I85PREP
⌘ K
ICS/SCADA study materials
ICS/SCADA study resources

ICS/SCADA: Standards and Regulations for Cybersecurity

ICS/SCADA · Work through your exam, one topic at a time.

All guide sections

Standards and Regulations for Cybersecurity

What this domain tests

The exam tests whether you know which framework or regulation applies, what it requires at a high level, and where it stops. Expect questions on IEC 62443, NIST SP 800-82, NERC CIP, ISO/IEC 27001 and 27019, and the NIST Cybersecurity Framework.

Core rules

  • IEC 62443 is the industrial automation and control systems series. It uses zones and conduits, defines security levels SL1–SL4, and includes system requirements (3-3 series), component requirements (4-2), and service-provider requirements. Certification is not the same as a NERC impact rating.
  • NIST SP 800-82 Rev. 3 is guidance for operational technology security, not a regulation. It covers risk management, architecture, and overlays for ICS.
  • NERC CIP is mandatory and enforceable for the North American bulk electric system. CIP-002 categorizes BES cyber systems; CIP-005 covers the electronic security perimeter; CIP-007 covers system security management; CIP-010 covers configuration change management and vulnerability assessments. Noncompliance can bring penalties.
  • ISO/IEC 27001 certifies an information security management system, not a product. ISO/IEC 27019 adds energy-utility-specific guidance.
  • The NIST CSF 2.0 functions are Govern, Identify, Protect, Detect, Respond, and Recover. Use it as an organizing model, not a substitute for sector regulation.

Worked example

A utility asks whether a new substation control system falls under NERC CIP. Reasoning: first determine whether the facility is part of the bulk electric system and whether the system performs a BES cyber system function. Apply CIP-002 categorization to assign high, medium, or low impact. If it is in scope, apply the electronic security perimeter, access controls, patching, and monitoring requirements that match the categorization. IEC 62443 may still guide the architecture, but it does not replace the mandatory CIP obligation.

Traps

  • Calling NIST SP 800-82 a law or regulation.
  • Confusing IEC 62443 security levels with NERC CIP impact ratings.
  • Saying ISO/IEC 27001 certifies a product or an ICS device.
  • Applying NERC CIP to every ICS, including facilities outside the bulk electric system.
  • Treating a framework mapping as evidence of compliance.