The short answer
CISA Guidance as a Reference
The federal cybersecurity agency publishes guidance that a utility can adopt as a reference standard: the cross-sector cybersecurity performance goals, a prioritized, numbered list of practices with cost and impact ratings that a utility can write into its policy as the baseline and into its specifications as requirements; the water and wastewater sector goals that map them to utility systems; the secure-by-design principles that state what a buyer should expect of a product, which belong in a procurement specification; and the advisories and the exploited vulnerabilities catalog that are the references a vulnerability management process cites. The goals are aligned with the institute framework and cross-referenced to it, so a utility that adopts them can report against the framework, and they sit beside the industrial standard series as the practical baseline where the standard series gives the design method.
Key points
- The performance goals are numbered, prioritized, and rated; they can be cited in policy and in specifications.
- The water sector goals say what each goal means for a utility; they are the version to hand to operations.
- Secure by design is the list of what to demand of a vendor: no default passwords, logging, secure defaults, support commitments.
- The advisories and the exploited catalog are the references for vulnerability decisions.
- The goals cross-reference the institute framework, so adopting them is also progress against it.
- The sector resources and services are covered on the cybersecurity resources page; this page is about citing the documents.
The performance goals as a baseline
The cross-sector cybersecurity performance goals are a set of practices grouped by the framework functions, each with an identifier, a statement of the outcome, a rating of cost, complexity, and impact, and a reference to the institute framework outcomes it supports. They were written for organizations that need a place to start and a way to prioritize, which describes most utilities. Because they are numbered and specific, they can be adopted as the utility baseline: the policy says the utility implements the goals, the annual assessment reports against each goal, and a procurement specification requires a vendor or an integrator to deliver systems that meet the goals that apply to them. The water and wastewater sector goals restate each goal in utility terms with examples, and are the document to give to operations and management.
| Goal area | Examples of goals | Where a utility applies it |
|---|---|---|
| Account security | Change default passwords; minimum password strength; unique credentials; revoke credentials of departing staff; separate user and privileged accounts | The password policy, the account lifecycle, the vendor account procedure |
| Device security | Hardware and software approval process; asset inventory; prohibit connection of unauthorized devices; document network topology; secure log storage | The inventory, the third-party software policy, the network drawings, the log collector |
| Data security | Log collection; secure sensitive data; encrypt data in transit | The collector, the historian security, the VPN design |
| Governance and training | A named security leader; basic training; improving incident response; vendor and supplier requirements | The security owner, the training plan, the incident plan, the procurement clause |
| Vulnerability management | Mitigate known exploited vulnerabilities; vulnerability disclosure; deploy security-by-design tools; no exploitable services on the internet; limit operational technology connections to the public internet | The advisory triage, the risk-based patching, the external scanning |
| Supply chain | Vendor incident reporting; vendor vulnerability disclosure; supply chain risk in procurement | The contract clauses |
| Response and recovery | Incident reporting; incident response plans; system backups; document network topology; recovery planning | The reporting list, the plan, the offline copies |
| Other | Network segmentation; detecting relevant threats; email security | The zones and conduits, the monitoring sensor, the office side |
Secure by design in procurement
The agency and its partners have published principles that describe what a secure product looks like from the buyer side: it ships without default passwords, it logs security events by default, it supports multi-factor authentication, its secure configuration is the default rather than an option, its vendor publishes vulnerabilities and fixes them for a stated support life, and its vendor takes ownership of the security outcomes of its customers. A utility writes those into its specifications for controllers, SCADA software, network equipment, and integration services, and asks the vendor to state how the product meets each. The principles do not replace the industrial standard series product requirements, which are more detailed; they are the short list a purchasing department can hold a vendor to.
The vulnerability references
- The industrial control systems advisories: coordinated disclosures with affected versions, severity, and mitigations, cited in the utility vulnerability records by their identifiers.
- The known exploited vulnerabilities catalog: the list a utility checks first, and the reference for the urgency tier in risk-based patching; federal agencies are directed to remediate entries by a due date, and utilities use the same dates as a benchmark.
- Joint advisories with the federal investigative agency and other partners on threat actors targeting the water sector, which the threat landscape assessment cites.
- The binding operational directives, which apply to federal agencies and are read by utilities as an indication of what the government considers urgent.
Citing beside the others
| Reference | Role | Citation use |
|---|---|---|
| Performance goals | The practical baseline | Policy baseline; assessment checklist; specification requirements |
| Institute framework | The program structure | The annual assessment and the report to management |
| Institute operational technology guide | The control system design reference | Design basis for segmentation and control adjustments |
| Industrial standard series | The design method and the vendor and product requirements | Zone and conduit design; integrator and product requirements in specifications |
| Sector center fundamentals | The water sector summary | Orientation and management communication |
| Environmental agency checklist | The regulator view of the same baseline | The assessment the regulator may inspect against |
Frequently asked questions
- Are the performance goals a standard?
- They are voluntary guidance, not a standard in the formal sense, and they say so. They function as a baseline standard because they are specific, prioritized, and widely referenced, and a utility can adopt them as its own standard by policy, which is what makes them binding on the utility and its contractors.
- How do the goals relate to the water infrastructure act assessment?
- The act requires an assessment and a plan that address cybersecurity without prescribing a method. The sector guidance points to the goals and the environmental agency checklist as the way to do the cyber portion; a utility that assesses against the goals has the cyber content of its assessment.
- Can we require a vendor to meet the goals?
- The goals that apply to products and services can be written into a specification as requirements: unique credentials, no default passwords, logging, multi-factor support, vulnerability disclosure, and so on. The secure-by-design principles and the industrial standard series product requirements give more detail for the product itself.
- Where are the services, the advisors, the scanning?
- On the cybersecurity resources page for the agency. This page is about the documents as references; the services are how a utility gets help using them.
Related topics
- CISA ResourcesWhat the federal cybersecurity agency provides to utilities without charge: the performance goals, regional advisors, external vulnerability scanning, control system advisories, the exploited catalog, a self-assessment tool, exercises, and incident reporting.
- NIST Publications for Control SystemsThe National Institute of Standards and Technology documents a control engineer will meet: the Cybersecurity Framework, the operational technology security guide, the control catalog, the digital identity guideline, and the incident handling guide.
- IEC 62443The international standard series for industrial automation and control system security: how it is organized, what security levels and foundational requirements mean, and how a utility or integrator actually uses it.
- Advisories and AlertsWhere a utility learns its equipment has a known vulnerability and what to do with the news: the government and vendor advisory feeds, the sector center, the exploited catalog, subscribing by product, a weekly triage on exposure and consequence, and records.
- Security Program BasicsWhat a control system security program is for a utility that has never had one: a named owner, an inventory, a risk assessment, a few policies, baseline controls, training, vendor rules, an exercised incident plan, and a first-year plan for a small staff.
- EPA GuidanceWhat the federal environmental agency provides to water and wastewater utilities on cybersecurity and what it expects: the free assessment, the checklist aligned with federal goals, joint incident response guidance, the enforcement position, and how to use it.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.