ISA TR62443-2-3

ISA-TR62443-2-3 describes requirements for asset owners andindustrial automation and control system (IACS) product suppliersthat have established and are now maintaining an IACS patchmanagement program.

This Technical Report recommends a defined format for thedistribution of information about security patches from assetowners to IACS product suppliers, a definition of some of theactivities associated with the development of the patch informationby IACS product suppliers and deployment and installation of thepatches by asset owners. The exchange format and activities aredefined for use in security related patches; however, it may alsobe applicable for non-security related patches or updates.

The Technical Report does not differentiate between patches madeavailable for the operating systems (OSs), applications or devices.It does not differentiate between the product suppliers that supplythe infrastructure components or the IACS applications; it providesguidance for all patches applicable to the IACS. Additionally, thetype of patch can be for the resolution of bugs, reliabilityissues, operability issues or security vulnerabilities.

Note 1 This Technical Report does not provide guidance on theethics and approaches for the discovery and disclosure of securityvulnerabilities affecting IACS. This is a general issue outside thescope of this report.

Note 2 This Technical Report does not provide guidance on themitigation of vulnerabilities in the period between when thevulnerability is discovered and the date that the patch resolvingthe vulnerability is created. For guidance on multiplecountermeasures to mitigate security risks as part of an IACSsecurity management system (IACS-SMS), refer to Annexes B.4.5,B.4.6 and B.8.5 in this Technical Report and other documents in theISA-62443 series.

Edition:

15

Published:

07/01/2015

Number of Pages:

70

File Size:

1 file , 1.2 MB