System Protection Profile - Industrial Control Systems

**Version 1.0**

**Prepared for**

![](media/image1.png){width="3.3430555555555554in"
height="1.3916666666666666in"}

**by**

![](media/image2.jpeg){width="2.25in" height="1.1305555555555555in"}

# Document Control {#document-control .Invisible-1}

# Preparation {#preparation .Invisible-2}

+---------------------+----------------------------+-------------------+
| ## Action {#ac      | ##                         | ## Date {#da      |
| tion .Text-Heading} | Name {#name .Text-Heading} | te .Text-Heading} |
+---------------------+----------------------------+-------------------+
| Prepared by:        | Ron Melton, Terry          | 14 April 2004     |
|                     | Fletcher, Matt Earley      |                   |
+---------------------+----------------------------+-------------------+
| Reviewed by:        | Murray Donaldson           | 14 April 2004     |
+---------------------+----------------------------+-------------------+

# Release {#release .Invisible-2}

+-------+------------+------------+------------+---------------------+
| ## Ve | ## Date    | ## Chan    | ## Pages   | ## Remarks {#rem    |
| rsion |  Released  | ge Notice  | Affected { | arks .Text-Heading} |
|  {#ve | {#date-rel | {#change-n | #pages-aff |                     |
| rsion | eased .Tex | otice .Tex | ected .Tex |                     |
|  .Tex | t-Heading} | t-Heading} | t-Heading} |                     |
| t-Hea |            |            |            |                     |
| ding} |            |            |            |                     |
+-------+------------+------------+------------+---------------------+
| 0.91  | 4 Feb 2004 | N/A        | All        | SPP populated into  |
|       |            |            |            | new structure. Core |
|       |            |            |            | information         |
|       |            |            |            | chapters (1 to 6)   |
|       |            |            |            | nearing completion. |
|       |            |            |            | Chapters 7 and 8    |
|       |            |            |            | (Application Notes  |
|       |            |            |            | & Rationale) under  |
|       |            |            |            | development.        |
+-------+------------+------------+------------+---------------------+
| 1.0   | 14 April   | N/A        | All        | First release       |
|       | 2004       |            |            |                     |
+-------+------------+------------+------------+---------------------+

# Distribution List {#distribution-list .Invisible-2}

+---------------+-------------------+---------------------------------+
| ## Na         | ## Organisa       | ## Title {#title .Text-Heading} |
| me {#name-1 . | tion {#organisati |                                 |
| Text-Heading} | on .Text-Heading} |                                 |
+---------------+-------------------+---------------------------------+
| Keith         | NIST              | PCSRF Program Manager           |
| Stouffer      |                   |                                 |
+---------------+-------------------+---------------------------------+
| PCSRF Members | Various           | Various                         |
+---------------+-------------------+---------------------------------+

TABLE OF CONTENTS

[Document Control 2](#document-control)

[Preparation 2](#preparation)

[Release 2](#release)

[Distribution List 2](#distribution-list)

[1 Introduction 9](#introduction)

[1.1 SPP Identification 9](#spp-identification)

[1.2 SPP Overview 9](#spp-overview)

[2 STOE Description 13](#stoe-description)

[2.1 Overview of the System Target of Evaluation (STOE)
13](#overview-of-the-system-target-of-evaluation-stoe)

[2.2 Scope of the STOE 13](#scope-of-the-stoe)

[2.3 Security Features 15](#security-features)

[2.4 Features Outside of Scope 17](#features-outside-of-scope)

[3 STOE Security Environment 18](#stoe-security-environment)

[3.1 Secure Usage Assumptions 18](#secure-usage-assumptions)

[3.2 Threats to Security 18](#threats-to-security)

[3.2.1 Threats Addressed by the STOE 19](#threats-addressed-by-the-stoe)

[3.2.2 Threats Addressed by the Operating Environment
27](#threats-addressed-by-the-operating-environment)

[3.3 Overarching Organizational Security Policies
27](#overarching-organizational-security-policies)

[4 Risks 29](#risks)

[4.1 Risk Categories applicable to the STOE
29](#risk-categories-applicable-to-the-stoe)

[4.2 Risks to the External Operating Environment
34](#risks-to-the-external-operating-environment)

[5 Security Objectives 35](#security-objectives)

[5.1 Security Objectives for the STOE
35](#security-objectives-for-the-stoe)

[5.2 Security Objectives for the External Operating Environment
38](#security-objectives-for-the-external-operating-environment)

[6 IT Security Requirements 39](#it-security-requirements)

[6.1 STOE Security Functional Requirements
39](#stoe-security-functional-requirements)

[6.1.1 Logon Controls: 43](#logon-controls)

[6.1.2 Password Selection 44](#password-selection)

[6.1.3 Authentication Data Protection
45](#authentication-data-protection)

[6.1.4 Replay / Reuse 45](#replay-reuse)

[6.1.5 Session Suspension 46](#session-suspension)

[6.1.6 User Accounts and Profiles 46](#user-accounts-and-profiles)

[6.1.7 Role based access control 47](#role-based-access-control)

[6.1.8 Controls on RBAC Attributes 48](#controls-on-rbac-attributes)

[6.1.9 Firewall access control 48](#firewall-access-control)

[6.1.10 Audit events 49](#audit-events)

[6.1.11 Intrusion detection and response
50](#intrusion-detection-and-response)

[6.1.12 Audit trail protection 52](#audit-trail-protection)

[6.1.13 Audit trail analysis / review 53](#audit-trail-analysis-review)

[6.1.14 TOE Integrity 53](#toe-integrity)

[6.1.15 Data Authentication 54](#data-authentication)

[6.1.16 Data exchange integrity 54](#data-exchange-integrity)

[6.1.17 Functions required to support dependencies
55](#functions-required-to-support-dependencies)

[6.1.18 Secure Communications Channels
56](#secure-communications-channels)

[6.1.19 Management Functions 59](#management-functions)

[6.1.20 Physical Security Requirements
61](#physical-security-requirements)

[6.1.21 Security Event Monitoring 61](#security-event-monitoring)

[6.1.22 Requirements for interfaces between system components
63](#requirements-for-interfaces-between-system-components)

[6.1.23 Requirements for composability and interoperability between
system components
63](#requirements-for-composability-and-interoperability-between-system-components)

[6.1.24 Configuration requirements 63](#configuration-requirements)

[6.2 STOE Security Assurance Requirements
63](#stoe-security-assurance-requirements)

[6.2.1 Configuration Management (ACM) 65](#configuration-management-acm)

[6.2.2 Delivery and Operation (ADO) 67](#delivery-and-operation-ado)

[6.2.3 Guidance Documents (AGD) 69](#guidance-documents-agd)

[6.2.4 Life Cycle Support (ALC) 71](#life-cycle-support-alc)

[6.2.5 Security Awareness (ASA) 74](#security-awareness-asa)

[6.2.6 System O&M Security Controls (ASC)
74](#system-om-security-controls-asc)

[6.2.7 System Architecture (Class ASD)
76](#system-architecture-class-asd)

[6.2.8 Tests (ATE) 80](#tests-ate)

[6.2.9 Vulnerability Assessment (AVA) 83](#vulnerability-assessment-ava)

[6.2.10 Assurance Maintenance (AMA) 84](#assurance-maintenance-ama)

[6.3 Security Requirements for the IT Environment
89](#security-requirements-for-the-it-environment)

[6.4 Security Requirements for the Non-IT Environment
89](#security-requirements-for-the-non-it-environment)

[7 SPP Application Notes 90](#spp-application-notes)

[7.1 SPP Overview 90](#spp-overview-1)

[7.1.1 SPP Purpose 90](#spp-purpose)

[7.1.2 SPP Structure 91](#spp-structure)

[7.1.3 SPP Application 94](#spp-application)

[7.2 SPP Application: Risk Management
94](#spp-application-risk-management)

[7.2.1 Risk Management Process 94](#risk-management-process)

[7.3 SPP Application: SPP 96](#spp-application-spp)

[7.3.1 Refinement of the Security Environment
97](#refinement-of-the-security-environment)

[7.3.2 Risk Identification 98](#risk-identification-1)

[7.3.3 Refinement of the Security Objectives
100](#refinement-of-the-security-objectives)

[7.3.4 Refinement of the IT Security Requirements
100](#refinement-of-the-it-security-requirements)

[7.3.5 Supporting Rationale 100](#supporting-rationale)

[7.4 SPP Application: SST 101](#spp-application-sst)

[7.4.1 STOE Summary Specification 101](#stoe-summary-specification)

[7.4.2 SPP Claims 102](#spp-claims)

[7.4.3 Supporting Rationale 102](#supporting-rationale-1)

[8 Rationale 103](#rationale)

[8.1 Security Risks Rationale 103](#security-risks-rationale-1)

[8.1.1 All Assets, Threats and Vulnerabilities Addressed
103](#all-assets-threats-and-vulnerabilities-addressed)

[8.1.2 Security Risks are Sufficient
120](#security-risks-are-sufficient)

[8.2 Security Objectives Rationale
120](#security-objectives-rationale-1)

[8.2.1 All Assumptions, Threats and Policies Addressed
120](#all-assumptions-threats-and-policies-addressed)

[8.2.2 Security Objectives are Sufficient
132](#security-objectives-are-sufficient)

[8.2.3 Suitability of the Security Objectives to counter identified
Risks
132](#suitability-of-the-security-objectives-to-counter-identified-risks)

[8.2.4 Sufficiency of the Security Objectives to counter identified
Risks
137](#sufficiency-of-the-security-objectives-to-counter-identified-risks)

[8.3 Security Requirements Rationale
137](#security-requirements-rationale)

[8.3.1 Suitability of the Security Requirements
137](#suitability-of-the-security-requirements)

[8.3.2 Sufficiency of the Security Requirements
143](#sufficiency-of-the-security-requirements)

[8.3.3 Satisfaction of Dependencies 143](#satisfaction-of-dependencies)

[8.4 Rationale for Extensions 143](#rationale-for-extensions)

[8.4.1 Augmentation for Assurance Background Information
143](#augmentation-for-assurance-background-information)

[8.5 Strength of Function Claims 150](#strength-of-function-claims)

[Appendix A -- Acronyms 151](#appendix-a-acronyms)

**LIST OF TABLES**

[Table 1 --Scope of the STOE 14](#__RefHeading___Toc69732165)

[Table 2 -- Summary of STOE Security Features
15](#__RefHeading___Toc69732166)

[Table 3 -- Secure Usage Assumptions 18](#__RefHeading___Toc69732167)

[Table 4 -- Threat Agents for the STOE 19](#__RefHeading___Toc69732168)

[Table 5 -- Sources of Vulnerabilities of the STOE
20](#__RefHeading___Toc69732169)

[Table 6 -- Attack Methods against the STOE
22](#__RefHeading___Toc69732170)

[Table 7 -- Assets protected by the STOE
23](#__RefHeading___Toc69732171)

[Table 8 -- Threats countered by the STOE
25](#__RefHeading___Toc69732172)

[Table 9 -- Organizational Security Policies
27](#__RefHeading___Toc69732173)

[Table 10 -- Identified Risk Categories for the STOE
29](#__RefHeading___Toc69732174)

[Table 11 -- Security Objectives for the STOE
35](#__RefHeading___Toc69732175)

[Table 12 -- STOE Security Functional Requirements
39](#__RefHeading___Toc69732176)

[Table 13 -- STOE Security Assurance Requirements
64](#__RefHeading___Toc69732177)

[Table 14 - Mapping of Assets, Threats and Vulnerabilities to Security
Risks 103](#__RefHeading___Toc69732178)

[Table 15 - Mapping of Security Risks to Assets, Threats and
Vulnerabilities 116](#__RefHeading___Toc69732179)

[Table 16 - Mapping of Assumptions, Threats, and OSPs to Security
Objectives 120](#__RefHeading___Toc69732180)

[Table 17 - Mapping of Security Objectives to Threats, Policies and
Assumptions 127](#__RefHeading___Toc69732181)

[Table 18 - Mapping of Security Risks to Security Objectives
132](#__RefHeading___Toc69732182)

[Table 19 - Mapping of Security Objectives to Security Risks
134](#__RefHeading___Toc69732183)

[Table 20 - Mapping of Security Objectives to Security Requirements
137](#__RefHeading___Toc69732184)

[Table 21 - Mapping of Security Requirements to Security Objectives
139](#__RefHeading___Toc69732185)

> **Conventions and Terminology**
>
> **Conventions**

The notation, formatting, and conventions used in this System Protection
Profile are consistent with those used in Version 2.1 of the Common
Criteria \[CC\]. Selected presentation choices are discussed here to aid
the System Protection Profile reader. The CC allows several operations
to be performed on functional requirements: The allowable operations
defined in paragraph 2.1.4 of Part 2 of the CC \[CC2\] are *refinement,
selection, assignment* and *iteration.*

-   The assignment operation is used to assign a specific value to an
    unspecified parameter, such as the length of a password. An
    assignment operation is indicated by showing the value in square
    brackets, i.e. \[assignment_value(s)\].

-   The refinement operation is used to add detail to a requirement, and
    thus further restricts a requirement. Refinement of security
    requirements is denoted by **bold text.**

-   The selection operation is picking one or more items from a list in
    order to narrow the scope of a component element. Selections are
    denoted by *[underlined italicized]{.underline}* text.

-   Iterated functional and assurance requirements are given unique
    identifiers by appending to the base requirement identifier from the
    CC an iteration number inside parenthesis, for example,
    FMT_MTD.1.1 (1) and FMT_MTD.1.1 (2) refer to separate instances of
    the FMT_MTD.1 security functional requirement component.

All operations described above are used in this System Protection
Profile. *Italicized text* is used for both official document titles and
text meant to be emphasized more than plain text.

> **Terminology**

The terminology used in the System Protection Profile is that defined in
the Common Criteria \[CC1, CC2\]. A glossary has also been provided in
Appendix A -- Acronyms.

**References**

  ------------------- ---------------------------------------------------
  \[CC\]              Common Criteria for Information Technology Security
                      Evaluation, Version 2.1, August 1999.

  \[CC1\]             Common Criteria Part 1: Introduction and General
                      Model, Version 2.1, CCIB-99-031, August 1999.

  \[CC2\]             Common Criteria Part 2: Security Functional
                      Requirements, Version 2.1, CCIB-99­032, August 1999.

  \[CC3\]             Common Criteria Part 3: Security Assurance
                      Requirements, Version 2.1, CCIB-99­033, August 1999.

  \[CEM\]             Common Evaluation Methodology Part 2: Evaluation
                      Methodology, Version 1.0, CEM­99/045, August 1999.
  ------------------- ---------------------------------------------------

**Document Organization**

**Section 1** provides the introductory material for the System
Protection Profile.

**Section 2** provides general purpose and STOE description.

**Section 3** provides a discussion of the expected environment for the
STOE. This section also defines the set of threats that are to be
addressed by either the technical, operational or management controls
implemented by the STOE or through the environmental controls.

**Section 4** identifies the risks to the STOE that have been derived
from the statement of the security environment defined in section 3.

**Section 5** defines the security objectives for both the STOE and the
STOE environment.

**Section 6** contains the functional and assurance requirements derived
from the Common Criteria, Part 2 and 3 \[CC2, CC3\], respectively that
must be satisfied by the STOE.

**Section 7** contains guidance information for SST authors who would
like to claim conformance to the SPP.

**Section 8** provides a rationale to explicitly demonstrate that the
identified risks to the STOE have been derived from the aspects
identified in the security environment. It also demonstrates how the
security objectives have been derived from each of the identified risks.
The section then explains how the set of requirements are complete
relative to the objectives, and that each security objective is
addressed by one or more component requirements. Arguments are provided
for the coverage of each objective. Section 8 also provides a set of
arguments that address dependency analysis, strength of function issues,
and the internal consistency and mutual supportiveness of the System
Protection Profile requirements.

**Appendix A** documents an acronym list to define frequently used
acronyms applicable to the STOE.

#  {#section .unnumbered}

# Introduction

This introductory section presents *System Protection Profile (SPP)*
identification information and an overview of the SPP.

## SPP Identification

This section provides information needed to identify and control this
SPP. This SPP targets an **extended Evaluation Assurance Level (EAL) 3**
level of assurance for the STOE.

  -------------------- --------------------------------------------------
  **SPP Title:**       System Protection Profile - Industrial Control
                       Systems

  **SPP Version:**     1.0

  **CC Version:**      Common Criteria for Information Technology
                       Security Evaluation, Version 2.1 Final

  **SPP Evaluation:**  National Information Assurance Partnership

  **Author(s):**       National Institute of Standards & Technology

  **Keywords:**        Industrial Control Systems
  -------------------- --------------------------------------------------

## SPP Overview

**SPP Background**

This SPP has been developed as part of the Process Control Security
Requirements Forum (PCSRF) sponsored by the National Institute of
Standards and Technology (NIST). This SPP is intended to provide an ISO
15408 based starting point in formally stating security requirements
associated with industrial control systems (ICS). This SPP includes
security functional requirements (SFRs) and security assurance
requirements (SARs) that extend ISO 15408 to cover issues associated
with systems. These extensions are based on current ISO subcommittee
work to extend ISO 15408 to cover the accreditation of systems and the
evaluation of system protection profiles and system security targets.
These extensions broaden consideration of security controls to include
non-technical controls based on procedural and management functions.

**Industrial Process Security**

Continued existence of modern society is dependent on its industry and
infrastructure and its ability to control electrical, chemical and
mechanical transformations of materials and energy to produce desired
results.

Generally, an ICS is a computer-based system(s) used to control
industrial processes and physical functions. Industrial control systems
automate these control functions allowing for industrial processes that
are faster, larger and more complex than non-automated means. The ICS
and associated systems assure the safe and environmentally acceptable
operation of a specific industrial process.

The ultimate goal of an ICS is to assure the specified operational,
safety and environmental compatibility of a specified industrial process
such as a power plant and its distribution network. The "specified
operation" may be "continued operation" or "demand operation." For
example, a power plant operation generally is supposed to be continuous
while an emergency power generator typically is supposed to operate on
demand only. Safety and environmental compatibility means that neither
personnel safety, nor the quality of the environment (natural or
otherwise) are endangered.

Therefore, the overall security concern for an ICS typically originates
from malicious threat agents attempting to disrupt an industrial process
such as to interfere with it specified operation (e.g. to create a power
outage) or to negatively impact on the environment and/or personnel
safety (e.g. exploding a fuel tank or destabilizing chemical process to
free noxious gases).

It is worth noting that attempting to capture the requirements of all
ICS implementations in a single document is not feasible due to the
differences between the processes and the networks deployed across
various industries. However, there exists a subset of those security
requirements that are applicable to all ICS implementations. This subset
is the focus of this SPP.

The SPP has been written in such a way that it may be used as the basis
for preparing a System Security Target for a specific ICS or as the
basis for a more detailed SPP for a sub-class of ICS such as a
Supervisory Control and Data Acquisition System (SCADA). For more
discussion of the role of this SPP refer to section 7.1 of the
application notes.

**ICS Background**

There are several varieties of ICS, but all consist of the same basic
elements. As shown in Figure 1 those components are: the controller,
sensors, actuators (or final control elements), and in some cases a
human machine interface (HMI) and a remote diagnostics and maintenance
capability. These components may be in close physical proximity or they
may be distributed with great distances (many miles) between some of the
elements) depending on the specific application. In addition to these
technical elements ICS include a human element including operators,
maintainers and engineers. They also have operating procedures and other
non-technical elements.

A simplified view of the operation of an ICS and the function of the
elements is as follows. The controller implement control algorithms
based on a mathematical model of the process to be controlled and the
control objectives. The sensors sense the state of the process through
measurement of process parameters such as temperature, pressure,
voltage, pH, position, size, etc. The state of the process may change
due to external \"disturbances\", changes in the process inputs such as
feed material, or in response to action initiated by the controller. The
controller processes the sensor information and, based on the control
algorithm and desired state of the process, sends commands to the final
control elements which in turn interact with the controlled process to
affect changes in its state. The final control elements take many
different forms including valves, switches, relays, motors, and so forth
depending on the nature of the process under control. The HMI provides a
means for human operators to monitor the state of the process and the
ICS, to interact with the controller to change the control objective and
may also include manual control options (for the case of emergency).
Similarly there may be a remote diagnostics and maintenance interface to
be used in gathering data used for diagnostics, maintenance, emergency
procedures or other similar activities.

**Need for an ICS SPP**

Recently, several factors have raised concern about the security of
industrial control systems. First, there has been a general trend to
replace specialized control devices, particularly controllers and
communications elements, with general purpose computer equipment and
associated data communications technology. Second, many companies have
chosen to interconnect certain parts of their process control networks
with their corporate intranet once they have introduced general-purpose
equipment into the process control system.

These two factors introduce all of the potential vulnerabilities found
in the network computing in general, particularly if there is a path
through the corporate intranet to the Internet at large. Third, for ICS
that are broadly distributed a variety of communications media are used
including the public switched telephone system, wireless communications
and the Internet. There are potential security vulnerabilities
associated with each of these communications paths. Finally, ICS are key
components of much of our national critical infrastructure including the
electric power, water and water treatment, oil and gas production and
distribution as well as industrial and military manufacturing.

To address these vulnerabilities organizations are primarily installing
security retrofits or upgrades to existing their existing ICS. This SPP
is intended to provide a basis for these activities as well as the
design of new systems. In either case, the security functionality should
be implemented based on a risk analysis that determines security
requirements based on an assessment of threats, vulnerabilities and
impacts.

**System Protection Profile - Industrial Control Systems**

The System Protection Profile for Industrial Control Systems (SPP-ICS)
specifies the integrated set of security requirements for industrial
control systems. The integrated set of requirements includes
requirements for operating policies and procedures, requirements for
information technology based system components, requirements for
interfaces and interoperability between system components, and
requirements for the physical environment and protection of the system.

Because the SPP-ICS represents an integrated view of the requirements,
special consideration is given to decomposition of security
functionality and assignment of specific security functions to
sub-systems or components of the overall integrated system. Likewise,
the decomposition or composability of the security functionality is also
considered. The goal of this aspect of analysis and design is to define
security requirements for subsystems or system components at the lowest
possible level while at the same time retaining the required level of
assurance and security functionality for the integrated system as a
whole.

![](media/image3.wmf)As shown in Figure 1 an industrial control system
consists of classes of components for the direct control of a process
(the controller(s), actuators and sensors) a human machine interface and
capabilities for remote diagnostics and maintenance. Although not
represented in the diagram, there are also human elements such as
operators and non-technical elements such as operating procedures.

Figure 1: Generic industrial control system

This system protection profile is written for a generic industrial
control system as a high-level statement of requirements. It provides a
starting point for more specific and detailed statements of requirements
for industrial control systems focused on a specific industry, company,
or component.

# STOE Description

This section provides context for the STOE evaluation by identifying the
system and describing the evaluated configuration.

## Overview of the System Target of Evaluation (STOE)

This section describes the security subsystem of the industrial control
system. The security subsystem includes both the information technology
based components and the non-information technology based elements
implemented via policies and operating procedures. Particular attention
is given to the interaction and dependencies between the security
subsystem and the overall industrial control system.

The STOE focuses on protecting data confidentiality, data integrity and
system availability without interfering with safety system functions.
Data integrity centers on protecting data flows to and from the
controller and the other ICS components or subsystems. The STOE is also
intended to protect system availability to assure continuity of
operations.

## Scope of the STOE

The STOE consists of the security services and procedures, both
automated and manual, which are designed to meet the security objectives
defined to counter threats to the ICS.

The scope of the STOE is depicted graphically in Figure 2. Boxes with
bold red borders depict the primary system security functions. These
functions are: user authentication services (including user access
control), physical access control, boundary protection, and data /
device authentication. User authentication services control access to
process control related computer systems including the human machine
interface (HMI) and remote diagnostics and maintenance. In addition,
user authentication is used by the physical access control system to
authenticate personnel for physical access. Data / device authentication
is shown as a separate function to emphasize the need for data and
command signal authentication. Note that the corporate intranet is in
the external environment of the STOE.

The blue lines from actuator to controlled process and from controlled
process to sensor indicate that these are physical connections
representing the direct interactions that take place. The rest of the
diagram depicts logical connections. Security controls based on
management and operating procedures are not shown in the figure.

![](media/image4.wmf)

Figure 2 *Graphical depiction of System Target of Evaluation*

The scope of the STOE includes the technical and non-technical elements
identified in Table 1.

