The short answer
NIST Publications for Control Systems
The National Institute of Standards and Technology publishes the reference documents behind most cybersecurity programs in the United States, and a handful of them are the ones a utility uses. The Cybersecurity Framework gives the structure: functions from governance through identification, protection, detection, response, and recovery, with outcomes to assess against and profiles to plan with. The special publication on operational technology security applies that structure to control systems, with the architecture, the risk management, and the control adjustments that industrial systems need. The security and privacy control catalog is the detailed list of controls that assessors and frameworks map to. The digital identity guideline is the basis of modern password and authentication policy. The incident handling guide is the structure of an incident response plan. The practice guides show worked implementations of specific problems. All are free, and a utility cites them in its policies, its assessments, and its specifications.
Key points
- The Cybersecurity Framework is the shape of the program; the operational technology guide is the control system version of it.
- The control catalog is the reference when an assessor or a regulator asks which control satisfies a requirement.
- The digital identity guideline is why the password policy no longer demands quarterly changes.
- The incident handling guide is the outline of the incident response plan.
- The practice guides show how a control was actually built, with products named.
- All free; cite the current revision, because they are revised.
The documents
| Document | What it is | When a utility opens it |
|---|---|---|
| Cybersecurity Framework | A structure of functions, categories, and outcomes for managing cybersecurity risk, with the governance function added in the second version, and profiles for planning current and target states | The annual self-assessment; the report to management; the structure of the security program |
| Special publication on operational technology security | The guide to securing industrial control systems, formerly the industrial control systems security guide: architecture, segmentation, risk management, incident response, and a control overlay tailored to operational technology | The design reference for segmentation and the source of the control system adjustments to generic controls |
| Security and privacy controls catalog | The catalog of controls, organized by family, with baselines by impact level | When an assessment, a regulator, or an insurer asks which control meets a requirement, and when writing a specification that must cite controls |
| Digital identity guidelines | Requirements for identity proofing, authentication, and federation; the authentication volume covers passwords and multi-factor authentication | Writing the password and authentication policy; answering an auditor who asks for quarterly password changes |
| Computer security incident handling guide | The incident response life cycle: preparation, detection and analysis, containment, eradication, recovery, and lessons learned | Writing and exercising the incident response plan |
| Cybersecurity practice guides | Worked implementations of specific capabilities in a laboratory with named products, including control system integrity and asset management | When designing a specific capability and wanting to see one built |
| Manufacturing profile of the framework | The framework applied to manufacturing systems, with a sector example that translates to utilities | An example of a sector profile when writing the utility profile |
| Zero trust architecture | The principles of verifying every access rather than trusting a network location | Reading before designing remote access; applied with care in control systems |
How they fit
The framework is the outline. Each of its outcomes, such as maintaining an asset inventory or controlling remote access, can be satisfied by controls from the catalog, and the operational technology guide says which controls need adjustment for a plant where availability comes first and patching is deliberate. The identity guideline and the incident handling guide are deep dives into two areas that every program needs, and the practice guides are examples. A utility reads the framework and the operational technology guide, uses the catalog as a reference, adopts the identity guideline for its password policy, and structures its incident plan on the incident handling guide.
The operational technology guide
The special publication on operational technology security is the document written for the systems a water utility runs. It describes control system architectures and how they differ from enterprise systems, walks through risk management for operational technology, lays out defense in depth with segmentation and zones, covers the incident response and recovery considerations that a physical process imposes, and provides an overlay of the control catalog that says, control by control, how the generic requirement is applied or adjusted for a control system. It is the reference the utility control engineer keeps at hand, and it is the one to cite when an enterprise policy needs to be adapted for the plant.
The framework in practice
- 1
Assess
For each outcome in the framework, the current state: done, partly, not. The sector performance goals and the environmental agency checklist provide a shorter version for a first pass.
- 2
Profile
The current profile and the target profile: where the utility is and where it intends to be, by outcome, with the gaps listed.
- 3
Plan
The gaps ranked by the risk assessment, with actions, owners, and dates. This is the security program plan.
- 4
Report
The profile and the plan to management, in the framework language, once a year.
- 5
Repeat
The next year, with the profile updated; the change from year to year is the measure of the program.
Other institute resources
- The national vulnerability database, the catalog of published vulnerabilities with identifiers and scores that advisories reference.
- The time services, which include the network time servers that a DMZ time server may synchronize to.
- Measurement and calibration traceability, which is what the calibration certificates on reference standards ultimately trace to.
- Guidance on supply chain risk, on cloud security, and on protecting controlled information for utilities that handle it.
Frequently asked questions
- Is the framework mandatory for a water utility?
- No. It is voluntary guidance that most regulators, insurers, and sector organizations accept as the reference structure, and the water infrastructure act assessment and the sector guidance align with it. Using it is the path of least resistance when anyone asks how the program is organized.
- Which document should a small utility read first?
- The sector performance goals and the environmental agency checklist, which distill the framework for a utility, and then the operational technology guide for the control system specifics. The framework itself is read when the program is ready to be assessed formally.
- Do we need the control catalog?
- As a reference, when a requirement has to be traced to a control or a specification has to cite one. Nobody reads it front to back. The operational technology guide overlay is the part that matters for a plant.
- How do these relate to the industrial security standard series?
- The institute documents are American guidance organized around risk management and controls; the international industrial security standard series is a standard organized around zones, conduits, and security levels for owners, integrators, and products. They are compatible, the operational technology guide references the standard series, and a utility commonly uses the framework for its program and the standard series for its network design and its vendor requirements.
Related topics
- Security Program BasicsWhat a control system security program is for a utility that has never had one: a named owner, an inventory, a risk assessment, a few policies, baseline controls, training, vendor rules, an exercised incident plan, and a first-year plan for a small staff.
- IEC 62443The international standard series for industrial automation and control system security: how it is organized, what security levels and foundational requirements mean, and how a utility or integrator actually uses it.
- Password Policy for OTA password policy that fits a control system rather than an office: length over complexity, rotation on events, screening against breached lists, multi-factor authentication, no lockouts that take control from an operator, and unique vaulted device passwords.
- OT Incident Response PlanThe plan for the day the control system is not trusted: who decides, the triggers, the first hour, isolating without stopping treatment, running by hand, preserving evidence, who to notify and when, recovery from backups, and the exercise that makes it real.
- CISA Guidance as a ReferenceHow the federal cybersecurity agency publications serve as reference standards for a utility: the performance goals as a baseline for policy and procurement, the water sector goals, secure-by-design principles for vendors, and the advisories.
- OT Risk AssessmentRanking what could go wrong in a control system and what it would cost: the consequence-first method for utilities, the assets and scenarios to list, likelihood without pretending to know it, the risk matrix, and turning the ranked list into a work plan.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.