Sterile Injectables Plant: Patching a Validated DCS
A sterile injectables plant runs a validated DCS and MES in a facility built in 2004. The DCS vendor requires a persistent VPN for alarm troubleshooting; the VPN terminates on an engineering workstation that also has internet access for email. Batch records are retained under GMP change control, and patching the DCS requires revalidation of the control strategy, which takes 6 to 9 months. Corporate IT wants to deploy its standard EDR agent and monthly Windows patches, but the DCS runs Windows Server 2008 R2 and one HMI runs Windows 7. A recent scan found 37 unpatched critical CVEs on the HMI and a shared local administrator password across five workstations. Production pressure is high; there is only one planned shutdown per year. The site has a 62443-2-1 CSMS, but patch management is informal and no OT incident response plan exists.
1. Corporate IT proposes to apply its standard monthly patch cycle and EDR to the DCS. Assess this proposal and describe a 62443-2-3-aligned patch management approach you would implement.
Read the worked answer
Reject a blind monthly IT patch cycle for the DCS. The system is validated and vendor-supported; an untested patch can break batch control and trigger a deviation. Accept the principle of patch management but modify the method. Under 62443-2-3: inventory the DCS/HMI assets and OS versions; define roles; monitor vendor and CERT advisories; evaluate each patch for severity, exploitability, exposure and vendor approval; test on a representative validation environment; schedule deployment in the annual shutdown or an approved emergency change; verify installation; keep records and metrics. For Windows 7/2008 R2, many patches are no longer supplied, so compensating controls matter. EDR: do not deploy the corporate agent without vendor compatibility and performance testing; an agent that scans PLC/DCS directories or consumes CPU can cause outages. If EDR is not supported, use network monitoring, application allowlisting, restricted USB and offline backups. Document any patch not applied and the residual risk.
2. The persistent vendor VPN and shared local administrator password are the two findings most likely to be exploited. Recommend specific controls and explain how they affect the zone/conduit design and SL-T.
Read the worked answer
Treat the vendor VPN as a high-risk conduit. Terminate it in a DMZ, not on an engineering workstation; require MFA, individual vendor accounts, least privilege, time-limited sessions, session recording and approval. The vendor should reach only the specific DCS server needed, through a jump host, with no route to the corporate email subnet or the internet. The shared local administrator password violates FR1/FR2: use unique accounts, a privileged access vault, MFA for administrative access and logging. If a legacy application forces a shared account, isolate it on a dedicated workstation, vault the password, rotate it and monitor use. In zone/conduit terms, the vendor access path is its own conduit with a high SL-T because it originates outside the site. The engineering workstation with email and VPN is a bridge between zones and should be removed or rebuilt. This reduces the likelihood of the exact path the tabletop found.
3. A critical CVE against the Windows 7 HMI has a public exploit and the next shutdown is 11 months away. What decision process and compensating measures would you document?
Read the worked answer
I would run a documented risk decision, not wait passively. Assess the CVE's exploitability, whether the HMI is reachable from the vendor VPN or internet, the safety/quality impact of a compromise, and the effectiveness of interim controls. Interim measures: move the HMI to a restricted VLAN; allow only the DCS servers and required backup; remove email and internet browsing; disable USB ports; apply application allowlisting; add IPS/IDS signatures and alerting; restrict vendor access; increase logging; test offline backups. If the public exploit is weaponized and the HMI is exposed, the residual risk may exceed the site's tolerance, so I would request an emergency change or an earlier shutdown. Otherwise, the asset owner signs a time-bound risk acceptance with the compensating controls and a review date. The key is to show why the decision is tolerable, not to claim the CVE is patched.