[]{#__RefHeading___Toc69732165 .anchor}Table 1 --Scope of the STOE

+----------------------+-----------------------------------------------+
| **STOE Components**  | **Example Hardware/Software Components**      |
+======================+===============================================+
| > **Physical         | > Access control for ICS perimeter and        |
| > Boundary           | > control center security                     |
| > Protection**       |                                               |
+----------------------+-----------------------------------------------+
| > **Logical Boundary | > Firewall and other gateway security devices |
| > Protection**       | > (e.g. intrusion detection systems)          |
+----------------------+-----------------------------------------------+
| > **Data             | > Data authentication service performed by    |
| > authentication**   | > ICS components (e.g. authenticators)        |
+----------------------+-----------------------------------------------+
| > **Data             | > Encryption services, such as link           |
| > Confidentiality**  | > encryption devices between trusted          |
|                      | > endpoints                                   |
+----------------------+-----------------------------------------------+
| > **User             | > User authentication service, integration    |
| > Authentication**   | > with physical access control                |
+----------------------+-----------------------------------------------+
| > **Continuity of    | > System backup and recovery, backup power,   |
| > Operations**       | > etc                                         |
+----------------------+-----------------------------------------------+
| > **Operating        | > System policies and procedures (e.g. backup |
| > procedures**       | > frequency, password requirements, etc)      |
+----------------------+-----------------------------------------------+
| > **Training**       | > Security awareness & training courses, etc. |
+----------------------+-----------------------------------------------+
| > **Management       | > Staff selection criteria, disciplinary      |
| > procedures**       | > measures and other relevant personnel       |
|                      | > security policies                           |
+----------------------+-----------------------------------------------+

## Security Features

The STOE provides the following security features:

[]{#__RefHeading___Toc69732166 .anchor}Table 2 -- Summary of STOE
Security Features

+----------------------+-----------------------------------------------+
| > **Feature**        | > **Description**                             |
+======================+===============================================+
| > **Authentication** | > Authentication of the following:            |
|                      |                                               |
|                      | -   Financial and business critical           |
|                      |     information sent from the ICS to external |
|                      |     systems                                   |
|                      |                                               |
|                      | -   Configuration change commands affecting   |
|                      |     core ICS functions (e.g. control          |
|                      |     algorithms, set points, limit points etc) |
|                      |                                               |
|                      | -   Users and services accessing the          |
|                      |     protected assets (e.g. actuators, control |
|                      |     systems, etc)                             |
+----------------------+-----------------------------------------------+
| >                    | > Protection of business, financial and       |
|  **Confidentiality** | > control data from unauthorized disclosure   |
|                      | > (as determined by risk assessment and       |
|                      | > approved by the data or system owner),      |
|                      | > including, but not limited to, appropriate  |
|                      | > segments within the ICS network.            |
+----------------------+-----------------------------------------------+
| > **Integrity**      | > Protection against the unauthorized         |
|                      | > modification of the following information:  |
|                      |                                               |
|                      | -   Information flows of a sensitive nature   |
|                      |     on exposed network segments               |
|                      |                                               |
|                      | -   Internal control data used throughout the |
|                      |     ICS                                       |
|                      |                                               |
|                      | -   ICS operational system configuration      |
+----------------------+-----------------------------------------------+
| > **Availability**   | > Protection against the loss of availability |
|                      | > of all critical and major ICS operational   |
|                      | > systems including, but not limited to,      |
|                      |                                               |
|                      | -   Control servers                           |
|                      |                                               |
|                      | -   Primary communications channel (or        |
|                      |     network)                                  |
|                      |                                               |
|                      | -   ICS operational system configuration      |
|                      |     capability                                |
+----------------------+-----------------------------------------------+
| > **Boundary         | > Protection against unauthorized attempts to |
| > Protection**       | > breech both the physical and the logical    |
|                      | > boundaries of the ICS.                      |
+----------------------+-----------------------------------------------+
| > **Access control** | > Strict access control for the following:    |
|                      |                                               |
|                      | -   On-site and off-site remote access into   |
|                      |     the ICS network                           |
|                      |                                               |
|                      | -   Externally-visible interfaces of the ICS  |
|                      |                                               |
|                      | -   System resources deemed by the owner(s)   |
|                      |     as requiring protection                   |
|                      |                                               |
|                      | -   Those system functions capable of         |
|                      |     modifying ICS configuration               |
|                      |                                               |
|                      | -   Critical ICS processes based on state     |
|                      |     information relevant to that process      |
|                      |     (e.g. time of day, location, etc)         |
+----------------------+-----------------------------------------------+
| > **Backup /         | > Backup mechanisms for critical ICS data and |
| > Recovery**         | > control information to enable timely        |
|                      | > recovery from system compromises or damage. |
+----------------------+-----------------------------------------------+
| > **Audit**          | > Entries in the audit log of appropriate ICS |
|                      | > components detailing the successful and     |
|                      | > unsuccessful security relevant activities   |
|                      | > of users and applications.                  |
+----------------------+-----------------------------------------------+
| > **Monitoring**     | > Monitoring and detection of unauthorized    |
|                      | > activity, unusual activity and attempts to  |
|                      | > defeat the security capabilities of the     |
|                      | > ICS, including the deployment of intrusion  |
|                      | > detection systems (IDS) at critical parts   |
|                      | > of the ICS infrastructure.                  |
+----------------------+-----------------------------------------------+
| > **Non-interference | > Non-interference of ICS security functions  |
| > with safety        | > and safety-critical functions while         |
| > critical           | > maintaining ICS performance.                |
| > functions**        |                                               |
+----------------------+-----------------------------------------------+
| > **Self             | > Self-tests to verify the configuration and  |
| > Verification**     | > integrity of the security functions of the  |
|                      | > ICS.                                        |
+----------------------+-----------------------------------------------+
| > **Emergency        | > Emergency power sufficient to allow for     |
| > power**            | > graceful shutdown of the ICS and the        |
|                      | > controlled process in the event that        |
|                      | > primary and secondary power fail.           |
+----------------------+-----------------------------------------------+
| > **Security Plans,  | > Security plans, policies and procedures     |
| > Policies &         | > covering at least the following areas:      |
| > Procedures**       |                                               |
|                      | -   Overarching security policy governing the |
|                      |     access and necessary protection for all   |
|                      |     ICS components                            |
|                      |                                               |
|                      | -   Security management of the ICS and        |
|                      |     associated infrastructure                 |
|                      |                                               |
|                      | -   Security management roles and             |
|                      |     responsibilities throughout the ICS       |
|                      |     management infrastructure                 |
|                      |                                               |
|                      | -   Documentation of the organizational risk  |
|                      |     management process and its relationship   |
|                      |     to ICS systems                            |
|                      |                                               |
|                      | -   Business continuity and disaster recovery |
|                      |     plans for the ICS                         |
|                      |                                               |
|                      | -   Migration Strategy covering the           |
|                      |     identification, assessment and treatment  |
|                      |     of new or existing vulnerabilities (in    |
|                      |     accordance with risk management policy)   |
|                      |     during the life-cycle of the ICS          |
|                      |                                               |
|                      | -   Policies governing the roles,             |
|                      |     responsibilities and activities           |
|                      |     authorized for third parties interfacing  |
|                      |     with ICS components                       |
|                      |                                               |
|                      | -   Policies and the necessary procedures to  |
|                      |     ensure adherence to identified compliance |
|                      |     regulations (e.g. System Audits, Privacy  |
|                      |     Act, etc)                                 |
+----------------------+-----------------------------------------------+

## Features Outside of Scope 

Features outside the scope of the defined STOE:

-   General physical protection outside the scope of the ICS

-   Enterprise intranet protection

-   Protection of \"business\" information and systems other than that
    generated by the ICS while it resides within the ICS.

-   Primary power sources (e.g. mains generated supply)

-   General corporate-level security policies, procedures and training
    (the STOE will only address ICS specific policies, procedures and
    training)

#  {#section-1 .unnumbered}

# STOE Security Environment

> In order to clarify the nature of the security problem that the STOE
> is intended to solve, this section describes the following:

-   Any assumptions about the security aspects of the environment and/or
    of the manner in which the STOE is intended to be used.

-   Any known or assumed threats to the assets against which specific
    protection within the STOE or its environment is required.

-   Any organizational security policy statements or rules with which
    the STOE must comply.

## Secure Usage Assumptions

The following assumptions relate to the operation of the TOE:

[]{#__RefHeading___Toc69732167 .anchor}Table 3 -- Secure Usage
Assumptions

+--------------------+-------------------------------------------------+
| **Name**           | **Description**                                 |
+====================+=================================================+
| > **A              | > In accordance with organizational policy      |
| .PHYSICAL_ACCESS** | > physical access controls are applied at       |
|                    | > designated physical access points throughout  |
|                    | > the system whose perimeters are defined by    |
|                    | > the organization, and personnel with          |
|                    | > authorized access is documented and           |
|                    | > maintained. Entry to secure areas is          |
|                    | > controlled and monitored on a periodic basis. |
+--------------------+-------------------------------------------------+
| >                  | > In accordance with organizational policy,     |
| **A.COMMS_ACCESS** | > physical access to communication media, and   |
|                    | > connections to the media, and services        |
|                    | > allowed to go over the communications media   |
|                    | > (e.g., internet access, e-mail) is            |
|                    | > controlled, as is access to devices that      |
|                    | > display or output system control information. |
+--------------------+-------------------------------------------------+
| > **A.EXTERNAL**   | > The ICS network may have connectivity with    |
|                    | > non-ICS system networks through which         |
|                    | > Internet connectivity is possible.            |
+--------------------+-------------------------------------------------+
| > **A.REMOTE**     | > Remote access to ICS components may be        |
|                    | > available to authorized individuals.          |
+--------------------+-------------------------------------------------+

## Threats to Security

Threats may be addressed either by the STOE or by its intended
environment (for example, using personnel, physical, or administrative
safeguards not provided by the STOE). These two classes of threats are
discussed separately.

Threats are characterized in terms of an identified threat agent, the
attack, and the asset that is the subject of the attack. Threats agents
are described as a combination of expertise, available resources, and
motivation. Attacks are described as a combination of attack methods,
any vulnerabilities exploited, and opportunity.

### Threats Addressed by the STOE

The following sections document the threat agents, attacks and assets
relevant to the STOE. The last section combines all three aspects into a
list of threats to be countered by the STOE.

#### Threat Agents

Threats agents are characterized through a combination of expertise,
available resources, and motivation. The threat agents relevant to the
STOE have been captured below in Table 4.

[]{#__RefHeading___Toc69732168 .anchor}Table 4 -- Threat Agents for the
STOE

+--------------------+-----------+-----------+-----------+-------------+
| > **Threat Agent   | > *       |           |           |             |
| > Label**          | *Descript |           |           |             |
|                    | ion**[^1] |           |           |             |
+====================+===========+===========+===========+=============+
|                    | >         | > **Ex    | > **Re    | > **M       |
|                    |  **Threat | pertise** | sources** | otivation** |
|                    | > Agent** |           |           |             |
+--------------------+-----------+-----------+-----------+-------------+
| >                  | > Trusted | >         | > Su      | > No        |
|  **AGENT.INSIDER** | >         |  Low/High | bstantial | n-malicious |
|                    | employee, |           |           |             |
|                    | > co      |           |           |             |
|                    | ntractor, |           |           |             |
|                    | > vendor  |           |           |             |
|                    | > or      |           |           |             |
|                    | >         |           |           |             |
|                    |  customer |           |           |             |
+--------------------+-----------+-----------+-----------+-------------+
| > **AG             | > Trusted | >         | > Su      | > Malicious |
| ENT.EVIL_INSIDER** | >         |  Low/High | bstantial |             |
|                    | employee, |           |           |             |
|                    | > co      |           |           |             |
|                    | ntractor, |           |           |             |
|                    | > vendor  |           |           |             |
|                    | > or      |           |           |             |
|                    | >         |           |           |             |
|                    |  customer |           |           |             |
|                    | > acting  |           |           |             |
|                    | > inappr  |           |           |             |
|                    | opriately |           |           |             |
+--------------------+-----------+-----------+-----------+-------------+
| > **AGE            | > Former  | >         | >         | > Malicious |
| NT.PRIOR_INSIDER** | > trusted |  Low/High |  Moderate |             |
|                    | >         |           |           |             |
|                    | employee, |           |           |             |
|                    | > co      |           |           |             |
|                    | ntractor, |           |           |             |
|                    | > vendor  |           |           |             |
|                    | > or      |           |           |             |
|                    | >         |           |           |             |
|                    |  customer |           |           |             |
+--------------------+-----------+-----------+-----------+-------------+
| >                  | > Una     | > High    | >         | > Malicious |
| **AGENT.OUTSIDER** | uthorized |           |  Minimal/ |             |
|                    | >         |           | >         |             |
|                    |  external |           | >         |             |
|                    | > party   |           |  Moderate |             |
+--------------------+-----------+-----------+-----------+-------------+
| > **AGENT.NATURE** | > Envi    | > N/A     | > Su      | > N/A       |
|                    | ronmental |           | bstantial |             |
|                    | > sources |           |           |             |
|                    | > of      |           |           |             |
|                    | > threats |           |           |             |
|                    | > such as |           |           |             |
|                    | > ear     |           |           |             |
|                    | thquakes, |           |           |             |
|                    | > flood   |           |           |             |
|                    | > and     |           |           |             |
|                    | > fire    |           |           |             |
+--------------------+-----------+-----------+-----------+-------------+

Evil insiders include those legitimate users on the internal ICS network
who misuse privileges or impersonate higher-privileged users.

Outsiders include those intruders gaining access to the ICS from the
Internet, dialup lines, physical break-ins, or from partner (supplier or
customer) networks linked to the corporate network.

#### Attacks

Attacks are described as a combination of attack methods, any
vulnerabilities exploited, and opportunity.

##### Sources of Vulnerability

The sources of vulnerability applicable to the STOE have been captured
below. Please note that these sources of vulnerability should be further
refined by the SST author to identify specific vulnerabilities
applicable to the their own instantiation of the STOE.

Editor's note: The table below refers to sources or categories of
vulnerabilities applicable to an ICS. It is envisaged that the
categories of vulnerabilities listed below will be refined by the SST
author as each STOE will have vulnerabilities specific to their own
security environment in which the ICS is deployed.

[]{#__RefHeading___Toc69732169 .anchor}Table 5 -- Sources of
Vulnerabilities of the STOE

+----------------+-------------+--------------------------------------+
| > *            | > **Vuln    | > **Description**                    |
| *Vulnerability | erability** |                                      |
| > Label**      |             |                                      |
+================+=============+======================================+
| > *            | > Use of    | > The use of clear text protocols    |
| *V.PLAINTEXT** | > clear     | > and the transmission of business   |
|                | > text      | > and control data unencrypted over  |
|                | > protocols | > insecure communication channels    |
|                |             | > (e.g. FTP, TELNET).                |
+----------------+-------------+--------------------------------------+
| >              | >           | > The presence of unnecessary system |
| **V.SERVICES** | Unnecessary | > services on key ICS components and |
|                | > services  | > subsystems that may be exploited   |
|                | > enabled   | > to negatively impact on system     |
|                | > on system | > security (e.g. sendmail, finger    |
|                | >           | > services).                         |
|                |  components |                                      |
+----------------+-------------+--------------------------------------+
| > **V.REMOTE** | > Remote    | > Uncontrolled external access to    |
|                | > access    | > the corporate network (e.g.        |
|                | > vuln      | > through the Internet) allowing     |
|                | erabilities | > unauthorized entry to the          |
|                |             | > interconnected ICS network. Also   |
|                |             | > includes vulnerabilities           |
|                |             | > introduced through poor VPN        |
|                |             | > configuration, exposed wireless    |
|                |             | > access points, uncontrolled modem  |
|                |             | > access (e.g. through networked     |
|                |             | > faxes) and weak remote user        |
|                |             | > authentication techniques.         |
+----------------+-------------+--------------------------------------+
| > **V.         | > Poor      | > Business and operational           |
| ARCHITECTURE** | > system    | > requirements impacting on the      |
|                | > a         | > effectiveness of deployed or       |
|                | rchitecture | > planned security measures to       |
|                | > design    | > protect the confidentiality,       |
|                | > leading   | > integrity and availability of the  |
|                | > to        | > ICS and its components. Poor       |
|                | >           | > security architecture may also     |
|                |  weaknesses | > lead to the bypass and tamper of   |
|                | > in system | > ICS security functions.            |
|                | > security  |                                      |
|                | > posture   |                                      |
+----------------+-------------+--------------------------------------+
| > **V          | > Poor      | > Lack of quality processes (e.g.    |
| .DEVELOPMENT** | > system    | > configuration management, quality  |
|                | >           | > testing) leading to errors in      |
|                | development | > system implementation and third    |
|                | > practices | > party products such as buffer      |
|                | > leading   | > overflows and errors in control    |
|                | > to        | > algorithms.                        |
|                | > weakness  |                                      |
|                | > in system |                                      |
|                | > imp       |                                      |
|                | lementation |                                      |
+----------------+-------------+--------------------------------------+
| > **           | >           | > Lack of formal system policies,    |
| V.NOPOLICIES** |  Inadequate | > plans and procedures (e.g. weak    |
|                | > system    | > password policies, no incident     |
|                | > security  | > response plans, irregular          |
|                | > policies, | > compliance audits, poor            |
|                | > plans and | > configuration management policies  |
|                | >           | > and procedures, poor system        |
|                |  procedures | > auditing practices, backup         |
|                |             | > procedures etc).                   |
+----------------+-------------+--------------------------------------+
| > **V.SPOF**   | > Single    | > Poor security architecture design  |
|                | > Points of | > leading to one or more single      |
|                | > Failure   | > points of failure in the ICS and   |
|                |             | > resulting in system                |
|                |             | > unavailability.                    |
+----------------+-------------+--------------------------------------+
| > **           | >           | > Inadequate training on system      |
| V.NOTRAINING** |  Inadequate | > security issues leading to poor    |
|                | > user      | > user security awareness.           |
|                | > training  |                                      |
+----------------+-------------+--------------------------------------+
| >              | > U         | > Unauthorized user access to the    |
| **V.3RDPARTY** | nauthorized | > ICS or its components via a 3^rd^  |
|                | > access to | > party network connection.          |
|                | > ICS via   |                                      |
|                | > 3^rd^     |                                      |
|                | > party     |                                      |
|                | > network   |                                      |
+----------------+-------------+--------------------------------------+
| > **V.NORISK** | > Lack of   | > Inadequate risk assessment         |
|                | > risk      | > activities performed on critical   |
|                | >           | > assets leading to a poor           |
|                |  assessment | > understanding of the security      |
|                |             | > posture of the ICS and the         |
|                |             | > security controls needed to        |
|                |             | > counter security risks to the      |
|                |             | > organization.                      |
+----------------+-------------+--------------------------------------+

##### Attack Descriptions

The generic types of attack relevant to the STOE have been captured
below. Please note that the referenced vulnerabilities have been defined
in the previous section.

[]{#__RefHeading___Toc69732170 .anchor}

Table 6 -- Attack Methods against the STOE

+----------------+------------+------------+------------+------------+
| > **Attack     | > **Des    |            |            |            |
| > Label**      | cription** |            |            |            |
+================+============+============+============+============+
|                | >          | >          | >          | >          |
|                | **Attack** | **Method** |  **Vulnera |  **Opportu |
|                |            |            | bilities** | nity**[^2] |
+----------------+------------+------------+------------+------------+
| > **           | > Un       | > Packet   | > V.       | > Locally  |
| ATTACK.SNIFF** | authorized | > capture  | PLAINTEXT, | > &        |
|                | > traffic  | > tool,    | > V.ARC    | > Remotely |
|                | > analysis | >          | HITECTURE, |            |
|                |            |  keystroke | >          |            |
|                |            | > logger   |  V.REMOTE, |            |
|                |            | > etc      | > V        |            |
|                |            |            | .3RDPARTY, |            |
|                |            |            | > V.NORISK |            |
+----------------+------------+------------+------------+------------+
| > **A          | > Un       | > Packet   | > V.       | > Locally  |
| TTACK.REPLAY** | authorized | > capture  | PLAINTEXT, | > &        |
|                | > replay   | > tool,    | > V.ARC    | > Remotely |
|                | > of       | >          | HITECTURE, |            |
|                | > captured |  keystroke | >          |            |
|                | > traffic  | > logger   |  V.REMOTE, |            |
|                |            | > etc      | > V        |            |
|                |            |            | .3RDPARTY, |            |
|                |            |            | > V.NORISK |            |
+----------------+------------+------------+------------+------------+
| > **           | > Imp      | > Ex       | > V.       | > Locally  |
| ATTACK.SPOOF** | ersonating | ploitation | PLAINTEXT, | > &        |
|                | > an       | > of weak  | >          | > Remotely |
|                | >          | > user     |  V.REMOTE, |            |
|                | authorized | > auth     | > V.ARC    |            |
|                | > user     | entication | HITECTURE, |            |
|                |            | >          | > V.N      |            |
|                |            |  mechanism | OPOLICIES, |            |
|                |            |            | > V        |            |
|                |            |            | .3RDPARTY, |            |
|                |            |            | > V.NORISK |            |
+----------------+------------+------------+------------+------------+
| >              | > O        | > Denial   | > V        | > Remotely |
| **ATTACK.DOS** | verloading | > of       | .SERVICES, |            |
|                | > the      | > service  | >          |            |
|                | > network  | > attack   |  V.REMOTE, |            |
|                |            | > from the | > V.ARC    |            |
|                |            | > Internet | HITECTURE, |            |
|                |            | > causing  | > V.SPOF,  |            |
|                |            | > system   | > V        |            |
|                |            | > downtime | .3RDPARTY, |            |
|                |            |            | > V.NORISK |            |
+----------------+------------+------------+------------+------------+
| > **           | > Operator | > ICS      | > V        | > Locally  |
| ATTACK.ERROR** | > error    | > system   | .SERVICES, |            |
|                |            | > operator | > V.N      |            |
|                |            | > error    | OPOLICIES, |            |
|                |            | > causing  | > V.N      |            |
|                |            | > security | OTRAINING, |            |
|                |            | > breach   | > V.NORISK |            |
+----------------+------------+------------+------------+------------+
| > **A          | > Social   | > U        | > V.N      | > Locally  |
| TTACK.SOCIAL** | > e        | nsolicited | OPOLICIES, | > &        |
|                | ngineering | > contact  | > V.N      | > Remotely |
|                | > of       | > with     | OTRAINING, |            |
|                | >          | > employee | > V.NORISK |            |
|                | authorized | > with the |            |            |
|                | > users    | > intent   |            |            |
|                |            | > of       |            |            |
|                |            | > d        |            |            |
|                |            | iscovering |            |            |
|                |            | > user     |            |            |
|                |            | > c        |            |            |
|                |            | redentials |            |            |
|                |            | > or       |            |            |
|                |            | >          |            |            |
|                |            |  acquiring |            |            |
|                |            | >          |            |            |
|                |            |  sensitive |            |            |
|                |            | > i        |            |            |
|                |            | nformation |            |            |
+----------------+------------+------------+------------+------------+
| > **           | > Virus    | > Virus    | > V        | > Locally  |
| ATTACK.VIRUS** | >          | > p        | .SERVICES, |            |
|                |  infection | ropagation | >          |            |
|                | > of ICS   | > via      |  V.REMOTE, |            |
|                | > system   | > email    | > V.ARC    |            |
|                | >          | > system   | HITECTURE, |            |
|                | components | > or       | > V.N      |            |
|                |            | > Internet | OPOLICIES, |            |
|                |            | >          | > V.N      |            |
|                |            | downloaded | OTRAINING, |            |
|                |            | > content  | > V        |            |
|                |            | > (e.g.    | .3RDPARTY, |            |
|                |            | > Trojan)  | > V.NORISK |            |
+----------------+------------+------------+------------+------------+
| > **AT         | > D        | > File     | > V        | > Locally  |
| TACK.DESTROY** | estruction | > deletion | .SERVICES, | > &        |
|                | > of ICS   | > on       | >          | > Remotely |
|                | > control  | > c        |  V.REMOTE, |            |
|                | > data,    | ompromised | > V.ARC    |            |
|                | > business | > ICS file | HITECTURE, |            |
|                | > data or  | > servers  | > V.N      |            |
|                | > con      |            | OPOLICIES, |            |
|                | figuration |            | > V.N      |            |
|                | > i        |            | OTRAINING, |            |
|                | nformation |            | > V.NORISK |            |
+----------------+------------+------------+------------+------------+
| > **A          | > Mo       | > File     | > V        | > Locally  |
| TTACK.MODIFY** | dification | > mo       | .SERVICES, | > &        |
|                | > of ICS   | dification | >          | > Remotely |
|                | > control  | > on       |  V.REMOTE, |            |
|                | > data,    | > c        | > V.ARC    |            |
|                | > business | ompromised | HITECTURE, |            |
|                | > data or  | > ICS file | > V.N      |            |
|                | > con      | > servers  | OPOLICIES, |            |
|                | figuration |            | > V.N      |            |
|                | > i        |            | OTRAINING, |            |
|                | nformation |            | > V.NORISK |            |
+----------------+------------+------------+------------+------------+
| > **A          | > Bypass   | > Mo       | > V        | > Locally  |
| TTACK.BYPASS** | > of       | dification | .SERVICES, | > &        |
|                | > system   | > of ICS   | >          | > Remotely |
|                | > security | > conf     |  V.REMOTE, |            |
|                | >          | igurations | > V.ARC    |            |
|                |  functions | > of       | HITECTURE, |            |
|                | > and      | >          | > V.NORISK |            |
|                | >          | components |            |            |
|                | mechanisms |            |            |            |
+----------------+------------+------------+------------+------------+
| > **ATT        | >          | > Un       | > V.ARC    | > Locally  |
| ACK.PHYSICAL** | Compromise | authorized | HITECTURE, |            |
|                | > of       | > access   | > V.N      |            |
|                | > poorly   | > to       | OPOLICIES, |            |
|                | > i        | >          | > V.N      |            |
|                | mplemented | physically | OTRAINING, |            |
|                | > and/or   | > secured  | > V.NORISK |            |
|                | >          | > areas    |            |            |
|                | controlled | > housing  |            |            |
|                | > physical | > system   |            |            |
|                | > security | > assets   |            |            |
|                | >          | > (e.g.    |            |            |
|                | mechanisms | >          |            |            |
|                |            |  perimeter |            |            |
|                |            | > security |            |            |
|                |            | > breach)  |            |            |
+----------------+------------+------------+------------+------------+
| > **A          | > Acts of  | > Env      | > V.ARC    | > Locally  |
| TTACK.NATURE** | > nature   | ironmental | HITECTURE, |            |
|                | > causing  | > o        | > V.N      |            |
|                | > system   | ccurrences | OPOLICIES, |            |
|                | > unav     | > such as  | > V.       |            |
|                | ailability | > e        | NOTRAINING |            |
|                |            | arthquake, | > V.SPOF,  |            |
|                |            | > flood    | > V.NORISK |            |
|                |            | > and fire |            |            |
+----------------+------------+------------+------------+------------+

