7, 7.6, 7.7 # 12.5 Control of operational software

text: System segregation # 13.1 Network PR.AC-5 security management

text: IT Security

text: Architecture

text: Traffic filtering # 12.5 Control of operational software # 12.6 Technical ─ SR 6.2, 7.1, 7,2 vulnerability management

text: Cryptography # 10.1 Cryptographic ─ SR 1.8, 1.9, controls

text: Administration # 9.2 User access PR.AT-2 SR 1.3, 1.4, accounts management

text: IT Security

text: 2.2 Administration Administration # 9.4 System and

text: information systems application access PR.AT-2 SR 2.1,

text: control

text: Authentication and # 9.1 Business SR 1.1, 1.2, 1.5, 1.7, identification requirements of PR.AC-1 1.10, 1.11 Identity and access access control 2.3

text: management

text: Access rights # 9.2 User access ID.AM-5,6 SR 2.1, 2.5, management PR.AC-1,4

text: IT security # 14.1 Security

text: maintenance requirements of

text: procedure information systems PR.IP-2 SR 3.3, 3.4, 3.7 # 14.2 Security in PR.MA-1,2

text: IT security

text: 2.4 development and

text: maintenance

text: support processes

text: Remote access # 6.2 Mobile devices PR.AC-3 SR 1.6, 1.13, 2.2, 2.6, and teleworking

text: Physical and Physical and #11.1 Secure areas PR.AC-2 2.5 environmental environmental SR 1.1, 1.5 #11.2 Equipment PR.IP-5 security security

text: Part 3 - Defence

text: Detection DE.AE-1 # 12.4 Logging and DE.CM-1,2,3,4,5,6,7,8 SR 3.1, 3.2 monitoring DE.DP-1,2,3,4,5

text: 3.1 Detection Logging # 12.4 Logging and DE.CM-1 SR 6.1 monitoring

text: Logs correlation and # 12.4 Logging and DE.CM-1 SR 6.1 analysis monitoring

text: Information system # 16.1.4

text: security incident Management of DE.AE-2,3,4,5

text: response information security RS.AN-1,2,3,4

text: incidents and

text: Computer security

text: improvements 3.2 incident SR 6.1, 6.2 PR.IP-9 management # 16.1.5 Response to RS.RP-1 information security RS.CO-1 incidents RS.MI-1,2,3

text: Incident report # 16.1.5 Response to information security RS.CO-1,2,3,4,5 SR 6.2 incidents

text: Communication with competent ─ ─ ─ authorities

text: Part 4 - Resilience

text: Business continuity ID.BE-5 # 17.1 Information management PR.DS-4 SR 7.3, 7.4 security continuity Continuity of PR.IP-4 4.1

text: Operations

text: Disaster recovery PR.DS-4 # 17.2 Redundancies SR 7.4, 7.5 management PR.IP-10

text: Crisis management # 17.1 Information PR.DS-4 SR 7.4, 7.5 organization security continuity PR.IP-10 4.2 Crisis Management Crisis management # 17.1 Information PR.DS-4 SR 7.4, 7.5 process security continuity

text: Table 22: Mapping of the information security measures to the international information security standards applied to all the sectors

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vasilissis Sofias Marousi 151 24, Attiki, Greece Catalogue Number PO Box 1309, 710 01 Heraklion, Greece ISBN 978-92-9204-232-5, DOI 10.2824/844702 Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu