ICS/OT Security Policy
Security of industrial control systems and operational technology
Purpose
Protect Industrial Control Systems (ICS) and Operational Technology (OT) against cyber threats, ensuring continuous operation and the integrity, confidentiality and availability of the systems.
Scope
Applies to all ICS/OT assets (controllers, sensors, actuators, network devices, software and associated equipment) and to all staff, contractors and authorized users who interact with these systems.
Objectives
- Strengthen ICS/OT security.
- Align ICS/OT operations with the overall cybersecurity strategy.
- Ensure resilience and rapid incident response.
- Protect the integrity, confidentiality and availability of ICS/OT assets.
Key Standards
Asset and Connection Management
- Document all ICS/OT devices in the asset inventory.
- Maintain strict physical and logical segmentation between ICS networks and other corporate or external networks.
- Restrict the use of external media and mobile devices; subject them to security scans if they're required.
Networks and Systems
- Continuously monitor the ICS/OT network and keep security event logs.
- Configure and harden systems against known vulnerabilities.
- Protect Safety Instrumented Systems (SIS) through isolation and strict controls.
- Manage vulnerabilities and patches in a way adapted to ICS/OT systems.
- Use dedicated cybersecurity applications for malware detection and mitigation.
Data and Applications
- Classify and handle ICS/OT data according to sensitivity and operational importance.
- Use software and applications from trusted vendors, periodically assessing vulnerabilities.
Employees and Contractors
- Mandatory training in ICS/OT cybersecurity practices.
- Immediate reporting of anomalies, failures or cyber threats.
Monitoring and Review
- Regular audits to verify compliance.
- Immediate correction of deviations through technical adjustments or training.
- Frequent review of the policy to adapt to emerging threats and ensure ongoing resilience.