#### Assets

Assets protected by the STOE include the following:

[]{#__RefHeading___Toc69732171 .anchor}Table 7 -- Assets protected by
the STOE

+-------------------------+------------+------------------------------+
| > **Asset Label**       | >          | > **Description**            |
|                         |  **Asset** |                              |
+=========================+============+==============================+
| > **ASSET.ACTUATOR**    | > Actuator | > One or more devices that   |
|                         |            | > receive the controlled     |
|                         |            | > variables from the         |
|                         |            | > controller and feeds them  |
|                         |            | > into the controlled        |
|                         |            | > process for action.        |
+-------------------------+------------+------------------------------+
| > **ASSET.SENSOR**      | > Sensor   | > One or more devices that   |
|                         |            | > sense or detect the value  |
|                         |            | > of a process variable and  |
|                         |            | > generates a signal related |
|                         |            | > to the value (includes the |
|                         |            | > sensing and transmitting   |
|                         |            | > parts of the device).      |
+-------------------------+------------+------------------------------+
| > **ASSET.CONTROLLER**  | >          | > The computer system or     |
|                         | Controller | > components that processes  |
|                         |            | > sensor input, executes     |
|                         |            | > control algorithms and     |
|                         |            | > computes actuator outputs  |
|                         |            | > (e.g. Programmable Logic   |
|                         |            | > Controllers).              |
+-------------------------+------------+------------------------------+
| > **ASSET.HMI**         | > HMI      | > The hardware or software   |
|                         |            | > through which an operator  |
|                         |            | > interacts with a           |
|                         |            | > controller, providing a    |
|                         |            | > user with a view into the  |
|                         |            | > manufacturing process for  |
|                         |            | > monitoring or controlling  |
|                         |            | > the process.               |
+-------------------------+------------+------------------------------+
| > **ASSET.REMOTE**      | > Remote   | > The hardware and software  |
|                         | > D        | > devices responsible for    |
|                         | iagnostics | > diagnostic and maintenance |
|                         | > &        | > activities performed on    |
|                         | > M        | > the ICS from remote        |
|                         | aintenance | > locations (e.g. Remote     |
|                         |            | > Terminal Units,            |
|                         |            | > pcAnywhere). May also      |
|                         |            | > include the communications |
|                         |            | > mechanism or protocol used |
|                         |            | > to access to the ICS (e.g. |
|                         |            | > VPN).                      |
+-------------------------+------------+------------------------------+
| > **ASSET.COMMS**       | > Comm     | > The communications         |
|                         | unications | > infrastructure used to     |
|                         | > Infr     | > bridge the control loop    |
|                         | astructure | > within an ICS. Also        |
|                         |            | > includes the network       |
|                         |            | > protocols and control      |
|                         |            | > equipment used to          |
|                         |            | > integrate ICS components   |
|                         |            | > and subsystems (e.g.       |
|                         |            | > Ethernet, wireless, RS-232 |
|                         |            | > etc).                      |
+-------------------------+------------+------------------------------+
| > **ASSET.CTRLPROCESS** | >          | > The process subject to     |
|                         | Controlled | > analysis and control by    |
|                         | > Process  | > the ICS (including the     |
|                         |            | > inputs and outputs to the  |
|                         |            | > process).                  |
+-------------------------+------------+------------------------------+
| > **ASSET.CTRLINFO**    | > Process  | > The process control        |
|                         | > Control  | > information being          |
|                         | > I        | > collected by, processed    |
|                         | nformation | > by, stored on and          |
|                         |            | > transmitted to or from the |
|                         |            | > components that constitute |
|                         |            | > the process control        |
|                         |            | > network                    |
+-------------------------+------------+------------------------------+
| > **ASSET.BUSINFO**     | > Process  | > The process control        |
|                         | > Control  | > business or financial      |
|                         | > Business | > information being created  |
|                         | > I        | > by, processed by, stored   |
|                         | nformation | > on and transmitted to or   |
|                         |            | > from the components that   |
|                         |            | > constitute the process     |
|                         |            | > control network.           |
+-------------------------+------------+------------------------------+

#### Threat Description

Using the description of the threat agents, attacks and assets captured
in the previous sections, each of the threats relevant to the STOE have
been characterized below:

[]{#__RefHeading___Toc69732172 .anchor}Table 8 -- Threats countered by
the STOE

+-------------------+----------+--------------------------------------+
| > **Threat        | > **     | > **Description**                    |
| > Label**         | Threat** |                                      |
+===================+==========+======================================+
| >                 | > Unau   | > An unauthorized individual         |
|  **T.DISCLOSURE** | thorized | > (AGENT.EVIL_INSIDER,               |
|                   | > Inf    | > AGENT.PRIOR_INSIDER,               |
|                   | ormation | > AGENT.OUTSIDER) directs an attack  |
|                   | > Di     | > (ATTACK.SNIFF, ATTACK.SOCIAL) to   |
|                   | sclosure | > acquire sensitive information      |
|                   |          | > (ASSET.COMMS, ASSET.CTRLINFO,      |
|                   |          | > ASSET.BUSINFO) stored on ICS       |
|                   |          | > components.                        |
+-------------------+----------+--------------------------------------+
| > **              | > Unau   | > An unauthorized individual         |
| T.EVIL_ANALYSIS** | thorized | > (AGENT.EVIL_INSIDER,               |
|                   | >        | > AGENT.PRIOR_INSIDER,               |
|                   | Analysis | > AGENT.OUTSIDER) directs an attack  |
|                   |          | > (ATTACK.SNIFF, ATTACK.SOCIAL) to   |
|                   |          | > analyze sensitive information      |
|                   |          | > flows (ASSET.COMMS,                |
|                   |          | > ASSET.CTRLPROCESS, ASSET.CTRLINFO, |
|                   |          | > ASSET.BUSINFO) protected by the    |
|                   |          | > STOE.                              |
+-------------------+----------+--------------------------------------+
| > **T.EV          | > Unau   | > An unauthorized individual         |
| IL_MODIFICATION** | thorized | > (AGENT.EVIL_INSIDER,               |
|                   | > Modi   | > AGENT.PRIOR_INSIDER,               |
|                   | fication | > AGENT.OUTSIDER) directs an attack  |
|                   |          | > (ATTACK.MODIFY, ATTACK.BYPASS,     |
|                   |          | > ATTACK.SNIFF) to modify sensitive  |
|                   |          | > information (ASSET.CTRLPROCESS,    |
|                   |          | > ASSET.CTRLINFO, ASSET.BUSINFO)     |
|                   |          | > stored on ICS components.          |
+-------------------+----------+--------------------------------------+
| > **T.E           | > Unau   | > An unauthorized individual         |
| VIL_DESTRUCTION** | thorized | > (AGENT.EVIL_INSIDER,               |
|                   | > Des    | > AGENT.PRIOR_INSIDER,               |
|                   | truction | > AGENT.OUTSIDER) directs an attack  |
|                   |          | > (ATTACK.DESTROY, ATTACK.BYPASS) to |
|                   |          | > destroy sensitive information      |
|                   |          | > (ASSET.CTRLPROCESS,                |
|                   |          | > ASSET.CTRLINFO, ASSET.BUSINFO)     |
|                   |          | > stored on ICS components.          |
+-------------------+----------+--------------------------------------+
| >                 | > T      | > The tampering of ICS components    |
| **T.CTRL_TAMPER** | ampering | > (ASSET.ACTUATOR, ASSET.SENSOR,     |
|                   | > with   | > ASSET.CONTROLLER, ASSET.HMI,       |
|                   | >        | > ASSET.REMOTE, ASSET.COMMS) by      |
|                   |  control | > malicious individuals              |
|                   | > co     | > (AGENT.EVIL_INSIDER,               |
|                   | mponents | > AGENT.PRIOR_INSIDER,               |
|                   |          | > AGENT.OUTSIDER) via the following  |
|                   |          | > attacks (ATTACK.MODIFY,            |
|                   |          | > ATTACK.BYPASS, ATTACK.PHYSICAL).   |
+-------------------+----------+--------------------------------------+
| >                 | > I      | > An authorized operator             |
| **T.BAD_COMMAND** | ntegrity | > (AGENT.INSIDER) accidentally       |
|                   | > of     | > issues bad commands (ATTACK.ERROR) |
|                   | >        | > resulting in the modification of   |
|                   |  Control | > controlled ICS processes and       |
|                   | >        | > components (ASSET.CTRLPROCESS,     |
|                   | Commands | > ASSET.ACTUATOR, ASSET.SENSOR,      |
|                   |          | > ASSET.CONTROLLER, ASSET.HMI).      |
+-------------------+----------+--------------------------------------+
| > **T.SPOOF**     | >        | > An unauthorized individual         |
|                   | Spoofing | > (AGENT.EVIL_INSIDER,               |
|                   | > le     | > AGENT.PRIOR_INSIDER,               |
|                   | gitimate | > AGENT.OUTSIDER) directs an attack  |
|                   | > users  | > (ATTACK.SNIFF, ATTACK.SPOOF,       |
|                   | > of the | > ATTACK.SOCIAL) to obtain user      |
|                   | > STOE   | > credentials (ASSET.REMOTE,         |
|                   |          | > ASSET.COMMS) stored on ICS server  |
|                   |          | > components to impersonate          |
|                   |          | > authorized users.                  |
+-------------------+----------+--------------------------------------+
| > **T.REPUDIATE** | >        | > An authorized user (AGENT.INSIDER) |
|                   | Identity | > denies having performed an action  |
|                   | > rep    | > (ATTACK.ERROR) on the ICS          |
|                   | udiation | > interactive systems (ASSET.REMOTE, |
|                   |          | > ASSET.COMMS, ASSET.HMI).           |
+-------------------+----------+--------------------------------------+
| > **T.DOS**       | > Denial | > An unauthorized individual         |
|                   | > of     | > (AGENT.EVIL_INSIDER,               |
|                   | >        | > AGENT.PRIOR_INSIDER,               |
|                   |  Service | > AGENT.OUTSIDER) directs an attack  |
|                   |          | > (ATTACK.DESTROY, ATTACK.DOS) that  |
|                   |          | > denies service to valid users by   |
|                   |          | > making ICS components              |
|                   |          | > (ASSET.ACTUATOR, ASSET.SENSOR,     |
|                   |          | > ASSET.CONTROLLER, ASSET.HMI,       |
|                   |          | > ASSET.REMOTE, ASSET.COMMS)         |
|                   |          | > temporarily unavailable or         |
|                   |          | > unusable.                          |
+-------------------+----------+--------------------------------------+
| > **T.PRIVILEGE** | > E      | > An unprivileged individual         |
|                   | levation | > (AGENT.EVIL_INSIDER,               |
|                   | > of     | > AGENT.PRIOR_INSIDER,               |
|                   | > p      | > AGENT.OUTSIDER) directs an attack  |
|                   | rivilege | > (ATTACK.ERROR, ATTACK.SNIFF,       |
|                   |          | > ATTACK.SPOOF, ATTACK.SOCIAL) to    |
|                   |          | > obtain user credentials            |
|                   |          | > (ASSET.REMOTE, ASSET.COMMS) stored |
|                   |          | > on ICS server components to        |
|                   |          | > elevate privileged access to ICS   |
|                   |          | > components for malicious purposes. |
+-------------------+----------+--------------------------------------+
| > **T.            | > Fault  | > Faults generated by the system     |
| NO_FAULT_RECORD** | > D      | > (AGENT.INSIDER) as a consequence   |
|                   | etection | > of operator error and/or security  |
|                   |          | > breach (ATTACK.ERROR) while        |
|                   |          | > performing their routine tasks are |
|                   |          | > not detected nor audited on ICS    |
|                   |          | > interactive systems (ASSET.REMOTE, |
|                   |          | > ASSET.COMMS, ASSET.HMI) for        |
|                   |          | > further analysis and correction.   |
+-------------------+----------+--------------------------------------+
| > **T.DISASTER**  | > System | > A natural disaster (AGENT.NATURE)  |
|                   | > Unavai | > ceases operation of one or more    |
|                   | lability | > components of the ICS              |
|                   | > due to | > (ASSET.ACTUATOR, ASSET.SENSOR,     |
|                   | >        | > ASSET.CONTROLLER, ASSET.HMI,       |
|                   |  Natural | > ASSET.REMOTE, ASSET.COMMS) as a    |
|                   | >        | > consequence of earthquake, fire,   |
|                   | Disaster | > flood or other unpredictable event |
|                   |          | > (ATTACK.NATURE).                   |
+-------------------+----------+--------------------------------------+
| > **T.OUTAGE**    | > System | > A natural disaster, malicious or   |
|                   | > Unavai | > non-malicious individual           |
|                   | lability | > (AGENT.NATURE, AGENT.INSIDER,      |
|                   | > due to | > AGENT.EVIL_INSIDER,                |
|                   | > Power  | > AGENT.PRIOR_INSIDER,               |
|                   | > Outage | > AGENT.OUTSIDER) inadvertently (or  |
|                   |          | > otherwise) causes a power outage   |
|                   |          | > affecting the availability of one  |
|                   |          | > or more components of the ICS      |
|                   |          | > (ASSET.ACTUATOR, ASSET.SENSOR,     |
|                   |          | > ASSET.CONTROLLER, ASSET.HMI,       |
|                   |          | > ASSET.REMOTE, ASSET.COMMS).        |
+-------------------+----------+--------------------------------------+
| > **T.INFECTION** | > Virus  | > An individual (AGENT.INSIDER,      |
|                   | > I      | > AGENT.EVIL_INSIDER,                |
|                   | nfection | > AGENT.PRIOR_INSIDER,               |
|                   |          | > AGENT.OUTSIDER) maliciously or     |
|                   |          | > accidentally introduces a virus to |
|                   |          | > the ICS network (ATTACK.VIRUS)     |
|                   |          | > causing unnecessary system         |
|                   |          | > downtime and corruption of data    |
|                   |          | > (ASSET.ACTUATOR, ASSET.SENSOR,     |
|                   |          | > ASSET.CONTROLLER, ASSET.HMI,       |
|                   |          | > ASSET.REMOTE, ASSET.COMMS,         |
|                   |          | > ASSET.CTRLPROCESS, ASSET.CTRLINFO, |
|                   |          | > ASSET.BUSINFO).                    |
+-------------------+----------+--------------------------------------+
| > **T.            | > Unau   | > An unauthorized individual         |
| PHYSICAL_ACCESS** | thorized | > (AGENT.PRIOR_INSIDER,              |
|                   | >        | > AGENT.OUTSIDER) directs an attack  |
|                   | physical | > (ATTACK.PHYSICAL) to gain physical |
|                   | > access | > access to protected ICS components |
|                   |          | > (ASSET.ACTUATOR, ASSET.SENSOR,     |
|                   |          | > ASSET.CONTROLLER, ASSET.HMI,       |
|                   |          | > ASSET.REMOTE, ASSET.COMMS).        |
+-------------------+----------+--------------------------------------+

### Threats Addressed by the Operating Environment

This SPP has not identified any threats relevant to the operating
environment. Organizational security policy P.ENVIRONMENT assumes that
adequate security controls have been deployed to address the threats
relevant to the STOE operating environment.

## Overarching Organizational Security Policies

This section describes the Overarching Organizational Security Policies
(OOSPs) that define the broader context of the organization which
support and govern the use of a system. These will form part of the
basis for deriving the actual organizational security policies (OSPs) to
be included as part of a specific STOE.

The scope of organizational security policy includes both the
organizational security policies of the organization that has
responsibility for operating the industrial control system as well as
those for any external organizations that the industrial control system
interacts with. Security related organizational policies include the
following:

[]{#__RefHeading___Toc69732173 .anchor}Table 9 -- Organizational
Security Policies

+----------------+-----------------------------------------------------+
| > **Name**     | > **Description**                                   |
+================+=====================================================+
| > **P.EVENT**  | > The organization shall monitor security events to |
|                | > ensure compliance with security policies (e.g.    |
|                | > security incident response plan).                 |
+----------------+-----------------------------------------------------+
| > *            | > The organization shall have in place policies,    |
| *P.PERSONNEL** | > training programs, and reporting and enforcement  |
|                | > mechanisms such that personnel know their         |
|                | > security role in the organization.                |
+----------------+-----------------------------------------------------+
| > **P.IN       | > The organization shall provide an organizational  |
| FRASTRUCTURE** | > structure to establish the implementation of the  |
|                | > security program, in which the policies can be    |
|                | > established, maintained and enforced throughout   |
|                | > the organization.                                 |
+----------------+-----------------------------------------------------+
| > **P.C        | > The organization shall provide management and     |
| ONFIGURATION** | > operational security controls necessary to manage |
|                | > the system's configuration during operations and  |
|                | > evaluate and control changes to ensure that the   |
|                | > system remains secure.                            |
+----------------+-----------------------------------------------------+
| >              | > Adequate physical security shall be provided to   |
| **P.PHYSICAL** | > detect or prevent unauthorized access or          |
|                | > connection to the system and its components.      |
+----------------+-----------------------------------------------------+
| > **P.POLICY** | > The organization and system shall comply with     |
|                | > organizational and regulatory policies and        |
|                | > controls governing the use of, and implemented by |
|                | > the system to ensure secure operations.           |
+----------------+-----------------------------------------------------+
| > **P.ASSETS** | > The organization shall provide documentation of   |
|                | > the system and its components, to understand the  |
|                | > overall security posture.                         |
+----------------+-----------------------------------------------------+
| > **P.SAFETY** | > The organization shall comply with relevant       |
|                | > standards to ensure the safety of the system and  |
|                | > its operators.                                    |
+----------------+-----------------------------------------------------+
| > **P.         | > ICS security controls shall be implemented so as  |
| NO_INTERFERE** | > not to impede the minimum required operational    |
|                | > capabilities of the ICS, and so as to not impede  |
|                | > the safety systems that protect the ICS.          |
+----------------+-----------------------------------------------------+
| >              | > The ICS shall be operated in accordance with a    |
| **P.BUSINESS** | > business continuity policy that addresses the     |
|                | > identification of and response to events that     |
|                | > adversely affect the ability of the ICS to        |
|                | > operate in fulfilling its design goals (e.g.      |
|                | > power outages, acts of nature etc).               |
+----------------+-----------------------------------------------------+
| > **P.RISK**   | > The ICS shall be designed, implemented, and       |
|                | > operated to meet the risk objectives resulting    |
|                | > from a system life-cycle risk management program. |
|                | > The risk management program shall establish a     |
|                | > comprehensive and integrated set of risk          |
|                | > management goals for issues affecting ICS         |
|                | > operation, safety and security.                   |
+----------------+-----------------------------------------------------+
| > **P          | > The STOE operating environment shall have         |
| .ENVIRONMENT** | > adequate security controls to counter those       |
|                | > threats originating from outside of the defined   |
|                | > STOE. The implementation and maintenance of these |
|                | > security controls should be in accordance with    |
|                | > organizational security policies similar to those |
|                | > listed in this table and be selected based on the |
|                | > outcomes of a risk assessment.                    |
+----------------+-----------------------------------------------------+

# Risks

The security risks are a further instantiation of the security problem.
The element of risk is captured by the SPP to determine the relative
importance of the security needs of the STOE and its operating
environment. They guide the specification of the security objectives by
ensuring that only those security needs seen as critical to the
organization are addressed by the STOE or its operating environment.

Each risk is a product of asset value, assessed level of relevant
threats, and associated vulnerabilities (as identified in the previous
section). It represents the potential that a given threat will exploit
vulnerabilities to cause loss or damage to an asset or group of assets,
and hence directly or indirectly to the organization.

Please note that this SPP has not specified the level of risk. Rather,
it is intended that the SST author evaluate and prioritize the level of
each risk according to their own ICS implementation (based on the
combination of the value of each asset to the organization, the impact
and probability rating of each threat successfully exploiting the
identified vulnerabilities, and the effectiveness of existing security
controls). Further guidance on the completion and relevance of this
section can be found in chapter 7.

## Risk Categories applicable to the STOE

The categories of security risks relevant to the STOE are described in
Table 10. The table references the threats, vulnerabilities and assets
identified in the previous chapter.

Editor's Note: At this level of abstraction the SPP has only captured
the categories of risk applicable to the generic ICS described by this
SPP. It is anticipated that future SPPs and SSTs will identify specific
risks relevant to the author's own organizational context, and therefore
expand upon the generic risks presented in this chapter.

[]{#__RefHeading___Toc69732174 .anchor}Table 10 -- Identified Risk
Categories for the STOE

+-------------+-------------+--------------+-----------+-------------+
| > **Risk    | > **Risk    | >            | > *       | >           |
| > Category  | > Category  |  **Threats** | *Vulnerab |  **Assets** |
| > Label**   | > De        |              | ilities** |             |
|             | scription** |              |           |             |
+=============+=============+==============+===========+=============+
| > **RI      | > Risks     | > T.         | > V.P     | > ASSE      |
| SK.MANAGE** | >           | BAD_COMMAND, | LAINTEXT, | T.ACTUATOR, |
|             |  associated | >            | > V.      | > AS        |
|             | > with the  | T.REPUDIATE, | SERVICES, | SET.SENSOR, |
|             | > security  | >            | >         | > ASSET.    |
|             | > roles and | T.PRIVILEGE, | V.REMOTE, | CONTROLLER, |
|             | > respo     | > T.NO_F     | >         | >           |
|             | nsibilities | AULT_RECORD, | V.ARCHITE |  ASSET.HMI, |
|             | >           |              | CTUREV.NO | > AS        |
|             |  applicable |              | POLICIES, | SET.REMOTE, |
|             | > to all    |              | > V.NO    | > A         |
|             | > ICS       |              | TRAINING, | SSET.COMMS, |
|             | > users, as |              | > V       | > ASSET.    |
|             | > well as   |              | .3RDPARTY | CTRLPROCESS |
|             | > risks     |              | >         |             |
|             | >           |              |  V.NORISK |             |
|             |  associated |              |           |             |
|             | > with the  |              |           |             |
|             | >           |              |           |             |
|             |  successful |              |           |             |
|             | > imp       |              |           |             |
|             | lementation |              |           |             |
|             | > of the    |              |           |             |
|             | > org       |              |           |             |
|             | anizational |              |           |             |
|             | > security  |              |           |             |
|             | > policies. |              |           |             |
+-------------+-------------+--------------+-----------+-------------+
| > **RISK.   | > Risks     | > T.         | > V.P     | > ASSE      |
| SECPOLICY** | >           | BAD_COMMAND, | LAINTEXT, | T.ACTUATOR, |
|             |  associated | >            | > V.      | > AS        |
|             | > with the  | T.REPUDIATE, | SERVICES, | SET.SENSOR, |
|             | > d         | >            | >         | > ASSET.    |
|             | evelopment, | T.PRIVILEGE, | V.REMOTE, | CONTROLLER, |
|             | >           | > T.NO_F     | >         | >           |
|             | endorsement | AULT_RECORD, | V.ARCHITE |  ASSET.HMI, |
|             | > and       | >            | CTUREV.NO | > AS        |
|             | >           |  T.INFECTION | POLICIES, | SET.REMOTE, |
|             | maintenance |              | > V.NO    | > A         |
|             | > of the    |              | TRAINING, | SSET.COMMS, |
|             | >           |              | > V       | > ASSET.C   |
|             | instruction |              | .3RDPARTY | TRLPROCESS, |
|             | >           |              | >         | > ASSE      |
|             |  stipulated |              |  V.NORISK | T.CTRLINFO, |
|             | > by the    |              |           | > AS        |
|             | > corporate |              |           | SET.BUSINFO |
|             | > security  |              |           |             |
|             | > policies. |              |           |             |
+-------------+-------------+--------------+-----------+-------------+
| > **RIS     | > Risks     | > T          | > V.P     | > ASSE      |
| K.RISKMAN** | >           | .DISCLOSURE, | LAINTEXT, | T.ACTUATOR, |
|             |  associated | > T.EV       | > V.      | > AS        |
|             | > with the  | IL_ANALYSIS, | SERVICES, | SET.SENSOR, |
|             | >           | > T.EVIL_M   | >         | > ASSET.    |
|             |  management | ODIFICATION, | V.REMOTE, | CONTROLLER, |
|             | > of the    | > T.EVIL_    | > V.ARCH  | >           |
|             | > risk      | DESTRUCTION, | ITECTURE, |  ASSET.HMI, |
|             | >           | > T.         | > V.SPOF, | > AS        |
|             |  assessment | CTRL_TAMPER, | > V.NO    | SET.REMOTE, |
|             | > processes | > T.         | POLICIES, | > A         |
|             | > for the   | BAD_COMMAND, | > V.NO    | SSET.COMMS, |
|             | > ICS.      | > T.SPOOF,   | TRAINING, | > ASSET.C   |
|             |             | >            | > V       | TRLPROCESS, |
|             |             | T.REPUDIATE, | .3RDPARTY | > ASSE      |
|             |             | > T.DOS,     | >         | T.CTRLINFO, |
|             |             | >            |  V.NORISK | > AS        |
|             |             | T.PRIVILEGE, |           | SET.BUSINFO |
|             |             | > T.NO_F     |           |             |
|             |             | AULT_RECORD, |           |             |
|             |             | >            |           |             |
|             |             |  T.DISASTER, |           |             |
|             |             | >            |           |             |
|             |             | T.INFECTION, |           |             |
|             |             | > T.PHY      |           |             |
|             |             | SICAL_ACCESS |           |             |
+-------------+-------------+--------------+-----------+-------------+
| > **RI      | > Risks     | > TBD        | >         | > ASSE      |
| SK.COMPLY** | >           |              | V.ARCHITE | T.ACTUATOR, |
|             |  associated |              | CTUREV.NO | > AS        |
|             | > with not  |              | POLICIES, | SET.SENSOR, |
|             | > meeting   |              | > V.NO    | > ASSET.    |
|             | > internal  |              | TRAINING, | CONTROLLER, |
|             | > and       |              | > V       | >           |
|             | > statutory |              | .3RDPARTY |  ASSET.HMI, |
|             | > re        |              | >         | > AS        |
|             | quirements. |              |  V.NORISK | SET.REMOTE, |
|             |             |              |           | > A         |
|             |             |              |           | SSET.COMMS, |
|             |             |              |           | > ASSET.C   |
|             |             |              |           | TRLPROCESS, |
|             |             |              |           | > ASSE      |
|             |             |              |           | T.CTRLINFO, |
|             |             |              |           | > AS        |
|             |             |              |           | SET.BUSINFO |
+-------------+-------------+--------------+-----------+-------------+
| > **RISK.   | > Risks     | >            | > V.P     | > ASSE      |
| ASSETCTRL** | >           | T.REPUDIATE, | LAINTEXT, | T.ACTUATOR, |
|             |  associated | >            | > V.      | > AS        |
|             | > with      | T.PRIVILEGE, | SERVICES, | SET.SENSOR, |
|             | > asset     | >            | >         | > ASSET.    |
|             | > clas      | T.INFECTION, | V.REMOTE, | CONTROLLER, |
|             | sification, | > T.PHY      | > V.ARC   | >           |
|             | >           | SICAL_ACCESS | HITECTURE |  ASSET.HMI, |
|             |  labelling, |              | > V.NO    | > AS        |
|             | > media     |              | POLICIES, | SET.REMOTE, |
|             | >           |              | > V.NO    | > A         |
|             |  management |              | TRAINING, | SSET.COMMS, |
|             | > and       |              | > V       | > ASSET.C   |
|             | > acco      |              | .3RDPARTY | TRLPROCESS, |
|             | untability. |              | >         | > ASSE      |
|             |             |              |  V.NORISK | T.CTRLINFO, |
|             |             |              |           | > AS        |
|             |             |              |           | SET.BUSINFO |
+-------------+-------------+--------------+-----------+-------------+
| > **RISK.   | > Risks     | > T.         | > V.P     | > ASSE      |
| PERSONNEL** | >           | BAD_COMMAND, | LAINTEXT, | T.ACTUATOR, |
|             |  associated | > T.SPOOF,   | > V.      | > AS        |
|             | > with      | >            | SERVICES, | SET.SENSOR, |
|             | > personnel | T.REPUDIATE, | >         | > ASSET.    |
|             | > vetting,  | >            | V.REMOTE, | CONTROLLER, |
|             | > security  | T.PRIVILEGE, | > V.ARCH  | >           |
|             | >           | > T.NO_F     | ITECTURE, |  ASSET.HMI, |
|             |  awareness, | AULT_RECORD, | > V.SPOF, | > AS        |
|             | > training, | >            | > V.NO    | SET.REMOTE, |
|             | >           |  T.DISASTER, | POLICIES, | > A         |
|             |  separation | >            | > V.NO    | SSET.COMMS, |
|             | > of duties | T.INFECTION, | TRAINING, | > ASSET.C   |
|             | > and       | > T.PHY      | > V       | TRLPROCESS, |
|             | > system    | SICAL_ACCESS | .3RDPARTY | > ASSE      |
|             | > usage     |              | >         | T.CTRLINFO, |
|             | >           |              |  V.NORISK | > AS        |
|             | agreements. |              |           | SET.BUSINFO |
+-------------+-------------+--------------+-----------+-------------+
| > **RISK    | > Risks     | > T.PHY      | >         | > ASSE      |
| .PHYSICAL** | >           | SICAL_ACCESS | V.ARCHITE | T.ACTUATOR, |
|             |  associated |              | CTUREV.NO | > AS        |
|             | > with      |              | POLICIES, | SET.SENSOR, |
|             | > u         |              | > V.NO    | > ASSET.    |
|             | nauthorized |              | TRAINING, | CONTROLLER, |
|             | > physical  |              | >         | >           |
|             | > access    |              |  V.NORISK |  ASSET.HMI, |
|             | > and/or    |              |           | > AS        |
|             | > damage to |              |           | SET.REMOTE, |
|             | > system    |              |           | >           |
|             | >           |              |           | ASSET.COMMS |
|             | components. |              |           |             |
+-------------+-------------+--------------+-----------+-------------+
| > **RIS     | > Risks     | > T.DISASTER | > V.A     | > ASSE      |
| K.ENVIRON** | >           |              | RCHITECTU | T.ACTUATOR, |
|             |  associated |              | REV.SPOF, | > AS        |
|             | > with the  |              | > V.NO    | SET.SENSOR, |
|             | > effects   |              | POLICIES, | > ASSET.    |
|             | > of        |              | > V.NO    | CONTROLLER, |
|             | > natural   |              | TRAINING, | >           |
|             | >           |              | >         |  ASSET.HMI, |
|             |  disasters, |              |  V.NORISK | > AS        |
|             | > such as   |              |           | SET.REMOTE, |
|             | > fire,     |              |           | > A         |
|             | > flood and |              |           | SSET.COMMS, |
|             | >           |              |           | > ASSET.C   |
|             | earthquake. |              |           | TRLPROCESS, |
|             |             |              |           | > ASSE      |
|             |             |              |           | T.CTRLINFO, |
|             |             |              |           | > AS        |
|             |             |              |           | SET.BUSINFO |
+-------------+-------------+--------------+-----------+-------------+
| > **RISK.EV | > Risks     | > T          | > V.P     | > ASSE      |
| IL_ACCESS** | >           | .DISCLOSURE, | LAINTEXT, | T.ACTUATOR, |
|             |  associated | > T.EV       | > V.      | > AS        |
|             | > with the  | IL_ANALYSIS, | SERVICES, | SET.SENSOR, |
|             | > illicit   | > T.EVIL_M   | >         | > ASSET.    |
|             | > use,      | ODIFICATION, | V.REMOTE, | CONTROLLER, |
|             | > m         | > T.EVIL_    | > V.ARCH  | >           |
|             | odification | DESTRUCTION, | ITECTURE, |  ASSET.HMI, |
|             | > and       | > T.         | > V.SPOF, | > AS        |
|             | >           | CTRL_TAMPER, | > V.NO    | SET.REMOTE, |
|             | destruction | > T.         | POLICIES, | > A         |
|             | > of        | BAD_COMMAND, | > V.NO    | SSET.COMMS, |
|             | > company   | > T.SPOOF,   | TRAINING, | > ASSET.C   |
|             | > data or   | >            | > V       | TRLPROCESS, |
|             | > in        | T.REPUDIATE, | .3RDPARTY | > ASSE      |
|             | appropriate | > T.DOS,     | >         | T.CTRLINFO, |
|             | > access to | >            |  V.NORISK | > AS        |
|             | > i         | T.PRIVILEGE, |           | SET.BUSINFO |
|             | nformation. | > T.NO_      |           |             |
|             | >           | FAULT_RECORD |           |             |
|             | > Risks     |              |           |             |
|             | >           |              |           |             |
|             |  associated |              |           |             |
|             | > with the  |              |           |             |
|             | > inability |              |           |             |
|             | > to make   |              |           |             |
|             | >           |              |           |             |
|             | individuals |              |           |             |
|             | >           |              |           |             |
|             | accountable |              |           |             |
|             | > for the   |              |           |             |
|             | > actions   |              |           |             |
|             | > they take |              |           |             |
|             | > when      |              |           |             |
|             | > using the |              |           |             |
|             | > systems.  |              |           |             |
+-------------+-------------+--------------+-----------+-------------+
| > **RISK.   | > Risks     | > T          | > V.P     | > AS        |
| NEED2KNOW** | >           | .DISCLOSURE, | LAINTEXT, | SET.REMOTE, |
|             |  associated | > T.EV       | > V.      | > A         |
|             | > with the  | IL_ANALYSIS, | SERVICES, | SSET.COMMS, |
|             | > threat to | > T.SPOOF,   | >         | > ASSET.C   |
|             | >           | >            | V.REMOTE, | TRLPROCESS, |
|             | information |  T.PRIVILEGE | >         | > ASSE      |
|             | > conf      |              | V.ARCHITE | T.CTRLINFO, |
|             | identiality |              | CTUREV.NO | > AS        |
|             | > and       |              | POLICIES, | SET.BUSINFO |
|             | > privacy,  |              | > V.NO    |             |
|             | > u         |              | TRAINING, |             |
|             | nauthorised |              | > V       |             |
|             | >           |              | .3RDPARTY |             |
|             |  disclosure |              | >         |             |
|             | > and clear |              |  V.NORISK |             |
|             | > desk      |              |           |             |
|             | >           |              |           |             |
|             |  practices. |              |           |             |
+-------------+-------------+--------------+-----------+-------------+
| > **RISK.   | > Risks     | > TBD        | > V.      | > ASSE      |
| INTEGRATE** | >           |              | SERVICES, | T.ACTUATOR, |
|             |  associated |              | >         | > AS        |
|             | > with the  |              | V.REMOTE, | SET.SENSOR, |
|             | >           |              | > V.ARCH  | > ASSET.    |
|             | integration |              | ITECTURE, | CONTROLLER, |
|             | > of        |              | > V.SPOF, | >           |
|             | > security  |              | > V.NO    |  ASSET.HMI, |
|             | > r         |              | POLICIES, | > AS        |
|             | equirements |              | > V.NO    | SET.REMOTE, |
|             | > into the  |              | TRAINING, | > A         |
|             | > systems   |              | > V       | SSET.COMMS, |
|             | >           |              | .3RDPARTY | > ASSET.C   |
|             | development |              | >         | TRLPROCESS, |
|             | > cycle and |              |  V.NORISK | > ASSE      |
|             | > the       |              |           | T.CTRLINFO, |
|             | > selection |              |           | > AS        |
|             | > of third  |              |           | SET.BUSINFO |
|             | > party     |              |           |             |
|             | > products. |              |           |             |
+-------------+-------------+--------------+-----------+-------------+
| > **RISK    | > Risks     | > T          | > V.P     | > ASSE      |
| .NETCOMMS** | >           | .DISCLOSURE, | LAINTEXT, | T.ACTUATOR, |
|             |  associated | > T.EV       | > V.      | > AS        |
|             | > with the  | IL_ANALYSIS, | SERVICES, | SET.SENSOR, |
|             | >           | > T.         | >         | > ASSET.    |
|             |  protection | CTRL_TAMPER, | V.REMOTE, | CONTROLLER, |
|             | > of        | > T.SPOOF,   | > V.ARCH  | >           |
|             | > network   | > T.DOS,     | ITECTURE, |  ASSET.HMI, |
|             | > com       | > T.NO_F     | > V.SPOF, | > AS        |
|             | munications | AULT_RECORD, | > V.NO    | SET.REMOTE, |
|             | > at the    | >            | POLICIES, | > A         |
|             | > logical   | T.INFECTION, | > V.NO    | SSET.COMMS, |
|             | > and       | > T.PHY      | TRAINING, | > ASSET.C   |
|             | > physical  | SICAL_ACCESS | > V       | TRLPROCESS, |
|             | > layers.   |              | .3RDPARTY | > ASSE      |
|             |             |              | >         | T.CTRLINFO, |
|             |             |              |  V.NORISK | > AS        |
|             |             |              |           | SET.BUSINFO |
+-------------+-------------+--------------+-----------+-------------+
| > **RIS     | > Risks     | > T          | > V.P     | > ASSE      |
| K.CONNECT** | >           | .DISCLOSURE, | LAINTEXT, | T.ACTUATOR, |
|             |  associated | > T.EV       | > V.      | > AS        |
|             | > with      | IL_ANALYSIS, | SERVICES, | SET.SENSOR, |
|             | >           | > T.EVIL_M   | >         | > ASSET.    |
|             | connections | ODIFICATION, | V.REMOTE, | CONTROLLER, |
|             | > to other  | > T.EVIL_    | > V.ARCH  | >           |
|             | > IT        | DESTRUCTION, | ITECTURE, |  ASSET.HMI, |
|             | > systems.  | > T.         | > V.SPOF, | > AS        |
|             |             | CTRL_TAMPER, | > V.NO    | SET.REMOTE, |
|             |             | > T.SPOOF,   | POLICIES, | > A         |
|             |             | > T.DOS,     | > V.NO    | SSET.COMMS, |
|             |             | >            | TRAINING, | > ASSET.C   |
|             |             | T.PRIVILEGE, | > V       | TRLPROCESS, |
|             |             | > T.NO_F     | .3RDPARTY | > ASSE      |
|             |             | AULT_RECORD, | >         | T.CTRLINFO, |
|             |             | >            |  V.NORISK | > AS        |
|             |             |  T.INFECTION |           | SET.BUSINFO |
+-------------+-------------+--------------+-----------+-------------+
| > **RISK    | > Risks     | > T          | > V.P     | > ASSE      |
| .INTERNET** | >           | .DISCLOSURE, | LAINTEXT, | T.ACTUATOR, |
|             |  associated | > T.EV       | > V.      | > AS        |
|             | > with the  | IL_ANALYSIS, | SERVICES, | SET.SENSOR, |
|             | > use of    | > T.EVIL_M   | >         | > ASSET.    |
|             | > the       | ODIFICATION, | V.REMOTE, | CONTROLLER, |
|             | > Internet  | > T.EVIL_    | > V.ARCH  | >           |
|             | > and email | DESTRUCTION, | ITECTURE, |  ASSET.HMI, |
|             | > services  | > T.         | > V.SPOF, | > AS        |
|             | > both      | CTRL_TAMPER, | > V.NO    | SET.REMOTE, |
|             | > internal  | > T.SPOOF,   | POLICIES, | > A         |
|             | > and       | > T.DOS,     | > V.NO    | SSET.COMMS, |
|             | > external  | >            | TRAINING, | > ASSET.C   |
|             | > to the    | T.PRIVILEGE, | > V       | TRLPROCESS, |
|             | > ICS.      | >            | .3RDPARTY | > ASSE      |
|             |             |  T.INFECTION | >         | T.CTRLINFO, |
|             |             |              |  V.NORISK | > AS        |
|             |             |              |           | SET.BUSINFO |
+-------------+-------------+--------------+-----------+-------------+
| > **RI      | > Risks     | > T          | > V.P     | > ASSE      |
| SK.REMOTE** | >           | .DISCLOSURE, | LAINTEXT, | T.ACTUATOR, |
|             |  associated | > T.EV       | > V.      | > AS        |
|             | > with the  | IL_ANALYSIS, | SERVICES, | SET.SENSOR, |
|             | >           | > T.EVIL_M   | >         | > ASSET.    |
|             |  connection | ODIFICATION, | V.REMOTE, | CONTROLLER, |
|             | > of remote | > T.EVIL_    | > V.ARCH  | >           |
|             | > users to  | DESTRUCTION, | ITECTURE, |  ASSET.HMI, |
|             | > the ICS   | > T.         | > V.SPOF, | > AS        |
|             | > network.  | CTRL_TAMPER, | > V.NO    | SET.REMOTE, |
|             |             | > T.SPOOF,   | POLICIES, | > A         |
|             |             | > T.DOS,     | > V.NO    | SSET.COMMS, |
|             |             | >            | TRAINING, | > ASSET.C   |
|             |             | T.PRIVILEGE, | > V       | TRLPROCESS, |
|             |             | >            | .3RDPARTY | > ASSE      |
|             |             |  T.INFECTION | >         | T.CTRLINFO, |
|             |             |              |  V.NORISK | > AS        |
|             |             |              |           | SET.BUSINFO |
+-------------+-------------+--------------+-----------+-------------+
| > **RI      | > Risks     | > T          | > V.P     | > ASSE      |
| SK.ONLINE** | >           | .DISCLOSURE, | LAINTEXT, | T.ACTUATOR, |
|             |  associated | > T.DOS,     | > V.      | > AS        |
|             | > with the  | > T.NO_F     | SERVICES, | SET.SENSOR, |
|             | > delivery  | AULT_RECORD, | >         | > ASSET.    |
|             | > of online | >            | V.REMOTE, | CONTROLLER, |
|             | > services, |  T.INFECTION | > V.ARCH  | >           |
|             | > including |              | ITECTURE, |  ASSET.HMI, |
|             | > statutory |              | > V.SPOF, | > AS        |
|             | > re        |              | > V.NO    | SET.REMOTE, |
|             | quirements, |              | POLICIES, | > A         |
|             | > security  |              | > V.NO    | SSET.COMMS, |
|             | > issues    |              | TRAINING, | > ASSET.C   |
|             | > and       |              | > V       | TRLPROCESS, |
|             | > controls, |              | .3RDPARTY | > ASSE      |
|             | >           |              | >         | T.CTRLINFO, |
|             |  publishing |              |  V.NORISK | > AS        |
|             | > and       |              |           | SET.BUSINFO |
|             | >           |              |           |             |
|             | third-party |              |           |             |
|             | > security. |              |           |             |
+-------------+-------------+--------------+-----------+-------------+
| > **RISK.   | > Risks     | > T          | > V.P     | > ASSE      |
| OPSMANAGE** | >           | .DISCLOSURE, | LAINTEXT, | T.ACTUATOR, |
|             |  associated | > T.EV       | > V.      | > AS        |
|             | > with      | IL_ANALYSIS, | SERVICES, | SET.SENSOR, |
|             | > managing  | > T.EVIL_M   | >         | > ASSET.    |
|             | > system    | ODIFICATION, | V.REMOTE, | CONTROLLER, |
|             | > changes,  | > T.EVIL_    | > V.ARCH  | >           |
|             | > such as   | DESTRUCTION, | ITECTURE, |  ASSET.HMI, |
|             | > changes   | > T.         | > V.SPOF, | > AS        |
|             | > not       | CTRL_TAMPER, | > V.NO    | SET.REMOTE, |
|             | > approved  | > T.         | POLICIES, | > A         |
|             | > or        | BAD_COMMAND, | > V.NO    | SSET.COMMS, |
|             | > audited   | > T.SPOOF,   | TRAINING, | > ASSET.C   |
|             | >           | >            | > V       | TRLPROCESS, |
|             |  correctly, | T.REPUDIATE, | .3RDPARTY | > ASSE      |
|             | > lack of   | > T.DOS,     | >         | T.CTRLINFO, |
|             | > c         | >            |  V.NORISK | > AS        |
|             | onsultation | T.PRIVILEGE, |           | SET.BUSINFO |
|             | > with      | > T.NO_F     |           |             |
|             | > relevant  | AULT_RECORD, |           |             |
|             | > parties,  | >            |           |             |
|             | > loss of   |  T.DISASTER, |           |             |
|             | > skilled   | >            |           |             |
|             | > people,   | T.INFECTION, |           |             |
|             | > and lack  | > T.PHY      |           |             |
|             | > of        | SICAL_ACCESS |           |             |
|             | > correct   |              |           |             |
|             | > doc       |              |           |             |
|             | umentation. |              |           |             |
|             | >           |              |           |             |
|             | > Risks     |              |           |             |
|             | >           |              |           |             |
|             |  associated |              |           |             |
|             | > with the  |              |           |             |
|             | > use of    |              |           |             |
|             | >           |              |           |             |
|             |  technology |              |           |             |
|             | > for data  |              |           |             |
|             | > and       |              |           |             |
|             | > system    |              |           |             |
|             | > control,  |              |           |             |
|             | > including |              |           |             |
|             | > data      |              |           |             |
|             | >           |              |           |             |
|             | protection, |              |           |             |
|             | > backup,   |              |           |             |
|             | > disaster  |              |           |             |
|             | > recovery, |              |           |             |
|             | >           |              |           |             |
|             |  inadequate |              |           |             |
|             | > security, |              |           |             |
|             | > and       |              |           |             |
|             | > i         |              |           |             |
|             | nsufficient |              |           |             |
|             | > capacity, |              |           |             |
|             | > etc.      |              |           |             |
+-------------+-------------+--------------+-----------+-------------+
| > *         | > Risks     | > T.         | > V.      | > ASSE      |
| *RISK.IDS** | >           | BAD_COMMAND, | SERVICES, | T.ACTUATOR, |
|             |  associated | >            | > V.NO    | > AS        |
|             | > with      | T.REPUDIATE, | POLICIES, | SET.SENSOR, |
|             | > security  | > T.NO_F     | > V.NO    | > ASSET.    |
|             | > auditing, | AULT_RECORD, | TRAINING, | CONTROLLER, |
|             | > security  |              | >         | >           |
|             | > breach    |              |  V.NORISK |  ASSET.HMI, |
|             | > detection |              |           | > AS        |
|             | > and       |              |           | SET.REMOTE, |
|             | > response, |              |           | > A         |
|             | > incident  |              |           | SSET.COMMS, |
|             | > reporting |              |           | > ASSET.    |
|             | > and       |              |           | CTRLPROCESS |
|             | > forensic  |              |           |             |
|             | > evidence  |              |           |             |
|             | > re        |              |           |             |
|             | quirements. |              |           |             |
+-------------+-------------+--------------+-----------+-------------+
| > **RISK.C  | > Risks     | > T.EVIL_    | > V.P     | > ASSE      |
| ONTINUITY** | >           | DESTRUCTION, | LAINTEXT, | T.ACTUATOR, |
|             |  associated | > T.         | > V.      | > AS        |
|             | > with      | CTRL_TAMPER, | SERVICES, | SET.SENSOR, |
|             | > ensuring  | > T.         | >         | > ASSET.    |
|             | > the       | BAD_COMMAND, | V.REMOTE, | CONTROLLER, |
|             | > un        | > T.DOS,     | > V.ARCH  | >           |
|             | interrupted | >            | ITECTURE, |  ASSET.HMI, |
|             | > a         |  T.DISASTER, | > V.SPOF, | > AS        |
|             | vailability | >            | > V.NO    | SET.REMOTE, |
|             | > of all    | T.INFECTION, | POLICIES, | > A         |
|             | > key       | > T.PHY      | > V.NO    | SSET.COMMS, |
|             | > business  | SICAL_ACCESS | TRAINING, | > ASSET.C   |
|             | > resources |              | > V       | TRLPROCESS, |
|             | > required  |              | .3RDPARTY | > ASSE      |
|             | > to        |              | >         | T.CTRLINFO, |
|             | > support   |              |  V.NORISK | > AS        |
|             | > essential |              |           | SET.BUSINFO |
|             | > (or       |              |           |             |
|             | > critical) |              |           |             |
|             | > business  |              |           |             |
|             | >           |              |           |             |
|             | activities. |              |           |             |
+-------------+-------------+--------------+-----------+-------------+

## Risks to the External Operating Environment

This SPP has not identified any risks relevant to the external operating
environment. Organizational security policy P.ENVIRONMENT assumes that
adequate security controls have been deployed to mitigate the risks to
the STOE external operating environment.

# Security Objectives

The security objectives are a concise statement of the intended response
to the security problem. These objectives indicate, at a high level, how
the security problem, as characterized in the \"Security Environment\"
section of the SPP, is to be addressed. Just as some threats are to be
addressed by the STOE and others by its intended environment, some
security objectives are for the STOE and others are for its environment.
These two classes of security objectives are discussed separately.

## Security Objectives for the STOE

The security objectives for the STOE are as described in the following
table.

[]{#__RefHeading___Toc69732175 .anchor}Table 11 -- Security Objectives
for the STOE

+------------------------+---------------------------------------------+
| > **Objective Label**  | > **Objective Description**                 |
+========================+=============================================+
| > **O.PHYSICAL**       | > The STOE must provide protection at the   |
|                        | > physical boundaries of the ICS to prevent |
|                        | > access to the protected assets by         |
|                        | > unauthorized users.                       |
+------------------------+---------------------------------------------+
| > **O.Risk**           | > ICS risk assessment shall be conducted    |
|                        | > throughout the life-cycle of an ICS, such |
|                        | > that a documented and approved risk       |
|                        | > assessment process is conducted           |
|                        | > initially, and reviewed with each change  |
|                        | > to the manufacturing process or change to |
|                        | > the ICS; and to ensure that changing      |
|                        | > vulnerabilities do not degrade the        |
|                        | > security of the ICS.                      |
+------------------------+---------------------------------------------+
| >                      | > The ICS security functions shall be       |
| **O.Non_Interference** | > implemented in a non-interfering manner   |
|                        | > such behavior of the ICS functions and    |
|                        | > safety functions are able to meet their   |
|                        | > performance constraints.                  |
+------------------------+---------------------------------------------+
| > *                    | > ICS security functions shall include the  |
| *O.INTERCONNECTIVITY** | > capability to secure interfaces and       |
|                        | > interconnectivity of ICS related safety   |
|                        | > systems, as required.                     |
+------------------------+---------------------------------------------+
| > **O.Data_Backup**    | > The STOE must include provisions for ICS  |
|                        | > data and control information (including   |
|                        | > executable software and control data) to  |
|                        | > assure the ability for timely recovery to |
|                        | > an operating state if the ICS is          |
|                        | > compromised or damaged. The data backup   |
|                        | > procedures should follow industry best    |
|                        | > practices including (but not limited to)  |
|                        | > secondary storage locations, testing of   |
|                        | > recovery procedures, and a back up        |
|                        | > interval either driven by configuration   |
|                        | > changes or a specified time interval or a |
|                        | > combination of both.                      |
+------------------------+---------------------------------------------+
| > **O                  | > The STOE shall authenticate configuration |
| .Data_Authentication** | > change commands such that configuration   |
|                        | > (control algorithms, set points, limit    |
|                        | > points, etc.) cannot be changed unless    |
|                        | > the origin of the command can be          |
|                        | > positively established.                   |
|                        | >                                           |
|                        | > The STOE shall authenticate financial or  |
|                        | > other business critical information sent  |
|                        | > from the STOE to external systems.        |
+------------------------+---------------------------------------------+
|                        |                                             |
+------------------------+---------------------------------------------+
| > **O.Continuity**     | > The ICS shall ensure continuity of        |
|                        | > operations in accordance with a business  |
|                        | > continuity policy that addresses a known  |
|                        | > set of anticipated events that might      |
|                        | > adversely affect the operational          |
|                        | > capability of the ICS.                    |
+------------------------+---------------------------------------------+
| > **O.MANAGEMENT**     | > A policy for governing security shall be  |
|                        | > defined to establish the following:       |
|                        |                                             |
|                        | -   An organization-wide, security          |
|                        |     management infrastructure               |
|                        |                                             |
|                        | -   Identified roles and responsibilities,  |
|                        |     together with explicit authority to     |
|                        |     ensure operational security within the  |
|                        |     management infrastructure               |
+------------------------+---------------------------------------------+
| > **O.Migration**      | The ICS shall have a migration strategy     |
|                        | providing the capability to govern the      |
|                        | evolution of the control system throughout  |
|                        | its security operational life cycle. The    |
|                        | migration strategy shall address at a       |
|                        | minimum:                                    |
|                        |                                             |
|                        | Assessment of new vulnerabilities and       |
|                        | appropriate/necessary mitigating actions to |
|                        | control/reduce new vulnerabilities. This    |
|                        | may include maintenance of the current      |
|                        | system state (components, configuration,    |
|                        | patches, etc).                              |
|                        |                                             |
|                        | The integration between computer            |
|                        | implemented and personnel implemented       |
|                        | procedures.                                 |
+------------------------+---------------------------------------------+
| > **O.Compliance**     | > The ICS shall be operated in compliance   |
|                        | > with relevant governing mandates.         |
+------------------------+---------------------------------------------+
| > **O.3rdparty**       | > Policies governing the roles,             |
|                        | > responsibilities and activities           |
|                        | > authorized for individuals not employed   |
|                        | > by the control system operating           |
|                        | > organization shall be developed.          |
+------------------------+---------------------------------------------+
| > **O.REMOTE**         | > The policies shall establish methods for  |
|                        | > on-site internal, on-site remote, and     |
|                        | > off-site remote access to control system  |
|                        | > resources.                                |
+------------------------+---------------------------------------------+
| > **O.Access_Control** | > The ICS shall provide the capability to   |
|                        | > grant or deny access to control system    |
|                        | > resources based upon the action being     |
|                        | > performed, and the authorizations         |
|                        | > associated with authorized subjects.      |
|                        | >                                           |
|                        | > The ICS shall deny unauthorized agents    |
|                        | > access to every control system resource.  |
|                        | >                                           |
|                        | > The ICS shall require that each agent     |
|                        | > authorized to use the control system is   |
|                        | > identified and is provided with           |
|                        | > credentials to authenticate their         |
|                        | > identity.                                 |
|                        | >                                           |
|                        | > The ICS must be able to include knowledge |
|                        | > of the control system state and/or the    |
|                        | > controlled process state when making an   |
|                        | > access control decision.                  |
|                        | >                                           |
|                        | > The ICS shall include knowledge of time   |
|                        | > and location in the rules for making an   |
|                        | > access control decision.                  |
+------------------------+---------------------------------------------+
| **O.SECURE_COMMS**     | The ICS shall provide the capability to     |
|                        | prevent or detect, as required, the loss of |
|                        | integrity of the ICS operational            |
|                        | communications capability.                  |
|                        |                                             |
|                        | The ICS shall provide the capability to     |
|                        | allow information flows only between those  |
|                        | endpoints authorized by the system.         |
+------------------------+---------------------------------------------+
| **O.DATA_INTEGRITY**   | The ICS shall provide the capability to     |
|                        | protect information flows from replay,      |
|                        | substitution or modification.               |
|                        |                                             |
|                        | The ICS shall provide the capability to     |
|                        | allow the recipient of an authorized        |
|                        | information flow to verify the correctness  |
|                        | of the received information.                |
+------------------------+---------------------------------------------+
| **O.CONFIDENTIALITY**  | The ICS shall protect the confidentiality   |
|                        | of information determined by the respective |
|                        | owners as requiring protection, including,  |
|                        | but not limited to, information related to  |
|                        | business, financial and control data.       |
+------------------------+---------------------------------------------+
| **O.AVAILABILITY**     | The ICS shall have continuity of            |
|                        | availability for operational capability.    |
|                        |                                             |
|                        | The ICS shall be capable of continuing      |
|                        | operation if a control server is            |
|                        | unavailable for any reason.                 |
|                        |                                             |
|                        | The ICS shall be capable of continuing      |
|                        | operation if the primary communications     |
|                        | channel is unavailable for any reason.      |
+------------------------+---------------------------------------------+
| **O.SYSTEM_INTEGRITY** | The ICS shall provide the capability to     |
|                        | prevent or detect, as required, the loss of |
|                        | integrity of the ICS operational system     |
|                        | configuration and capability.               |
|                        |                                             |
|                        | The ICS shall provide the capability to     |
|                        | restrict access to the functions used to    |
|                        | establish and maintain the secure           |
|                        | operational configuration of the ICS.       |
+------------------------+---------------------------------------------+
| **                     | The ICS shall be capable of performing      |
| O.SYSTEM_DIAGNOSTICS** | self-tests to verify the configuration and  |
|                        | integrity of the security functions of the  |
|                        | ICS.                                        |
|                        |                                             |
|                        | The ICS shall provide the capability for    |
|                        | self-test to be executed on start-up, at    |
|                        | periodic intervals, and on demand.          |
+------------------------+---------------------------------------------+
| **O.MONITORING**       | The ICS shall be capable of detecting       |
|                        | unauthorized activity, unusual activity and |
|                        | attempts to defeat the security             |
|                        | capabilities of the ICS.                    |
+------------------------+---------------------------------------------+
| > **O.AUDIT**          | > The ICS shall provide the capability to   |
|                        | > record and maintain event traces that     |
|                        | > reflect the successful and unsuccessful   |
|                        | > security relevant activities involving    |
|                        | > ICS resources.                            |
+------------------------+---------------------------------------------+
| > **O.IDS**            | The ICS shall be capable of detecting       |
|                        | unauthorized activity, unusual activity and |
|                        | attempts to defeat the security             |
|                        | capabilities of the ICS.                    |
|                        |                                             |
|                        | > The control system shall be capable of    |
|                        | > initiating action in response to the      |
|                        | > detection of a potential violation of the |
|                        | > ICS security policy.                      |
+------------------------+---------------------------------------------+

## Security Objectives for the External Operating Environment

This SPP has not identified any security objectives relevant to the
external operating environment. Organizational security policy
P.ENVIRONMENT assumes that adequate security controls have been deployed
to address the security needs outside the scope of the STOE.

# IT Security Requirements

## STOE Security Functional Requirements

This section contains the functional requirements for the STOE. This
includes system security functional requirements and system security
assurance requirements. The requirements are primarily stated as logical
requirements and cover information technology related requirements,
requirements for system security policies and system security related
operating procedures, and integration requirements addressing interfaces
and interoperability between security system components. The functional
requirements are listed in summary form in the table below.

Editor's Note: Table 12 and the text below it outline extensions to the
functional requirements that is building on ISO system work in concert
with NIST work building on security controls.

[]{#__RefHeading___Toc69732176 .anchor}Table 12 -- STOE Security
Functional Requirements

+--------+------------------+------------------------------------------+
| >      |                  |                                          |
|  **No. |                  |                                          |
| > Com  |                  |                                          |
| ponent |                  |                                          |
| > Com  |                  |                                          |
| ponent |                  |                                          |
| >      |                  |                                          |
| Name** |                  |                                          |
+========+==================+==========================================+
| > *    |                  |                                          |
| *Class |                  |                                          |
| > FAU: |                  |                                          |
| > A    |                  |                                          |
| udit** |                  |                                          |
+--------+------------------+------------------------------------------+
| > 1    | > FAU_ARP.1      | > Security alarms                        |
+--------+------------------+------------------------------------------+
| > 2    | > FAU_GEN.1      | > Audit data generation                  |
+--------+------------------+------------------------------------------+
| > 3    | > FAU_GEN.2      | > User identity association              |
+--------+------------------+------------------------------------------+
| > 4    | > FAU_SAA.1      | > Potential violation analysis           |
+--------+------------------+------------------------------------------+
| > 5    | > FAU_SAA.2      | > Profile based anomaly detection        |
+--------+------------------+------------------------------------------+
| > 6    | > FAU_SAA.3      | > Simple attack heuristics               |
+--------+------------------+------------------------------------------+
| > 7    | > FAU_SAA.4      | > Complex attack heuristics              |
+--------+------------------+------------------------------------------+
| > 8    | > FAU_SAR.1      | > Audit review                           |
+--------+------------------+------------------------------------------+
| > 9    | > FAU_SAR.2      | > Restricted audit review                |
+--------+------------------+------------------------------------------+
| > 10   | > FAU_SAR.3      | > Selectable audit review                |
+--------+------------------+------------------------------------------+
| > 11   | > FAU_STG.1      | > Protected audit trail storage          |
+--------+------------------+------------------------------------------+
| > 12   | > FAU_STG.2      | > Guarantees of audit data availability  |
+--------+------------------+------------------------------------------+
| > 13   | > FAU_STG.3      | > Action in case of possible audit data  |
|        |                  | > loss                                   |
+--------+------------------+------------------------------------------+
| > 14   | > FAU_STG.4      | > Prevention of audit data loss          |
+--------+------------------+------------------------------------------+
| > 15   | > FAU_SEL.1      | > Selective audit                        |
+--------+------------------+------------------------------------------+
| > *    |                  |                                          |
| *Class |                  |                                          |
| > FCS: |                  |                                          |
| > C    |                  |                                          |
| ryptog |                  |                                          |
| raphic |                  |                                          |
| > sup  |                  |                                          |
| port** |                  |                                          |
+--------+------------------+------------------------------------------+
| > 16   | > FCS_CKM.4      | > Cryptographic key management           |
+--------+------------------+------------------------------------------+
| > 17   | > FCS_COP.1      | > Cryptographic operation                |
+--------+------------------+------------------------------------------+
| > *    |                  |                                          |
| *Class |                  |                                          |
| > FDP: |                  |                                          |
| > User |                  |                                          |
| > data |                  |                                          |
| >      |                  |                                          |
| protec |                  |                                          |
| tion** |                  |                                          |
+--------+------------------+------------------------------------------+
| > 18   | > FDP_ACC.1      | > Subset access control                  |
+--------+------------------+------------------------------------------+
| > 19   | > FDP_ACC.2      | > Complete access control                |
+--------+------------------+------------------------------------------+
| > 20   | > FDP_ACF.1      | > Security attribute based access        |
|        |                  | > control                                |
+--------+------------------+------------------------------------------+
| > 21   | > FDP_DAU.2      | > Data authentication                    |
+--------+------------------+------------------------------------------+
| > 22   | > FDP_IFC.1      | > Subset information flow control        |
+--------+------------------+------------------------------------------+
| > 23   | > FDP_IFC.2      | > Complete information flow control      |
+--------+------------------+------------------------------------------+
| > 24   | > FDP_IFF.1      | > Simple security attributes             |
+--------+------------------+------------------------------------------+
| > 25   | > FDP_UCT.1      | > Basic data exchange confidentiality    |
+--------+------------------+------------------------------------------+
| > 26   | > FDP_UIT.1      | > Data exchange integrity                |
+--------+------------------+------------------------------------------+
| > 27   | > FDP_UIT.2      | > Source data exchange recovery          |
+--------+------------------+------------------------------------------+
| > *    |                  |                                          |
| *Class |                  |                                          |
| > FEM  |                  |                                          |
| >      |                  |                                          |
|  Event |                  |                                          |
| >      |                  |                                          |
| Monito |                  |                                          |
| ring** |                  |                                          |
+--------+------------------+------------------------------------------+
| > 28   | > FEM_EDI.1      | > Event Definition and Identification    |
+--------+------------------+------------------------------------------+
| > 29   | > FEM_EDI.2      | > Interaction of System Event Monitoring |
|        |                  | > Components                             |
+--------+------------------+------------------------------------------+
| > 30   | > FDM_EDI.3      | > Alarm Audit Requirements               |
+--------+------------------+------------------------------------------+
| > 31   | > FEM_EDI.4      | > Alarm Respoonse                        |
+--------+------------------+------------------------------------------+
| > *    |                  |                                          |
| *Class |                  |                                          |
| > FIA: |                  |                                          |
| > Id   |                  |                                          |
| entifi |                  |                                          |
| cation |                  |                                          |
| > &    |                  |                                          |
| > Auth |                  |                                          |
| entica |                  |                                          |
| tion** |                  |                                          |
+--------+------------------+------------------------------------------+
| > 32   | > FIA_AFL.1      | > Authentication failure handling        |
+--------+------------------+------------------------------------------+
| > 33   | > FIA_ATD.1      | > User attribute definition              |
+--------+------------------+------------------------------------------+
| > 34   | > FIA_SOS.1      | > Verification of passwords              |
+--------+------------------+------------------------------------------+
| > 35   | > FIA_SOS.2      | > TSF generation of passwords            |
+--------+------------------+------------------------------------------+
| > 36   | > FIA_UAU.1      | > Timing of authentication               |
+--------+------------------+------------------------------------------+
| > 37   | > FIA_UAU.2      | > User authentication before any action  |
+--------+------------------+------------------------------------------+
| > 38   | > FIA_UAU.3      | > Unforgeable authentication             |
+--------+------------------+------------------------------------------+
| > 39   | > FIA_UAU.4      | > Single use authentication mechanisms   |
+--------+------------------+------------------------------------------+
| > 40   | > FIA_UAU.7      | > Protected authentication feedback      |
+--------+------------------+------------------------------------------+
| > 41   | > FIA_UID.1      | > Timing of identification               |
+--------+------------------+------------------------------------------+
| > 42   | > FIA_UID.2      | > User identification before any action  |
+--------+------------------+------------------------------------------+
| > *    |                  |                                          |
| *Class |                  |                                          |
| > FMT: |                  |                                          |
| > Mana |                  |                                          |
| gement |                  |                                          |
| > of   |                  |                                          |
| > fun  |                  |                                          |
| ctions |                  |                                          |
| > in   |                  |                                          |
| >      |                  |                                          |
|  TSF** |                  |                                          |
+--------+------------------+------------------------------------------+
| > 43   | > FMT_MOF.1      | > Management of security functions       |
|        |                  | > behavior                               |
+--------+------------------+------------------------------------------+
| > 44   | > FMT_MOF.2      | > Security function and security policy  |
|        |                  | > mapping                                |
+--------+------------------+------------------------------------------+
| > 45   | > FMT_MSA.1      | > Management of security attributes      |
+--------+------------------+------------------------------------------+
| > 46   | > FMT_MTD.1      | > Management of TSF data                 |
+--------+------------------+------------------------------------------+
| > 47   | > FMT_MTD.4\`    | > Management of TSF data to policy       |
|        |                  | > mapping                                |
+--------+------------------+------------------------------------------+
| > 48   | > FMT_REV.1      | > Revocation                             |
+--------+------------------+------------------------------------------+
| > 49   | > FMT_SAE.1      | > Time limited authorization             |
+--------+------------------+------------------------------------------+
| > 50   | > FMT_SMF.1      | > Security management functions          |
+--------+------------------+------------------------------------------+
| > 51   | > FMT_SMR.1      | > Security roles                         |
+--------+------------------+------------------------------------------+
| > 52   | > FMT_SMR.2      | > Restrictions on security roles         |
+--------+------------------+------------------------------------------+
| > 53   | > FMT_SMR.4      | > Security role to policy mapping        |
+--------+------------------+------------------------------------------+
| > *    |                  |                                          |
| *Class |                  |                                          |
| > FEM: |                  |                                          |
| > Se   |                  |                                          |
| curity |                  |                                          |
| >      |                  |                                          |
|  event |                  |                                          |
| >      |                  |                                          |
| monito |                  |                                          |
| ring** |                  |                                          |
+--------+------------------+------------------------------------------+
| > 54   | > FEM_EDI.1      | > Event definition and identification    |
+--------+------------------+------------------------------------------+
| > 55   | > FEM_EDI.2      | > Interaction of system event monitoring |
|        |                  | > components                             |
+--------+------------------+------------------------------------------+
| > 56   | > FEM_EDI.3      | > Alarm audit requirements               |
+--------+------------------+------------------------------------------+
| > 57   | > FEM_EDI.4      | > Alarm response                         |
+--------+------------------+------------------------------------------+
| > *    |                  |                                          |
| *Class |                  |                                          |
| > FPT: |                  |                                          |
| > Prot |                  |                                          |
| ection |                  |                                          |
| > of   |                  |                                          |
| > the  |                  |                                          |
| >      |                  |                                          |
|  TSF** |                  |                                          |
+--------+------------------+------------------------------------------+
| > 58   | > FPT_AMT.1      | > Abstract machine testing               |
+--------+------------------+------------------------------------------+
| > 59   | > FPT_FLS.1      | > Failure with preservation of secure    |
|        |                  | > state                                  |
+--------+------------------+------------------------------------------+
| > 60   | > FPT_ITA.1      | > Inter-TSF availability within a        |
|        |                  | > defined availability metric            |
+--------+------------------+------------------------------------------+
| > 61   | > FPT_ITC.1      | > Inter-TSF confidentiality during       |
|        |                  | > transmission                           |
+--------+------------------+------------------------------------------+
| > 62   | > FPT_ITI.1      | > Inter-TSF detection of modification    |
+--------+------------------+------------------------------------------+
| > 63   | > FPT_ITI.2      | > Inter-TSF detection and correction of  |
|        |                  | > modification                           |
+--------+------------------+------------------------------------------+
| > 64   | > FPT_PHP.1      | > Passive detection of physical attack   |
+--------+------------------+------------------------------------------+
| > 65   | > FPT_PHP.2      | > Notification of physical attack        |
+--------+------------------+------------------------------------------+
| > 66   | > FPT_PHP.3      | > Resistance to physical attack          |
+--------+------------------+------------------------------------------+
| > 67   | > FPT_PHP.4      | > Domain definition and alarm response   |
+--------+------------------+------------------------------------------+
| > 68   | > FPT_RCV.2      | > Automated recovery                     |
+--------+------------------+------------------------------------------+
| > 69   | > FPT_RCV.3      | > Automated recovery without undue loss  |
+--------+------------------+------------------------------------------+
| > 70   | > FPT_RCV.4      | > Function recovery                      |
+--------+------------------+------------------------------------------+
| > 71   | > FPT_RCV.5      | > Continuous degraded operations         |
+--------+------------------+------------------------------------------+
| > 72   | > FPT_RPL.1      | > Replay detection                       |
+--------+------------------+------------------------------------------+
| > 73   | > FPT_SEP.1      | > TSF domain separation                  |
+--------+------------------+------------------------------------------+
| > 74   | > FPT_SSP.1      | > Simple trusted acknowledgement         |
+--------+------------------+------------------------------------------+
| > 75   | > FPT_SSP.2      | > Mutual trusted acknowledgement         |
+--------+------------------+------------------------------------------+
| > 76   | > FPT_STM.1      | > Reliable time stamps                   |
+--------+------------------+------------------------------------------+
| > 77   | > FPT_TDC.1      | > Inter-TSF data consistency             |
+--------+------------------+------------------------------------------+
| > 78   | > FPT_TRC.1      | > Internal TSF consistency               |
+--------+------------------+------------------------------------------+
| > 79   | > FPT_TST.1      | > TSF testing                            |
+--------+------------------+------------------------------------------+
| > *    |                  |                                          |
| *Class |                  |                                          |
| > FCM: |                  |                                          |
| > Prot |                  |                                          |
| ection |                  |                                          |
| > of   |                  |                                          |
| >      |                  |                                          |
| System |                  |                                          |
| > Con  |                  |                                          |
| figura |                  |                                          |
| tion** |                  |                                          |
+--------+------------------+------------------------------------------+
| > 80   | > FCM_IDI.1      | > Identification information             |
+--------+------------------+------------------------------------------+
| > 81   | > FCM_IDI.2      | > Change requests and actions            |
+--------+------------------+------------------------------------------+
| > 82   | > FCM_IDI.3      | > Authorizations                         |
+--------+------------------+------------------------------------------+
| > *    |                  |                                          |
| *Class |                  |                                          |
| > FRU: |                  |                                          |
| > Re   |                  |                                          |
| source |                  |                                          |
| > u    |                  |                                          |
| tiliza |                  |                                          |
| tion** |                  |                                          |
+--------+------------------+------------------------------------------+
| > 83   | > FRU_FLT.1      | > Degraded fault tolerance               |
+--------+------------------+------------------------------------------+
| > 84   | > FRU_PRS.1      | > Limited priority of service            |
+--------+------------------+------------------------------------------+
| > 85   | > FRU_PRS.2      | > Full priority of service               |
+--------+------------------+------------------------------------------+
| > *    |                  |                                          |
| *Class |                  |                                          |
| > FTP: |                  |                                          |
| > T    |                  |                                          |
| rusted |                  |                                          |
| > pat  |                  |                                          |
| h/chan |                  |                                          |
| nels** |                  |                                          |
+--------+------------------+------------------------------------------+
| > 86   | > FTP_ITC.1      | > Inter-TSF trusted channel              |
+--------+------------------+------------------------------------------+
| > 87   | > FTP_TRP.1      | > Trusted path                           |
+--------+------------------+------------------------------------------+

The following sections contain the functional components from the Common
Criteria Part 2 \[CC2\] (CC) with the operations completed. The standard
CC text is in regular font; the text inserted by the System Protection
Profile (SPP) author is in accordance with the conventions described in
at the beginning of this document.

### Logon Controls:

**FIA_UID.1 Timing of identification**

Hierarchical to: No other components.

**FIA_UID.1.1 The TSF shall allow \[assignment: *list of TSF-mediated
actions*\] on behalf of the user to be performed before the user is
identified.**

**FIA_UID.1.2 The TSF shall require each user to be successfully
identified before allowing any other TSF-mediated actions on behalf of
that user.**

Dependencies: No dependencies

**FIA_UAU.1 Timing of authentication**

Hierarchical to: No other components.

**FIA_UAU.1.1 The TSF shall allow \[assignment: *list of TSF mediated
actions*\] on behalf of the user to be performed before the user is
authenticated.**

**FIA_UAU.1.2 The TSF shall require each user to be successfully
authenticated before allowing any other TSF-mediated actions on behalf
of that user.**

Dependencies: **FIA_UID.1 Timing of identification**

**FIA_UAU.2 User authentication before any action**

Hierarchical to: FIA_UAU.1

**FIA_UAU.2.1** The TSF shall require each user to be successfully
authenticated before allowing **any other TSF-mediated actions** on
behalf of that user.

Dependencies: **FIA_UID.1 Timing of identification**

**FIA_AFL.1 Authentication failure handling**

Hierarchical to: No other components.

**FIA_AFL.1.1 The TSF shall detect when \[assignment: *number*\]
unsuccessful authentication attempts occur related to \[assignment:
*list of authentication events*\].**

**FIA_AFL.1.2 When the defined number of unsuccessful authentication
attempts has been met or surpassed, the TSF shall \[assignment: *list of
actions*\].**

Dependencies: **FIA_UAU.1 Timing of authentication**

**FTP_TRP.1 Trusted path**

Hierarchical to: No other components.

**FTP_TRP.1.1 The TSF shall provide a communication path between itself
and \[selection: *remote, local*\] users that is logically distinct from
other communication paths and provides assured identification of its end
points and protection of the communicated data from modification or
disclosure.**

**FTP_TRP.1.2 The TSF shall permit \[selection: *the TSF, local users,
remote users*\] to initiate communication via the trusted path.**

**FTP_TRP.1.3 The TSF shall require the use of the trusted path for
\[selection: *initial user authentication*, \[assignment: *other
services for which trusted path is required*\].**

Dependencies: No dependencies

**FTA_TSE.1 TOE session establishment**

Hierarchical to: No other components.

**FTA_TSE.1.1 The TSF shall be able to deny session establishment based
on \[assignment: *attributes*\].**

Dependencies: No dependencies

### Password Selection

**FIA_SOS.1 Verification of *passwords***

Hierarchical to: No other components.

**FIA_SOS.1.1 The TSF shall provide a mechanism to verify that
*passwords* meet \[assignment: *a defined quality metric*\].**

Dependencies: No dependencies

**FIA_SOS.2 TSF Generation of *passwords***

Hierarchical to: No other components.

**FIA_SOS.2.1 The TSF shall provide a mechanism to generate *passwords*
that meet \[assignment: *a defined quality metric*\].**

**FIA_SOS.2.2 The TSF shall be able to enforce the use of TSF generated
*passwords* for \[assignment: *list of TSF functions*\].**

Dependencies: No dependencies

**FMT_SAE.1 Time-limited authorisation**

Hierarchical to: No other components.

**FMT_SAE.1.1 The TSF shall restrict the capability to specify an
expiration time for \[assignment: *list of security attributes for which
expiration is to be supported*\] to \[assignment: *the authorized
identified roles*\].**

**FMT_SAE.1.2 For each of these security attributes, the TSF shall be
able to \[assignment: *list of actions to be taken for each security
attribute*\] after the expiration time for the indicated security
attribute has passed.**

Dependencies: **FMT_SMR.1 Security roles**

**FPT_STM.1 Reliable time stamps**

### Authentication Data Protection

**FIA_UAU.7 Protected authentication feedback**

Hierarchical to: No other components.

**FIA_UAU.7.1 The TSF shall provide only \[assignment: *list of
feedback*\] to the user while the authentication is in progress.**

Dependencies: **FIA_UAU.1 Timing of authentication**

(For passwords)

**FMT_MTD.1Management of TSF data**

Hierarchical to: No other components.

**FMT_MTD.1.1 The TSF shall restrict the ability to \[selection:
*change_default, query, modify, delete, clear*, \[assignment: *other
operations*\]\] the \[assignment: *list of TSF data*\] to \[assignment:
*the authorized identified roles*\].**

Dependencies: **FMT_SMF.1 Specification of management functions**

**FMT_SMR.1 Security roles**

**FPT_RPL.1 Replay detection**

Hierarchical to: No other components.

**FPT_RPL.1.1 The TSF shall detect replay for the following entities:
\[assignment: *list of identified entities*\].**

**FPT_RPL.1.2 The TSF shall perform \[assignment: *list of specific
actions*\] when replay is detected.**

Dependencies: No dependencies

### Replay / Reuse

**FIA_UAU.3 Unforgeable authentication**

Hierarchical to: No other components.

**FIA_UAU.3.1 The TSF shall \[selection: *detect, prevent*\] use of
authentication data that has been forged by any user of the TSF.**

**FIA_UAU.3.2 The TSF shall \[selection: *detect, prevent*\] use of
authentication data that has been copied from any other user of the
TSF.**

Dependencies: No dependencies

**FIA_UAU.4 Single-use authentication mechanisms**

Hierarchical to: No other components.

**FIA_UAU.4.1 The TSF shall prevent reuse of authentication data related
to \[assignment: *identified authentication mechanism(*s)\].**

Dependencies: No dependencies

\-\--These are targeted to preventing replay attacks from captured
control signals\-\--

### Session Suspension

**FTA_SSL.1 TSF-initiated session locking**

Hierarchical to: No other components.

**FTA_SSL.1.1 The TSF shall lock an interactive session after
\[assignment: *time interval of user inactivity*\] by:**

**a) clearing or overwriting display devices, making the current
contents unreadable;**

**b) disabling any activity of the user's data access/display devices
other than unlocking the session.**

**FTA_SSL.1.2 The TSF shall require the following events to occur prior
to unlocking the session: \[assignment: *events to occur*\].**

Dependencies: **FIA_UAU.1 Timing of authentication**

**FTA_SSL.2 User-initiated locking**

Hierarchical to: No other components.

**FTA_SSL.2.1 The TSF shall allow user-initiated locking of the user's
own interactive session,**

**by:**

**a) clearing or overwriting display devices, making the current
contents unreadable;**

**b) disabling any activity of the user's data access/display devices
other than unlocking the session.**

**FTA_SSL.2.2 The TSF shall require the following events to occur prior
to unlocking the session: \[assignment: *events to occur*\].**

Dependencies: **FIA_UAU.1 Timing of authentication**

**FTA_SSL.3 TSF-initiated termination**

Hierarchical to: No other components.

**FTA_SSL.3.1 The TSF shall terminate an interactive session after a
\[assignment: *time interval of user inactivity*\].**

Dependencies: No dependencies

### User Accounts and Profiles

**FMT_MTD.1Management of TSF data**

Hierarchical to: No other components.

**FMT_MTD.1.1 The TSF shall restrict the ability to \[selection:
*change_default, query, modify, delete, clear*, \[assignment: *other
operations*\]\] the \[assignment: *list of TSF data*\] to \[assignment:
*the authorized identified roles*\].**

Dependencies: **FMT_SMF.1 Specification of management functions**

**FMT_SMR.1 Security roles**

(User accounts and User profiles)

**FIA_ATD.1 User attribute definition**

Hierarchical to: No other components.

**FIA_ATD.1.1 The TSF shall maintain the following list of security
attributes belonging to individual users: \[assignment: *list of
security attributes*\].**

Dependencies: No dependencies

(Definition of user security attributes contained in a user profile)

### Role based access control

**FDP_ACC.1 Subset access control**

Hierarchical to: No other components.

**FDP_ACC.1.1 The TSF shall enforce the \[assignment: *access control
SFP*\] on \[assignment: *list of subjects*, *objects, and operations
among subjects and objects covered by the SFP*\].**

Dependencies: **FDP_ACF.1 Security attribute based access control**

**FDP_ACC.2 Complete access control**

Hierarchical to: FDP_ACC.1

**FDP_ACC.2.1** The TSF shall enforce the \[assignment: *access control
SFP*\] on \[assignment: *list of subjects and objects*\] **and all
operations among subjects and objects covered by the SFP.**

**FDP_ACC.2.2 The TSF shall ensure that all operations between any
subject in the TSC and any object within the TSC are covered by an
access control SFP.**

Dependencies: FDP_ACF.1 Security attribute based access control

**FDP_ACF.1 Security attribute based access control**

Hierarchical to: No other components.

**FDP_ACF.1.1 The TSF shall enforce the \[assignment: *access control
SFP*\] to objects based on \[assignment: *security attributes*, *named
groups of security attributes*\].**

**FDP_ACF.1.2 The TSF shall enforce the following rules to determine if
an operation among controlled subjects and controlled objects is
allowed: \[assignment: *rules governing access among controlled subjects
and controlled objects using controlled operations on controlled
objects*\].**

**FDP_ACF.1.3 The TSF shall explicitly authorize access of subjects to
objects based on the following additional rules: \[assignment: *rules,
based on security attributes, that explicitly authorize access of
subjects to objects*\].**

**FDP_ACF.1.4 The TSF shall explicitly deny access of subjects to
objects based on the \[assignment: *rules, based on security attributes,
that explicitly deny access of subjects to objects*\].**

Dependencies: **FDP_ACC.1 Subset access control**

**FMT_MSA.3 Static attribute initialization**

**FMT_SMR.1 Security roles**

Hierarchical to: No other components.

**FMT_SMR.1.1 The TSF shall maintain the roles \[assignment: *the
authorized identified roles*\].**

**FMT_SMR.1.2 The TSF shall be able to associate users with roles.**

Dependencies: **FIA_UID.1 Timing of identification**

**FMT_SMR.2 Restrictions on security roles**

Hierarchical to: **FMT_SMR.1**

**FMT_SMR.2.1** The TSF shall maintain the roles: \[assignment: *the
authorized identified roles*\].

**FMT_SMR.2.2** The TSF shall be able to associate users with roles.

**FMT_SMR.2.3 The TSF shall ensure that the conditions \[assignment: *a
single user account is not assigned the two different roles associated
with a two-man rule*\] are satisfied.**

Dependencies: **FIA_UID.1 Timing of identification**

Application Note: FDP_ACF.1 may be used to specify that particular
operations require two distinct roles to authorize the action.
FMT_SMR.2.3 can ensure that a user account cannot be assigned to both
roles (as used above). If there is more than one situation requiring
implementation of a two-man rule the combination should be iterated for
each set of roles.

### Controls on RBAC Attributes

**FMT_MSA.1 Management of security attributes**

Hierarchical to: No other components.

**FMT_MSA.1.1 The TSF shall enforce the \[assignment: *access control
SFP, information flow control SFP*\] to restrict the ability to
\[selection: *change_default, query, modify, delete,* \[assignment:
*other operations*\]\] the security attributes \[assignment: *list of
security attributes*\] to \[assignment: *the authorized identified
roles*\].**

Dependencies: **\[FDP_ACC.1 Subset access control or**

**FDP_IFC.1 Subset information flow control\]**

**FMT_SMF.1 Specification of management functions**

**FMT_SMR.1 Security roles**

### Firewall access control

**FDP_IFC.1 Subset information flow control**

Hierarchical to: No other components.

**FDP_IFC.1.1 The TSF shall enforce the \[assignment: *information flow
control SFP*\] on \[assignment: *list of subjects*, *information, and
operations that cause controlled information to flow to and from
controlled subjects covered by the SFP*\].**

Dependencies: **FDP_IFF.1 Simple security attributes**

**FDP_IFC.2 Complete information flow control**

Hierarchical to: FDP_IFC.1

**FDP_IFC.2.1** The TSF shall enforce the \[assignment: *information
flow control SFP*\] on \[assignment: *list of subjects* and
*information*\] and **all operations that cause that information to flow
to and from subjects covered by the SFP.**

**FDP_IFC.2.2 The TSF shall ensure that all operations that cause any
information in the TSC to flow to and from any subject in the TSC are
covered by an information flow control SFP.**

Dependencies: **FDP_IFF.1 Simple security attributes**

**FDP_IFF.1 Simple security attributes**

Hierarchical to: No other components.

**FDP_IFF.1.1 The TSF shall enforce the \[assignment: *information flow
control SFP*\] based on the following types of subject and information
security attributes: \[assignment: *the minimum number and type of
security attributes*\].**

**FDP_IFF.1.2 The TSF shall permit an information flow between a
controlled subject and controlled information via a controlled operation
if the following rules hold: \[assignment: *for each operation, the
security attribute-based relationship that must hold between subject and
information security attributes*\].**

**FDP_IFF.1.3 The TSF shall enforce the \[assignment: *additional
information flow control SFP rules*\].**

**FDP_IFF.1.4 The TSF shall provide the following \[assignment: *list of
additional SFP capabilities*\].**

**FDP_IFF.1.5 The TSF shall explicitly authorize an information flow
based on the following rules: \[assignment: *rules, based on security
attributes, that explicitly authorize information flows*\].**

**FDP_IFF.1.6 The TSF shall explicitly deny an information flow based on
the following rules: \[assignment: *rules, based on security attributes,
that explicitly deny information flows*\].**

Dependencies: **FDP_IFC.1 Subset information flow control**

**FMT_MSA.3 Static attribute initialization**

### Audit events

**FAU_GEN.1 Audit data generation**

Hierarchical to: No other components.

**FAU_GEN.1.1 The TSF shall be able to generate an audit record of the
following auditable events:**

**a) Start-up and shutdown of the audit functions;**

**b) All auditable events for the \[selection: *minimum, basic,
detailed, not specified*\] level of audit; and**

**c) \[assignment: *other specifically defined auditable events*\].**

**FAU_GEN.1.2 The TSF shall record within each audit record at least the
following**

**information:**

**a) Date and time of the event, type of event, subject identity, and
the outcome (success or failure) of the event; and**

**b) For each audit event type, based on the auditable event definitions
of the functional components included in the PP/ST, \[assignment: *other
audit relevant information*\]**

Dependencies: **FPT_STM.1 Reliable time stamps**

**FAU_GEN.2 User identity association**

Hierarchical to: No other components.

**FAU_GEN.2.1 The TSF shall be able to associate each auditable event
with the identity of the user that caused the event.**

Dependencies: **FAU_GEN.1 Audit data generation**

**FIA_UID.1 Timing of identification**

**FMT_MTD.1Management of TSF data**

Hierarchical to: No other components.

**FMT_MTD.1.1 The TSF shall restrict the ability to \[selection:
*change_default, query, modify, delete, clear*, \[assignment: *other
operations*\]\] the \[assignment: *list of TSF data*\] to \[assignment:
*the authorized identified roles*\].**

Dependencies: **FMT_SMF.1 Specification of management functions**

**FMT_SMR.1 Security roles**

**FAU_SEL.1 Selective audit**

Hierarchical to: No other components.

**FAU_SEL.1.1 The TSF shall be able to include or exclude auditable
events from the set of audited events based on the following
attributes:**

**a) \[selection: *object identity, user identity, subject identity,
host identity, event type*\]**

**b) \[assignment: *list of additional attributes that audit selectivity
is based upon*\].**

Dependencies: **FAU_GEN.1 Audit data generation**

**FMT_MTD.1 Management of TSF data**

### Intrusion detection and response

**FAU_ARP.1 Security alarms**

Hierarchical to: No other components.

**FAU_ARP.1.1 The TSF shall take \[assignment: *list of the least
disruptive actions*\] upon detection of a potential security
violation.**

Dependencies: **FAU_SAA.1 Potential violation analysis**

**FAU_SAA.1 Potential violation analysis**

Hierarchical to: No other components.

**FAU_SAA.1.1 The TSF shall be able to apply a set of rules in
monitoring the audited events and based upon these rules indicate a
potential violation of the TSP.**

**FAU_SAA.1.2 The TSF shall enforce the following rules for monitoring
audited events:**

**a) Accumulation or combination of \[assignment: *subset of defined
auditable events*\] known to indicate a potential security violation;**

**b) \[assignment: *any other rules*\].**

Dependencies: **FAU_GEN.1 Audit data generation**

**FAU_SAA.2 Profile based anomaly detection**

Hierarchical to: FAU_SAA.1

**FAU_SAA.2.1 The TSF shall be able to maintain profiles of system
usage, where an individual profile represents the historical patterns of
usage performed by the member(s) of \[assignment: *the profile target
group*\].**

**FAU_SAA.2.2 The TSF shall be able to maintain a suspicion rating
associated with each user whose activity is recorded in a profile, where
the suspicion rating represents the degree to which the user's current
activity is found inconsistent with the established patterns of usage
represented in the profile.**

**FAU_SAA.2.3 The TSF shall be able to indicate an imminent violation of
the TSP when a user's suspicion rating exceeds the following threshold
conditions \[assignment: *conditions under which anomalous activity is
reported by the TSF*\].**

Dependencies: **FIA_UID.1 Timing of identification**

**FAU_SAA.3 Simple attack heuristics**

Hierarchical to: FAU_SAA.1

**FAU_SAA.3.1 The TSF shall be able to maintain an internal
representation of the following signature events \[assignment: *a subset
of system events*\] that may indicate a violation of the TSP.**

**FAU_SAA.3.2 The TSF shall be able to compare the signature events
against the record of system activity discernible from an examination of
\[assignment: *the information to be used to determine system
activity*\].**

**FAU_SAA.3.3 The TSF shall be able to indicate an imminent violation of
the TSP when a system event is found to match a signature event that
indicates a potential violation of the TSP.**

Dependencies: No dependencies

**FAU_SAA.4 Complex attack heuristics**

Hierarchical to: FAU_SAA.3

**FAU_SAA.4.1** The TSF shall be able to maintain an internal
representation of the **following event sequences of known intrusion
scenarios \[assignment: *list of sequences of system events whose
occurrence are representative of known penetration scenarios*\] and**
the following signature events \[assignment: *a subset of system
events*\] that may indicate a potential violation of the TSP.

**FAU_SAA.4.2** The TSF shall be able to compare the signature events
**and event sequences** against the record of system activity
discernible from an examination of \[assignment: *the information to be
used to determine system activity*\].

**FAU_SAA.4.3** The TSF shall be able to indicate an imminent violation
of the TSP when **system activity** is found to match a signature event
**or event sequence** that indicates a potential violation of the TSP.

Dependencies: No dependencies

### Audit trail protection

**FAU_STG.1 Protected audit trail storage**

Hierarchical to: No other components.

**FAU_STG.1.1 The TSF shall protect the stored audit records from
unauthorised deletion.**

**FAU_STG.1.2 The TSF shall be able to \[selection: *prevent, detect*\]
modifications to the audit records.**

Dependencies: **FAU_GEN.1 Audit data generation**

**FAU_STG.2 Guarantees of audit data availability**

Hierarchical to: FAU_STG.1

**FAU_STG.2.1** The TSF shall protect the stored audit records from
unauthorized deletion.

**FAU_STG.2.2** The TSF shall be able to \[selection: *prevent,
detect*\] modifications to the audit records.

**FAU_STG.2.3 The TSF shall ensure that \[assignment: *metric for saving
audit records*\] audit records will be maintained when the following
conditions occur: \[selection: *audit storage exhaustion, failure,
attack*\].**

Dependencies: FAU_GEN.1 Audit data generation

**FAU_STG.3 Action in case of possible audit data loss**

Hierarchical to: No other components.

**FAU_STG.3.1 The TSF shall take \[assignment: *actions to be taken in
case of possible audit storage failure*\] if the audit trail exceeds
\[assignment: *pre-defined limit*\].**

Dependencies: FAU_STG.1 Protected audit trail storage

**FAU_STG.4 Prevention of audit data loss**

Hierarchical to: FAU_STG.3

**FAU_STG.4.1 The TSF shall \[selection: '*ignore auditable events',
'prevent auditable events, except those taken by the authorized user
with special rights', 'overwrite the oldest stored audit records'*\] and
\[assignment: *other actions to be taken in case of audit storage
failure*\] if the audit trail is full.**

Dependencies: FAU_STG.1 Protected audit trail storage

### Audit trail analysis / review

**FAU_SAR.1 Audit review**

120 This component will provide authorized users the capability to
obtain and interpret the information. In case of human users this
information needs to be in a human understandable presentation. In case
of external IT entities the information needs to be unambiguously
represented in an electronic fashion.

Hierarchical to: No other components.

**FAU_SAR.1.1 The TSF shall provide \[assignment: *authorized users*\]
with the capability to read \[assignment: *list of audit information*\]
from the audit records.**

**FAU_SAR.1.2 The TSF shall provide the audit records in a manner
suitable for the user to interpret the information.**

Dependencies: **FAU_GEN.1 Audit data generation**

**FAU_SAR.2 Restricted audit review**

Hierarchical to: No other components.

**FAU_SAR.2.1 The TSF shall prohibit all users read access to the audit
records, except those users that have been granted explicit
read-access.**

Dependencies: **FAU_SAR.1 Audit review**

**FAU_SAR.3 Selectable audit review**

Hierarchical to: No other components.

**FAU_SAR.3.1 The TSF shall provide the ability to perform \[selection:
*searches, sorting, ordering*\] of audit data based on \[assignment:
*criteria with logical relations*\].**

Dependencies: **FAU_SAR.1 Audit review**

### TOE Integrity

**FPT_PHP.1 Passive detection of physical attack**

Hierarchical to: No other components.

**FPT_PHP.1.1 The TSF shall provide unambiguous detection of physical
tampering that might compromise the TSF.**

**FPT_PHP.1.2 The TSF shall provide the capability to determine whether
physical tampering with the TSF's devices or TSF's elements has
occurred.**

Dependencies: **FMT_MOF.1 Management of security functions behavior**

**FPT_PHP.2 Notification of physical attack**

Hierarchical to: FPT_PHP.1

**FPT_PHP.2.1** The TSF shall provide unambiguous detection of physical
tampering that might compromise the TSF.

**FPT_PHP.2.2** The TSF shall provide the capability to determine
whether physical tampering with the TSF's devices or TSF's elements has
occurred.

**FPT_PHP.2.3 For \[assignment: *list of TSF devices/elements for which
active detection is required*\], the TSF shall monitor the devices and
elements and notify \[assignment: *a designated user or role*\] when
physical tampering with the TSF's devices or TSF's elements has
occurred.**

Dependencies: FMT_MOF.1 Management of security functions behavior

**FPT_PHP.3 Resistance to physical attack**

Hierarchical to: No other components.

**FPT_PHP.3.1 The TSF shall resist \[assignment: *physical tampering
scenarios*\] to the \[assignment: *list of TSF devices/elements*\] by
responding automatically such that the TSP is not violated.**

Dependencies: No dependencies

### Data Authentication

**FDP_DAU.2 Data authentication with identity of guarantor**

Hierarchical to: **FDP_DAU.1**

**FDP_DAU.2.1** The TSF shall provide a capability to generate evidence
that can be used as a guarantee of the validity of \[assignment: *list
of objects or information types*\].

**FDP_DAU.2.2** The TSF shall provide \[assignment: *list of subjects*\]
with the ability to verify evidence of the validity of the indicated
information **and the identity of the user that generated the
evidence.**

Dependencies: **FIA_UID.1 Timing of identification**

### Data exchange integrity

**FDP_UIT.1 Data exchange integrity**

Hierarchical to: No other components.

**FDP_UIT.1.1 The TSF shall enforce the \[assignment: *access control
SFP(s) and/or* i*nformation flow control SFP(s)*\] to be able to
\[selection*: transmit, receive*\] user data in a manner protected from
\[selection: *modification, deletion, insertion, replay*\] errors.**

Dependencies: **\[FDP_ACC.1 Subset access control, or**

**FDP_IFC.1 Subset information flow control\]**

**\[FTP_ITC.1 Inter-TSF trusted channel, or**

**FTP_TRP.1 Trusted path\]**

### Functions required to support dependencies

**FPT_STM.1.1 The TSF shall be able to provide reliable time stamps for
its own use.**

Dependencies: No dependencies

**FDP_ACF.1 Security attribute based access control**

Hierarchical to: No other components.

**FDP_ACF.1.1 The TSF shall enforce the \[assignment: *access control
SFP*\] to objects based on \[assignment: *security attributes*, *named
groups of security attributes*\].**

Dependencies: **FDP_ACC.1 Subset access control**

**FMT_MSA.3 Static attribute initialization**

**FMT_MSA.1 Management of security attributes**

Hierarchical to: No other components.

**FMT_MSA.1.1 The TSF shall enforce the \[assignment: *access control
SFP, information flow control SFP*\] to restrict the ability to
\[selection: *change_default, query, modify, delete,* \[assignment:
*other operations*\]\] the security attributes \[assignment: *list of
security attributes*\] to \[assignment: *the authorized identified
roles*\].**

Dependencies: **\[FDP_ACC.1 Subset access control or**

**FDP_IFC.1 Subset information flow control\]**

**FMT_SMF.1 Specification of management functions**

**FMT_SMR.1 Security roles**

**FMT_MSA.3 Static attribute initialization**

Hierarchical to: No other components.

**FMT_MSA.3.1 The TSF shall enforce the \[assignment: *access control
SFP, information flow control SFP*\] to provide \[selection:
*restrictive, permissive, other property*\] default values for security
attributes that are used to enforce the *SFP*.**

**FMT_MSA.3.2 The TSF shall allow the \[assignment: *the authorized
identified roles*\] to specify alternative initial values to override
the default values when an object or information is created.**

Dependencies: **FMT_MSA.1 Management of security attributes**

**FMT_SMR.1 Security roles**

**FDP_IFC.1 Subset information flow control**

Hierarchical to: No other components.

**FDP_IFC.1.1 The TSF shall enforce the \[assignment: *information flow
control SFP*\] on \[assignment: *list of subjects*, *information, and
operations that cause controlled information to flow to and from
controlled subjects covered by the SFP*\].**

Dependencies: **FDP_IFF.1 Simple security attributes**

**FMT_MOF.1Management of security functions behavior**

Hierarchical to: No other components.

**FMT_MOF.1.1 The TSF shall restrict the ability to \[selection:
*determine the behavior of, disable, enable, modify the behavior of*\]
the functions \[assignment: *list of functions*\] to \[assignment: *the
authorized identified roles*\].**

Dependencies: **FMT_SMF.1 Specification of management functions**

**FMT_SMR.1 Security roles**

### 6.1.18 Secure Communications Channels {#secure-communications-channels .unnumbered}

**FPT_ITA.1 Inter-TSF availability within a defined availability
metric**

Hierarchical to: No other components.

**FPT_ITA.1.1 The TSF shall ensure the availability of \[assignment:
*list types of TSF data*\] provided to a remote trusted product within
\[assignment: *a defined availability metric*\] given the following
conditions \[assignment: *conditions to ensure availability*\].**

Dependencies: No dependencies

**FPT_ITC.1 Inter-TSF confidentiality during transition**

Hierarchical to: No other components.

The TSF shall protect all data transmitted from the TSF to a remote
trusted product from unauthorized disclosure during transmission.

Dependencies: No dependencies

FPT_ITI.1 Inter-TSF detection of modification

Hierarchical to: No other components.

FPT_ITI.1.1 The TSF shall provide the capability to detect modification
of all TSF data during transmission between the TSF and a remote trusted
product within the following metric: \[assignment: *a defined
modification metric*\].

FPT_ITI.1.2 The TSF shall provide the capability to verify the integrity
of all TSF data transmitted between the TSF and a remote trusted product
and perform \[assignment: *action to be taken*\] if modifications are
detected.

Dependencies: No dependencies.

FPT_ITI.2 Inter-TSF detection and correction of modification

Hierarchical to: FPT_ITI.1

FPT_ITI.2.3 The TSF shall provide the capability to correct
\[assignment: *type of modification*\] of all TSF data transmitted
between the TSF and a remote trusted product.

Dependencies: No dependencies.

FPT_RCV.5 Continuous secure degraded operations

Hierarchical to: No other components.

FPT_RCV.5.1 The TSF shall ensure that \[assignment: *security controls
and list of failures/service discontinuities*\] that continuous degraded
operations can occur in a secure state.

FPT_RCV.5.2 The functions provided by the TSF to support continuous but
degraded operations in event of failure/service discontinuities shall be
configurable to support \[assignment: *prioritized operations and
configurations*\].

FPT_RCV.5.3 The TSF shall ensure that the transition for recovery from
degraded to normal operations \[assignment: *list of security controls
and configurations*\] can be performed in an orderly, consistent and
secure state.

FPT_SEP.1 TSF domain separation

Hierarchical to: No other components.

FPT_SEP.1.1 The TSF shall maintain a security domain for its execution
that protects it from interference and tampering from untrusted objects.

FPT_SEP.1.2 The TSF shall enforce separation between the security
domains of subjects in the TSC.

Dependencies: No dependencies.

FPT_SSP.1 Simple trusted acknowledgement

Hierarchical to: No other components.

FPT_SSP.1.1 The TSF shall acknowledge, when requested by another part of
the TSF, the receipt of an unmodified TSF data transmission.

Dependencies: FPT_ITT.1 Basic internal TSF data transfer protection

FTP_SSP.2 Mutual trusted acknowledgement

Hierarchical to: FPT_SSP.1

FTP_SSP.2.2 The TSF shall ensure that the relevant parts of the TSF know
the correct status of transmitted data among its different parts, using
acknowledgements.

Dependencies: FPT_ITT.1 Basic internal data transfer protection.

FPT_STM.1 Reliable time stamps

Hierarchical to: No other components.

The TSF shall be able to provide reliable time stamps for the systems
use.

Dependencies: No dependencies.

FPT_TDC.1 Inter-TSF basic data consistency

Hierarchical to: No other components.

FPT_TDC.1.1 The TSF shall provide the capability to consistently
interpret \[assignment: *list of TSF data types*\] when shared between
the TSF and another trusted product.

FPT_TDC.1.2 The TSF shall use \[assignment: *list of interpretation
rules to be applied by the TSF*\] when interpreting the TSF data from
another trusted IT product.

Dependencies: No dependencies.

FTP_ITC.1 Inter-TSF trusted channel

Hierarchical to: No other components.

FTP_ITC.1.1 The TSF shall provide a communication channel between itself
and a remote trusted product that is logically distinct from other
communication channels and provides assured identification of its end
points and protection of the channel data from modification or
disclosure.

FTP_ITC.1.2 The TSF shall permit \[selection: *the TSF, the remote
trusted product*\] to initiate communication via the trusted channel.

FPT_ITC.1.3 The TSF shall initiate communication via trusted channel for
\[assignment: *list of functions for which a trusted channel is
required*\].

Dependencies: No dependencies.

FTP_TRP.1 Trusted path

Hierarchical to: No other components.

FTP_TRP.1.1 The TSF shall provide a communication path between itself
and \[selection: *remote, local*\] users that is logically distinct from
other communications paths and provides assured identification of its
end points and protection of the communicated data from modification or
disclosure.

FPT_TRP.1.2 The TSF shall permit \[selection: *the TSF, local users,
remote users*\] to initiate communications via the trusted path.

FPTTRP.1.3 The TSF shall require the use of the trusted path for
\[selection: *initial user authentication,* \[assignment: *other
services for which trusted path is required*\]\].

Dependencies: No dependencies.

FDP_ETC.1 Export of user data without security attributes

Hierarchical to: No other components.

FDP_ETC. 1.1 The TSF shall enforce the \[assignment: *access control
SFP(s) and/or information flow control SFP(s)*\] when exporting user
data, controlled under the SFP(s), outside the TSC.

FDP_ETC.1.2 The TSF shall export the user data without the user data's
associated security attributes.

### 6.1.19 Management Functions {#management-functions .unnumbered}

**FMT_SMF.1 Specification of Management Functions**

Hierarchical to: No other components.

**FMT_SMF.1.1 The TSF shall be capable of performing the following
security management functions: \[assignment: list of security management
functions to be provided by the TSF\].**

Dependencies: No Dependencies.

**FMT_MOF.2 Security policy and security function mapping**

Hierarchical to: No other components.

**FMT_MOF.2.1 The TSF shall be capable of performing the following
security management**

**functions: \[assignment: list of security management functions to be
provided by**

**the TSF\].**

Dependencies**: No Dependencies**

\<Editor's Note: The remaining management functions are extensions to
ISO 15408, that is, they are not found in the ISO standard\>

**FMT_MTD.4 Management of TSF data to policy mapping**

Hierarchical to: No other components.

**FMT_MTD.4.1 The TSF shall restrict the ability to specify the mapping
for \[assignment: *list of security management functions* *provided by
the TSF*\], and \[assignment: *list of system security policies*\].**

**FMT_MTD.4.2 The TSF shall distinguish between \[assignment: *system
domains*\], \[assignment: *security policy governing domain*\], and
\[assignment: *data and its distribution and management*\].**

Dependencies**: FMT_MTD.1 Management of TSF data**

FMT_REV.1 Access revocation

Physical and IT access shall be revoked within \[assignment: *time
span*\] for personnel whose employment or contractual relationship is
terminated or for personnel who are temporarily not actively involved in
process control and operations (for example, workers on strike, workers
on a leave of absence, etc.)

**FCS_CKM.1 Cryptographic key generation**

Hierarchical to: No other components.

**FCS_CKM.1.1 The TSF shall generate cryptographic keys in accordance
with a specified cryptographic key generation algorithm \[assignment:
*cryptographic key generation algorithm*\] and specified cryptographic
key sizes \[assignment: *cryptographic key sizes*\] that meet the
following: \[assignment: *list of standards*\].**

Dependencies: **\[FCS_CKM.2 Cryptographic key distribution**

> **or**

**FCS_COP.1 Cryptographic operation\]**

**FCS_CKM.4 Cryptographic key destruction**

**FMT_MSA.2 Secure security attributes**

**FCS_CKM.2 Cryptographic key distribution**

Hierarchical to: No other components.

**FCS_CKM.2.1 The TSF shall distribute cryptographic keys in accordance
with a specified cryptographic key distribution method \[assignment:
*cryptographic key distribution method*\] that meets the following:
\[assignment: *list of standards*\].**

**Dependencies: \[FDP_ITC.1 Import of user data without security
attributes**

> **or**
>
> **FCS_CKM.1 Cryptographic key generation\]**
>
> **FCS_CKM.4 Cryptographic key destruction**
>
> **FMT_MSA.2 Secure security attributes**

**FCS_CKM.3.1 Cryptographic key access**

Hierarchical to: No other components

**FCS_CKM.3.1 The TSF shall perform \[assignment: *type of cryptographic
key access*\] in accordance with a specified cryptographic key access
method \[assignment: *cryptographic key access method*\] that meets the
following: \[assignment: *list of standards*\].**

**Dependencies: \[FDP_ITC.1 Import of user data without security
attributes**

> **or**
>
> **FCS_CKM.1 Cryptographic key generation\]**
>
> **FCS_CKM.4 Cryptographic key destruction**
>
> **FMT_MSA.2 Secure security attributes**

**FCS_CKM.4 Cryptographic key destruction**

Hierarchical to: No other components.

**FCS_CKM.4.1 The TSF shall destroy cryptographic keys in accordance
with a specified cryptographic key destruction method \[assignment:
*cryptographic key destruction method*\] that meets the following:
\[assignment: *list of standards*\].**

**Dependencies: \[FDP_ITC.1 Import of user data without security
attributes**

> **or**
>
> **FCS_CKM.1 Cryptographic key generation\]**
>
> **FMT_MSA.2 Secure security attributes**

**FCS_COP.1 Cryptographic operation**

Hierarchical to: No other componenets.

**FCS_COP.1.1 The TSF shall perform \[assignment: *list of cryptographic
operations*\] in accordance with a specified cryptographic algorithm
\[assignment: *cryptographic algorithm*\] and cryptographic key sizes
\[assignment: *cryptographic key sizes*\] that meet the following:
\[assignment:*list of standards*\].**

**Dependencies: \[FDP_ITC.1 Import of user data without security
attributes**

> **or**
>
> **FCS_CKM.1 Cryptographic key generation\]**
>
> **FCS_CKM.4 Cryptographic key destruction**

**FMT_MSA.2 Secure security attributes**

FPT_PHP.5 Backup and Restore

The TSF shall include the capability to backup and restore the system
configuration including critical programs, controller instructions and
parameters, and instructions and parameters for all sensors and
actuators. Backups shall be performed \[assignment: frequency\] and
whenever critical operating parameters \[assignment: identify the
critical operating parameters\] are changed.

FPT_PHP.5 Backup and Restore Self-Testing

The TSF backup and restore procedure shall be able to be self-tested
during regular operations and planned maintenance. Self-Test to be
evoked as part of FPT_TST.1.

### 6.1.20 Physical Security Requirements {#physical-security-requirements .unnumbered}

\<Editor's Note: These requirements are extensions to ISO 15408, that
is, they are not found in the ISO standard \>

PHY_SOB.2 Strength of Boundary Access Control

The TSF shall provide physical access control to critical ICS components
including, but not limited to: control room(s), servers, controller,
sensors, actuators, and the physical plant under control.

\<Editor's Note: This requirement is included as an example. Physical
security requirements should be inserted in this section as appropriate
to the specific nature of the target ICS \>

### 6.1.21 Security Event Monitoring {#security-event-monitoring .unnumbered}

\<Editor's Note: These requirements are extensions to ISO 15408, that
is, they are not found in the ISO standard \>

**FEM_EDI.1 Event Definition and Identification**

**Hierarchical to: No other components.**

**FEM_EDI.1.1 the TSF shall provide automated event monitoring for
\[select: *event identification, name of interface, location,component
name and functions,* \[assignment*: other event information*\].**

**FEM_EDI.1.2 The TSF shall provide the ability to \[assignment: *alarm*
*parameter settings, pre-defined security values*\].**

**FEM_EDI.1.3 The TSF shall prescribe the information flow for each
event \[assignment: *monitored interface/component, monitoring device,
information flow from receipt of alarm to its transmittal to end
receiver for action*\] and categorization of the alarm to the system TSF
\[assignment: *category and impact of alarm*\].**

Dependencies**: FMT_SMF.1 Specification of management functions**

**FMT_SMR.1_Security roles**

**FPT_PHP. FPT_PHP.4 Domain definition and response to alarm**

**FEM_EDI.2 Interaction of system event monitoring components**

Hierarchical to**: FEM_EDI.1 Event definition and identification**

**FEM_EDI.2.1**

**defines the iinteractions of technical and operational and management
security controls components that support event monitoring associated
with the system environment. Also defines the system environment
security controls event monitoring reporting mechanism from either
direct or indirect interface with the System technical security controls
components that support event monitoring. May be used in conjunction
with FPT_PHP.**

**FEM_EDI.3 Alarm audit requirements define the audit requirements for
the defined alarms.**

**FEM_EDI.4 Alarm response identifies that the alarm response to
authorized pre-defined security event monitoring alarms be obtained and
documented; identifies the roles and responsibilities that are defined
for receipt of alarm and required action, including any timing
constraints (possible roles are specified in FMT_SMR.1); defines
security event alarm reporting procedures and mechanisms for the
exchange of security event alarm information between the System IT and
System environment security controls; and specifies that event alarm
audit data be transformed to a specific format to support real-time
analysis, and into a different useful format for delivery to authorised
users for review (see application notes for FAU_SAA)**

FPT_STM.1 Reliable time stamps

**Hierarchical to: No other components.**

The TSF shall be able to provide reliable time stamps for the systems
use.

**Dependencies: No dependencies.**

### 6.1.22 Requirements for interfaces between system components {#requirements-for-interfaces-between-system-components .unnumbered}

*\<Editor's Note: These requirements are extensions to ISO 15408, that
is, they are not found in the ISO standard. \>*

FPT_PHP.2 Authentication Integration

The TSF shall integrate authentication of user access with
authentication for physical access such that user access is not granted
for a user not identified by the physical access control as being
physically present and such that user access is locked when the physical
access control indicates that the user is no longer physically present.

### 6.1.23 Requirements for composability and interoperability between system components {#requirements-for-composability-and-interoperability-between-system-components .unnumbered}

FPT_PHP.4 Domain Definition and Response to Alarm

The TSF shall identify and define the domains, which comprise the
system, the physical boundary for each domain, and the security
policy(s), which governs each of the domains. The system security alarms
may be tailored for the components being governed by the specific
domain. The definition for each alarm shall be well defined, to include
the alarm threshold, where it is reported, and the requisite system
response.

This section documents any requirements specific to security
composability that have not

### 6.1.24 Configuration requirements {#configuration-requirements .unnumbered}

*\<Editor's Note: These requirements are extensions to ISO 15408, that
is, they are not found in the ISO standard. \>*

FCM_IDI.1 Configuration Change Requests and Actions

The STOE shall be subject to configuration management with an explicit
change control and review process.

## STOE Security Assurance Requirements

This section contains the assurance requirements for the TOE. The
assurance requirements are listed in summary form in Table 13 below,
with more detail on the assurance requirements following the Table. The
general intent of the assurance requirements and associated system
evaluation activities is to confirm that the acceptable level of
residual risk as documented in the SPP is achieved in the operational
system

The baseline evaluation assurance level (EAL) for Industrial Control
Systems is EAL 3+. The \"+\" indicates that the EAL is as defined in ISO
15408 Part 3 with additional assurance requirements. In this case the
additional requirements reflect the assurances associated with design,
development, integration, testing and deployment of a system as opposed
to a component or product. In addition, because the ICS is a system, a
combination of technical and operations and management security control
elements must be considered.

\<Editor's Note: Table 13 and the text below it outlines extensions to
the assurance requirements that are building on ISO system work in
concert with NIST work on security controls\>

[]{#__RefHeading___Toc69732177 .anchor}Table 13 -- STOE Security
Assurance Requirements

+-------+---------------+----------------------------------------------+
| >     |               |                                              |
| **No. |               |                                              |
| >     |               |                                              |
|  Comp |               |                                              |
| onent |               |                                              |
| >     |               |                                              |
|  Comp |               |                                              |
| onent |               |                                              |
| > N   |               |                                              |
| ame** |               |                                              |
+=======+===============+==============================================+
| > **  |               |                                              |
| Class |               |                                              |
| >     |               |                                              |
|  ACM: |               |                                              |
| > Con |               |                                              |
| figur |               |                                              |
| ation |               |                                              |
| > ma  |               |                                              |
| nagem |               |                                              |
| ent** |               |                                              |
+-------+---------------+----------------------------------------------+
| > 1   | > ACM_CAP.3   | > Authorization controls                     |
+-------+---------------+----------------------------------------------+
| > 2   | > ACM_SCP.1   | > TOE CM Coverage                            |
+-------+---------------+----------------------------------------------+
| > 3   | > ACM_OBM.1   | > CM Operational Baseline and Maintenance    |
+-------+---------------+----------------------------------------------+
| > **  |               |                                              |
| Class |               |                                              |
| >     |               |                                              |
|  ADO: |               |                                              |
| > Del |               |                                              |
| ivery |               |                                              |
| > and |               |                                              |
| > O   |               |                                              |
| perat |               |                                              |
| ion** |               |                                              |
+-------+---------------+----------------------------------------------+
| > 4   | > ADO_DEL.1   | > Delivery procedures                        |
+-------+---------------+----------------------------------------------+
| > 5   | > ADO_IGS.1   | > Installation, generation and start-up      |
+-------+---------------+----------------------------------------------+
| > 6   | > ADO_SIC.1   | > Site interoperability check                |
+-------+---------------+----------------------------------------------+
| > **  |               |                                              |
| Class |               |                                              |
| >     |               |                                              |
|  AGD: |               |                                              |
| > Gui |               |                                              |
| dance |               |                                              |
| > d   |               |                                              |
| ocume |               |                                              |
| nts** |               |                                              |
+-------+---------------+----------------------------------------------+
| > 7   | > AGD_ADM.1   | > Administrator guidance                     |
+-------+---------------+----------------------------------------------+
| > 8   | > AGD_USR.1   | > User guidance                              |
+-------+---------------+----------------------------------------------+
| > 9   | > AGD_OCD.1   | > System operational configuration           |
|       |               | > definition guidance                        |
+-------+---------------+----------------------------------------------+
| > **  | > **Life      |                                              |
| Class | > cycle       |                                              |
| >     | > support**   |                                              |
| ALC** |               |                                              |
+-------+---------------+----------------------------------------------+
| > 10  | > ALC_DVS.1   | > Identification of security measures        |
+-------+---------------+----------------------------------------------+
| > 11  | > ALC_FLR.3   | > Systematic flaw remediation                |
+-------+---------------+----------------------------------------------+
| > 12  | > ALC_OPS.1   | > Operational security                       |
+-------+---------------+----------------------------------------------+
| > **  | > **Security  |                                              |
| Class | > awareness** |                                              |
| >     |               |                                              |
| ASA** |               |                                              |
+-------+---------------+----------------------------------------------+
| > 13  | > ASA_PPG.2   | > Verified operational security guidance     |
+-------+---------------+----------------------------------------------+
| > **  | > **O&M       |                                              |
| Class | > security    |                                              |
| >     | > controls**  |                                              |
| ASC** | >             |                                              |
|       | > **mainten** |                                              |
+-------+---------------+----------------------------------------------+
| > 14  | > ASC_PPO.1   | > Verified policy and procedures             |
+-------+---------------+----------------------------------------------+
| > 15  | > ASC_PFA.1   | > Asset records confirmation                 |
+-------+---------------+----------------------------------------------+
| > 16  | > ASC_OIN.1   | > Operational integration                    |
+-------+---------------+----------------------------------------------+
| > **  | > **System    |                                              |
| Class | > A           |                                              |
| >     | rchitecture** |                                              |
| ASD** |               |                                              |
+-------+---------------+----------------------------------------------+
| > 17  | > ASD_SAD.1   | > Operational system architecture design     |
+-------+---------------+----------------------------------------------+
| > 18  | > ASD_IFS.1   | > Operational system interface functional    |
|       |               | > specification                              |
+-------+---------------+----------------------------------------------+
| > 19  | > ASD_SSD.2   | > Subsystem design                           |
+-------+---------------+----------------------------------------------+
| > 20  | > ASD_IMP.1   | > Implementation representation              |
+-------+---------------+----------------------------------------------+
| > 21  | > ASD_COM.1   | > System security concept of operations      |
+-------+---------------+----------------------------------------------+
| > **  |               |                                              |
| Class |               |                                              |
| >     |               |                                              |
|  ATE: |               |                                              |
| > Te  |               |                                              |
| sts** |               |                                              |
+-------+---------------+----------------------------------------------+
| > 22  | > ATE_COV.2   | > Analysis of coverage                       |
+-------+---------------+----------------------------------------------+
| > 23  | > ATE_DPT.1   | > Testing high-level design                  |
+-------+---------------+----------------------------------------------+
| > 24  | > ATE_FUN.1   | > Functional testing                         |
+-------+---------------+----------------------------------------------+
| > 25  | > ATE_IND.2   | > Independent testing- sample                |
+-------+---------------+----------------------------------------------+
| > 26  | > ATE_AST.3   | > Operational testing policy conformance     |
+-------+---------------+----------------------------------------------+
| > **  |               |                                              |
| Class |               |                                              |
| >     |               |                                              |
|  AVA: |               |                                              |
| > Vul |               |                                              |
| nerab |               |                                              |
| ility |               |                                              |
| > As  |               |                                              |
| sessm |               |                                              |
| ent** |               |                                              |
+-------+---------------+----------------------------------------------+
| > 27  | > AVA_SOF.1   | > Strength of STOE security function         |
|       |               | > evaluation                                 |
+-------+---------------+----------------------------------------------+
| > 28  | > AVA_MSU.1   | > Examination of guidance                    |
+-------+---------------+----------------------------------------------+
| > 29  | > AVA_VLA.1   | > Developer vulnerability analysis           |
+-------+---------------+----------------------------------------------+
| > **  |               |                                              |
| Class |               |                                              |
| >     |               |                                              |
|  AMA: |               |                                              |
| >     |               |                                              |
|  Assu |               |                                              |
| rance |               |                                              |
| > Mai |               |                                              |
| ntena |               |                                              |
| nce** |               |                                              |
| >     |               |                                              |
| > *   |               |                                              |
| *Assu |               |                                              |
| rance |               |                                              |
| > Mai |               |                                              |
| ntena |               |                                              |
| nce** |               |                                              |
+-------+---------------+----------------------------------------------+
| > 30  | > ASA_AMP.1   | > Assurance maintenance plan                 |
+-------+---------------+----------------------------------------------+
| > 31  | > AMA_EVD.1   | > Evidence of assurance maintenance          |
+-------+---------------+----------------------------------------------+
| > 32  | > AMA_SIA.1   | > Security impact analysis                   |
+-------+---------------+----------------------------------------------+

### Configuration Management (ACM)

+---------------+------------------------------------------------------+
| #### Auth     |                                                      |
| orization Con |                                                      |
| trols (ACM_CA |                                                      |
| P.3) {#author |                                                      |
| ization-contr |                                                      |
| ols-acm_cap.3 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | ALC_DVS.1 Identification of security measures        |
+---------------+------------------------------------------------------+
| **A           | The developer shall provide a reference for the TOE. |
| CM_CAP.3.1D** |                                                      |
+---------------+------------------------------------------------------+
| **A           | The developer shall use a CM system.                 |
| CM_CAP.3.2D** |                                                      |
+---------------+------------------------------------------------------+
| **A           | The developer shall provide CM documentation.        |
| CM_CAP.3.3D** |                                                      |
+---------------+------------------------------------------------------+
| **A           | The reference for the STOE shall be unique to each   |
| CM_CAP.3.1C** | version of the TOE.                                  |
+---------------+------------------------------------------------------+
| **A           | The STOE shall be labeled with its reference.        |
| CM_CAP.3.2C** |                                                      |
+---------------+------------------------------------------------------+
| **A           | The CM documentation shall include a configuration   |
| CM_CAP.3.3C** | list **and a plan**.                                 |
+---------------+------------------------------------------------------+
| **A           | The configuration list shall describe the            |
| CM_CAP.3.4C** | configuration items that comprise the TOE.           |
+---------------+------------------------------------------------------+
| **A           | The CM documentation shall describe the method used  |
| CM_CAP.3.5C** | to uniquely identify the configuration items.        |
+---------------+------------------------------------------------------+
| **A           | The CM system shall uniquely identify all            |
| CM_CAP.3.6C** | configuration items.                                 |
+---------------+------------------------------------------------------+
| **A           | **The CM Plan shall describe how the CM system is    |
| CM_CAP.3.7C** | used.**                                              |
+---------------+------------------------------------------------------+
| **A           | **The evidence shall demonstrate that the CM system  |
| CM_CAP.3.8C** | is operating in accordance with the CM Plan.**       |
+---------------+------------------------------------------------------+
| **A           | **The CM documentation shall provide evidence that   |
| CM_CAP.3.9C** | all configuration have been and are being            |
|               | effectively maintained under the CM system.**        |
+---------------+------------------------------------------------------+
| **AC          | **The CM system shall provide measures such that     |
| M_CAP.3.10C** | only authorized changes are made to the              |
|               | configuration items.**                               |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| CM_CAP.3.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+

###  {#section-2 .unnumbered}

+---------------+------------------------------------------------------+
| #### STOE     |                                                      |
| CM Coverage ( |                                                      |
| ACM_SCP.1) {# |                                                      |
| stoe-cm-cover |                                                      |
| age-acm_scp.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | ACC_CAP.3 Authorization controls                     |
+---------------+------------------------------------------------------+
| **A           | **The developer shall provide a list of              |
| CM_SCP.1.1D** | configuration items for the TOE.**                   |
+---------------+------------------------------------------------------+
| **A           | **The list of configuration items shall include the  |
| CM_SCP.1.1C** | following: implementation representation and the     |
|               | evaluation evidence required by the assurance        |
|               | components in the ST.**                              |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| CM_SCP.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| ####          |                                                      |
| Operational B |                                                      |
| aseline & Mai |                                                      |
| ntenance (ACM |                                                      |
| _OBM.1) {#ope |                                                      |
| rational-base |                                                      |
| line-maintena |                                                      |
| nce-acm_obm.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | ACM_CAP.3 Authorization controls                     |
|               |                                                      |
|               | ACM_SCP.1 TOE CM coverage                            |
+---------------+------------------------------------------------------+
| **A           | **The developer/system owner shall use a CM system   |
| CM_OBM.1.1D** | for the initial/most recent evaluated system, which  |
|               | shall be called the "Baseline".**                    |
+---------------+------------------------------------------------------+
| **A           | **The CM system shall track and monitor each change, |
| CM_OBM.1.2D** | proposed and actual to the system Baseline, and its  |
|               | evaluation status.**                                 |
+---------------+------------------------------------------------------+
| **A           | **The CM system shall report the current operational |
| CM_OBM.1.3D** | system configuration baseline.**                     |
+---------------+------------------------------------------------------+
| **A           | **The developer/system owner shall provide CM        |
| CM_OBM.1.4D** | documentation of the Baseline system.**              |
+---------------+------------------------------------------------------+
| **A           | **The CM System shall uniquely identify the System   |
| CM_OBM.1.1C** | TOE Baseline, each associated change, and its        |
|               | evaluation status.**                                 |
+---------------+------------------------------------------------------+
| **AC          | **The CM Plan shall describe how the system baseline |
| M_OBM.1.2.C** | is maintained, and changes to the baseline are       |
|               | tracked and controlled.**                            |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| CM_OBM.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+

### Delivery and Operation (ADO)

###  {#section-3 .unnumbered}

+---------------+------------------------------------------------------+
| ###           |                                                      |
| # Delivery Pr |                                                      |
| ocedures (ADO |                                                      |
| _DEL.1) {#del |                                                      |
| ivery-procedu |                                                      |
| res-ado_del.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The developer shall document procedures for        |
| DO_DEL.1.1D** | delivery of the System TOE or parts of it to the     |
|               | user.**                                              |
+---------------+------------------------------------------------------+
| **A           | **The developer shall use the delivery procedures**. |
| DO_DEL.1.2D** |                                                      |
+---------------+------------------------------------------------------+
| **A           | **The delivery documentation** **shall describe all  |
| DO_DEL.1.1C** | procedures that are necessary to maintain security   |
|               | when distributing versions of the System TOE to a    |
|               | user's site**.                                       |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| DO_DEL.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #### Ins      |                                                      |
| tallation, Ge |                                                      |
| neration and  |                                                      |
| Start-up Proc |                                                      |
| edures (ADO_I |                                                      |
| GS.1) {#insta |                                                      |
| llation-gener |                                                      |
| ation-and-sta |                                                      |
| rt-up-procedu |                                                      |
| res-ado_igs.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The developer shall document procedures necessary  |
| DO_IGS.1.1D** | for the secure installation, generation, and         |
|               | start-up of the System TOE.**                        |
+---------------+------------------------------------------------------+
| **A           | **The installation, generation and start-up          |
| DO_IGS.1.1C** | documentation shall describe the steps necessary for |
|               | secure installation, generation, and start-up of the |
|               | System TOE**.                                        |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| DO_IGS.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall determine that the installation, |
| DO_IGS.1.2E** | generation, and start-up procedures result in a      |
|               | secure configuration.                                |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #### S        |                                                      |
| ite Interoper |                                                      |
| ability Check |                                                      |
|  (ADO_SIC.1)  |                                                      |
| {#site-intero |                                                      |
| perability-ch |                                                      |
| eck-ado_sic.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The developer shall document procedures necessary  |
| DO_SIC.1.1D** | to ensure that components and interfaces that        |
|               | comprise the System TOE, especially those to legacy  |
|               | security controls and interfaces can be started up   |
|               | and interoperate in a secure manner.**               |
+---------------+------------------------------------------------------+
| **A           | **The site interoperability check procedures         |
| DO_SIC.1.1C** | documentation shall describe the steps necessary for |
|               | verification of secure start-up and interoperation   |
|               | of the System TOE in its environment**.              |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| DO_SIC.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall determine that the start-up and  |
| DO_SIC.1.2E** | interoperability check procedures result in a secure |
|               | configuration.                                       |
+---------------+------------------------------------------------------+

### Guidance Documents (AGD)

+---------------+------------------------------------------------------+
| #### Admi     |                                                      |
| nistrator Gui |                                                      |
| dance (AGD_AD |                                                      |
| M.1) {#admini |                                                      |
| strator-guida |                                                      |
| nce-agd_adm.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | ASD_SAD.1 Operational System Architecture Design     |
+---------------+------------------------------------------------------+
| **A           | **The developer shall provide administrator guidance |
| GD_ADM.1.1D** | addressed to system administrative personnel.**      |
+---------------+------------------------------------------------------+
| **A           | **The administrator guidance shall describe the      |
| GD_ADM.1.1C** | administrative functions and interfaces available to |
|               | the administrator of the System TOE.**               |
+---------------+------------------------------------------------------+
| **A           | **The administrator guidance shall describe how to   |
| GD_ADM.1.2C** | administer the System TOE in a secure manner.**      |
+---------------+------------------------------------------------------+
| **A           | **The administrator guidance shall contain warnings  |
| GC_ADM.1.3C** | about functions and privileges that should be        |
|               | controlled in a secure processing environment.**     |
+---------------+------------------------------------------------------+
| **A           | **The administrator guidance shall describe all      |
| GC_ADM.1.4C** | assumptions regarding user behavior that are         |
|               | relevant to secure operation of the TOE.**           |
+---------------+------------------------------------------------------+
| **A           | **The administrator guidance shall describe all      |
| GC_ADM.1.5C** | security parameters under the control of the         |
|               | administrator, indicating secure values, as          |
|               | appropriate.**                                       |
+---------------+------------------------------------------------------+
| **A           | **The administrator guidance shall describe each     |
| GC_ADM.1.6C** | type of security-relevant event relative to the      |
|               | administrative functions that need to be performed,  |
|               | including changing the security characteristics of   |
|               | entities under the control of the TSF.**             |
+---------------+------------------------------------------------------+
| **A           | **The administrator guidance shall be consistent     |
| GC_ADM.1.7C** | with all other documentation supplied for            |
|               | evaluation.**                                        |
+---------------+------------------------------------------------------+
| **A           | **The administrator guidance shall describe all      |
| GC_ADM.1.8C** | security requirements for the IT environment that    |
|               | are relevant to the administrator.**                 |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| GD_ADM.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| ####          |                                                      |
|  User Guidanc |                                                      |
| e (AGD_USR.1) |                                                      |
|  {#user-guida |                                                      |
| nce-agd_usr.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | ASD_SAD.1 Operational System Architecture Design     |
+---------------+------------------------------------------------------+
| **A           | **The developer shall provide user guidance.**       |
| GD_USR.1.1D** |                                                      |
+---------------+------------------------------------------------------+
| **A           | **The user guidance shall describe the functions and |
| GD_USR.1.1C** | interfaces available to the non-administrator users  |
|               | of the System TOE.**                                 |
+---------------+------------------------------------------------------+
| **A           | **The user guidance shall describe the use of        |
| GD_USR.1.2C** | user-accessible security functions provided by the   |
|               | System TOE.**                                        |
+---------------+------------------------------------------------------+
| **A           | **The user guidance shall contain warnings about     |
| GD_USR.1.3C** | user-accessible functions and privileges that should |
|               | be controlled in a secure processing environment.**  |
+---------------+------------------------------------------------------+
| **A           | **The user guidance shall clearly present all user   |
| GD_USR.1.4C** | responsibilities necessary for secure operation of   |
|               | the TOE, including those related to assumptions      |
|               | regarding user behavior found in the statement of    |
|               | the TOE security environment.**                      |
+---------------+------------------------------------------------------+
| **A           | **The user guidance shall be consistent with all     |
| GD_USR.1.5C** | other documentation supplied for evaluation.**       |
+---------------+------------------------------------------------------+
| **A           | **The user guidance shall describe all security      |
| GD_USR.1.6C** | requirements for the IT environment that are         |
|               | relevant to the user.**                              |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| GD_USR.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| ####          |                                                      |
|  System Opera |                                                      |
| tional Config |                                                      |
| uration Defin |                                                      |
| ition Guidanc |                                                      |
| e (AGD_OCD.1) |                                                      |
|  {#system-ope |                                                      |
| rational-conf |                                                      |
| iguration-def |                                                      |
| inition-guida |                                                      |
| nce-agd_ocd.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | ASD_SAD.1 Operational System Architecture Design     |
|               |                                                      |
|               | ASD_COM.1 Operational System Security Concept of     |
|               | Operations                                           |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator/system owner shall        |
| GD_OCD.1.1D** | provide configuration guidance that defines the      |
|               | security relevant configuration parameters that      |
|               | support the integration of the system components and |
|               | that allow the system security functions to          |
|               | implement and enforce the system security concept of |
|               | operations and associated policies.**                |
+---------------+------------------------------------------------------+
| **A           | **The configuration guidance shall describe the      |
| GD_OCD.1.1C** | security configuration parameters available to the   |
|               | system integrator or equivalent users/administrator  |
|               | of the System TOE with that role and                 |
|               | responsibility.**                                    |
+---------------+------------------------------------------------------+
| **A           | **The configuration guidance shall describe the use  |
| GD_OCD.1.2C** | of security parameters configurable by the TOE to    |
|               | implement and enforce the system security            |
|               | policies.**                                          |
+---------------+------------------------------------------------------+
| **A           | **The configuration guidance shall contain warnings  |
| GD_OCD.1.3C** | about configuration accessible functions and         |
|               | privileges that should be controlled in a secure     |
|               | processing environment.**                            |
+---------------+------------------------------------------------------+
| **A           | **The configuration guidance shall clearly present   |
| GD_OCD.1.4C** | all configuration related responsibilities necessary |
|               | for secure operation of the TOE.**                   |
+---------------+------------------------------------------------------+
| **A           | **The user guidance shall be consistent with all     |
| GD_OCD.1.5C** | other documentation supplied for evaluation.**       |
+---------------+------------------------------------------------------+
| **A           | **The configuration guidance shall describe all      |
| GD_OCD.1.6C** | security requirements relative to the System         |
|               | environment.**                                       |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| GD_OCD.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+

### Life Cycle Support (ALC)

+---------------+------------------------------------------------------+
| #### Iden     |                                                      |
| tification of |                                                      |
|  Security Mea |                                                      |
| sures (ALC_DV |                                                      |
| S.1) {#identi |                                                      |
| fication-of-s |                                                      |
| ecurity-measu |                                                      |
| res-alc_dvs.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The developer shall produce development security   |
| LC_DVS.1.1D** | documentation.**                                     |
+---------------+------------------------------------------------------+
| **A           | **The development security documentation shall       |
| LC_DVS.1.1C** | describe all the physical, procedural, personnel,    |
|               | and other security measures that are necessary to    |
|               | protect the confidentiality and integrity of the TOE |
|               | design and implementation in its development         |
|               | environment.**                                       |
+---------------+------------------------------------------------------+
| **A           | **The development security documentation shall       |
| LC_DVS.1.2C** | provide evidence that these security measures are    |
|               | followed during the development and maintenance of   |
|               | the TOE.**                                           |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that the information   |
| LC_DVS.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.**                          |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that the security      |
| LC_DVS.1.2E** | measures are being applied.**                        |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #### S        |                                                      |
| ystematic Fla |                                                      |
| w Remediation |                                                      |
|  (ALC_FLR.3)  |                                                      |
| {#systematic- |                                                      |
| flaw-remediat |                                                      |
| ion-alc_flr.3 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | The developer shall provide flaw remediation         |
| LC_FLR.3.1D** | procedures addressed to TOE developers.              |
+---------------+------------------------------------------------------+
| **A           | The developer shall establish a a procedure for      |
| LC_FLR.3.2D** | accepting and acting upon all reports of security    |
|               | flaws and requests for corrections to those flaws.   |
+---------------+------------------------------------------------------+
| **A           | The developer shall provide remediation guidance     |
| LC_FLR.3.3D** | addressed to TOE users.                              |
+---------------+------------------------------------------------------+
| **A           | The flaw remediation procedures documentation shall  |
| LC_FLR.3.1C** | describe the procedures used to track all reported   |
|               | security flaws in each release of the TOE.           |
+---------------+------------------------------------------------------+
| **A           | The flaw remediation procedures shall require that a |
| LC_FLR.3.2C** | description of the nature and effect of each         |
|               | security flaw be provided, as well as the status of  |
|               | finding a correction to that flaw.                   |
+---------------+------------------------------------------------------+
| **A           | The flaw remediation procedures shall require that   |
| LC_FLR.3.3C** | corrective actions be identified for each of the     |
|               | security flaws.                                      |
+---------------+------------------------------------------------------+
| **A           | The flaw remediation procedures documentation shall  |
| LC_FLR.3.4C** | describe the methods used to provide flaw            |
|               | information, corrections and guidance on corrective  |
|               | actions to TOE users.                                |
+---------------+------------------------------------------------------+
| **A           | The flaw remediation procedures documentation shall  |
| LC_FLR.3.5C** | describe a means by which the developer receives     |
|               | from TOE users reports and enquiries of suspected    |
|               | security flaws in the TOE.                           |
+---------------+------------------------------------------------------+
| **A           | The procedures for processing reported security      |
| LC_FLR.3.6C** | flaws shall ensure that any reported flaws are       |
|               | corrected and the correction issued to TOE users.    |
+---------------+------------------------------------------------------+
| **A           | The procedures for processing reported security      |
| LC_FLR.3.7C** | flaws shall provide safeguards that any correction   |
|               | to these security flaws do not introduce any new     |
|               | flaws.                                               |
+---------------+------------------------------------------------------+
| **A           | The flaw remediation guidance shall describe a means |
| LC_FLR.3.8C** | by which TOE users report to the developer any       |
|               | suspected security flaws in the TOE.                 |
+---------------+------------------------------------------------------+
| **A           | **The flaw remediation procedures shall include a    |
| LC_FLR.3.9C** | procedure requiring timely responses for the         |
|               | automatic distribution of security flaw reports and  |
|               | the associated corrections to registered users who   |
|               | might be affected by the security flaw.**            |
+---------------+------------------------------------------------------+
| **AL          | **The flaw remediation guidance shall describe a     |
| C_FLR.3.10C** | means by which TOE users may register with the       |
|               | developer, to be eligible to receive security        |
|               | reports and corrections.**                           |
+---------------+------------------------------------------------------+
| **AL          | **The flaw remediation guidance shall identify the   |
| C_FLR.3.11C** | specific points of contact for all reports and       |
|               | enquiries about security issues involving the TOE.** |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| LC_FLR.3.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #### Ade      |                                                      |
| quacy of Oper |                                                      |
| ational Secur |                                                      |
| ity Measures  |                                                      |
| (ALC_OPS.2) { |                                                      |
| #adequacy-of- |                                                      |
| operational-s |                                                      |
| ecurity-measu |                                                      |
| res-alc_ops.2 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | ASD_COM.1 Operational System Security Concept of     |
|               | Operations                                           |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator/system owner shall        |
| LC_OPS.2.1D** | produce operations security documentation.**         |
+---------------+------------------------------------------------------+
| **A           | **The operations security documentation shall        |
| LC_OPS.2.1C** | describe all the physical, procedural, personnel,    |
|               | and other security controls measures that are        |
|               | required to protect the integrity of the System TOE  |
|               | implementation in its operational environment.**     |
+---------------+------------------------------------------------------+
| **            | **The operations security documentation shall        |
| ALC_OPS2.2C** | provide evidence that these security control         |
|               | measures are in place, followed, and enforced during |
|               | the operations and maintenance of the System TOE.**  |
+---------------+------------------------------------------------------+
| **A           | **The evidence shall provide support that the        |
| LC_OPS.2.3C** | security control measures, as implemented, provide   |
|               | the required level of protection to maintain         |
|               | effective security of the System TOE.**              |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| LC_OPS.2.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the security        |
| LC_OPS.2.2E** | controls measures are being applied.                 |
+---------------+------------------------------------------------------+

###  {#section-4 .unnumbered}

### Security Awareness (ASA)

+---------------+------------------------------------------------------+
| ##            |                                                      |
| ## Verified O |                                                      |
| perational Se |                                                      |
| curity Guidan |                                                      |
| ce (ASA_PPG.2 |                                                      |
| ) {#verified- |                                                      |
| operational-s |                                                      |
| ecurity-guida |                                                      |
| nce-asa_ppg.2 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The system owner/management shall provide security |
| SA_PPG.2.1D** | policy**                                             |
|               |                                                      |
|               | **and procedure guidance addressed to \[selection:   |
|               | \[assignment:**                                      |
|               |                                                      |
|               | ***appropriate personnel definition*\], *all*\]      |
|               | personnel.**                                         |
+---------------+------------------------------------------------------+
| **A           | **The security policy and procedure guidance shall   |
| SA_PPG.2.1C** | describe the security policies applicable to the     |
|               | system for the target personnel**                    |
+---------------+------------------------------------------------------+
| **A           | **The security policy and procedure guidance shall   |
| SA_PPG.2.2C** | describe how personnel can obtain the full contents  |
|               | of the security policies applicable to the system    |
|               | for the target personnel**                           |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| SA_PPG.2.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall independently verify through   |
| SA_PPG.2.2E** | \[selection: *personnel interviews, sampling the     |
|               | procedures in the security policy and procedure      |
|               | guidance*, \[assignment: *other methods*\]\] the     |
|               | veracity of the contents of the security policy and  |
|               | procedures guidance.**                               |
+---------------+------------------------------------------------------+

### System O&M Security Controls (ASC)

+---------------+------------------------------------------------------+
| #### Security |                                                      |
|  Policy, Proc |                                                      |
| edures and Or |                                                      |
| ganization (A |                                                      |
| SC_PPO.1) {#s |                                                      |
| ecurity-polic |                                                      |
| y-procedures- |                                                      |
| and-organizat |                                                      |
| ion-asc_ppo.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The system owner shall provide operational         |
| SC_PPO.1.1D** | security**                                           |
|               |                                                      |
|               | **documentation.**                                   |
+---------------+------------------------------------------------------+
| **A           | **The security controls documentation shall describe |
| SC_PPO.1.1C** | all the policy, procedural, personnel, and related   |
|               | organisational security controls measures that are   |
|               | necessary to protect the confidentiality and         |
|               | integrity of the operations and maintenance of the   |
|               | System TOE in its operational environment.**         |
+---------------+------------------------------------------------------+
| **A           | **The operations security documentation shall        |
| SC_PPO.1.2C** | provide evidence that these security controls        |
|               | measures are followed during the operation and       |
|               | maintenance of the System TOE.**                     |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| SC_PPO.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that the security      |
| SC_PPO.1.2E** | controls are being applied.**                        |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #### Phys     |                                                      |
| ical, Facilit |                                                      |
| y and Assets  |                                                      |
| (ASC_PFA.1) { |                                                      |
| #physical-fac |                                                      |
| ility-and-ass |                                                      |
| ets-asc_pfa.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The developer/system owner/integrator shall        |
| SC_PFA.1.1D** | provide**                                            |
|               |                                                      |
|               | **documentation for the physical, facility, and      |
|               | assets that**                                        |
|               |                                                      |
|               | **comprise the System security controls.**           |
+---------------+------------------------------------------------------+
| **A           | **The security controls documentation shall describe |
| SC_PFA.1.1C** | all the physical, facility and assets related        |
|               | security controls measures that are necessary to     |
|               | protect the confidentiality and integrity of the     |
|               | operations and maintenance of the System TOE in its  |
|               | operational environment.**                           |
+---------------+------------------------------------------------------+
| **A           | **The operations security documentation shall        |
| SC_PFA.1.2C** | provide evidence that these physical security        |
|               | controls measures are followed during the operation  |
|               | and maintenance of the System TOE.**                 |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| SC_PFA.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that the physical      |
| SC_PFA.1.2E** | security controls are being applied effectively.**   |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #### Operat   |                                                      |
| ional Integra |                                                      |
| tion (ASC_OIN |                                                      |
| .1) {#operati |                                                      |
| onal-integrat |                                                      |
| ion-asc_oin.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The developer/system owner/integrator shall        |
| SC_OIN.1.1D** | provide operational**                                |
|               |                                                      |
|               | **security documentation.**                          |
+---------------+------------------------------------------------------+
| **A           | **The operational system security documentation      |
| SC_OIN.1.1C** | shall describe the integrated system security        |
|               | controls; to include IT and physical, policy,        |
|               | procedural, personnel, and other system security     |
|               | measures that are necessary to protect the           |
|               | confidentiality and integrity of the operations and  |
|               | maintenance of the System TOE in its operational     |
|               | environment.**                                       |
+---------------+------------------------------------------------------+
| **A           | **The operations security documentation shall        |
| SC_OIN.1.2C** | provide evidence that the integrated security        |
|               | control measures are followed as part of the         |
|               | operations and maintenance of the System TOE.**      |
+---------------+------------------------------------------------------+
| **A           | **The evidence shall justify the integrated security |
| SC_OIN.1.3C** | measures provide the necessary level of protection   |
|               | to maintain the confidentiality and integrity of the |
|               | System TOE.**                                        |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| SC_OIN.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that the integrated    |
| SC_OIN.1.2E** | system security measures are being applied.**        |
+---------------+------------------------------------------------------+

### System Architecture (Class ASD)

+---------------+------------------------------------------------------+
| ##            |                                                      |
| ## Operationa |                                                      |
| l System Arch |                                                      |
| itecture Desi |                                                      |
| gn (ASD_SAD.1 |                                                      |
| ) {#operation |                                                      |
| al-system-arc |                                                      |
| hitecture-des |                                                      |
| ign-asd_sad.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator shall provide an          |
| SD_SAD.1.1D** | architecture description.**                          |
+---------------+------------------------------------------------------+
| **A           | **The architecture description shall identify the    |
| SD_SAD.1.1C** | system in terms of its subsystems and critical       |
|               | components and the interfaces and interconnects      |
|               | between the subsystems and critical components.**    |
+---------------+------------------------------------------------------+
| **A           | **The architecture description shall identify the    |
| SD_SAD.1.2C** | super-systems that interact with the system and the  |
|               | interfaces and interconnects between the system and  |
|               | the super-systems.**                                 |
+---------------+------------------------------------------------------+
| **A           | **The architecture description shall describe the    |
| SD_SAD.1.3C** | purpose of the identified subsystems, critical       |
|               | components, interconnects and interfaces of the      |
|               | system.**                                            |
+---------------+------------------------------------------------------+
| **A           | **The architecture description shall describe the    |
| SD_SAD.1.4C** | purpose of the identified interconnects and          |
|               | interfaces from the system to super-systems and      |
|               | shall describe the services from and provided to the |
|               | super-systems.**                                     |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| SD_SAD.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall determine that the             |
| SD_SAD.1.2E** | architecture description is consistent with the      |
|               | interface functional specification.**                |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #### O        |                                                      |
| perational Sy |                                                      |
| stem Interfac |                                                      |
| e Functional  |                                                      |
| Specification |                                                      |
|  (ASD_IFS.1)  |                                                      |
| {#operational |                                                      |
| -system-inter |                                                      |
| face-function |                                                      |
| al-specificat |                                                      |
| ion-asd_ifs.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator shall provide an          |
| SD_IFS.1.1D** | interface functional specification.**                |
+---------------+------------------------------------------------------+
| **A           | **The interface functional specification shall       |
| SD_IFS.1.1C** | describe the operational system security             |
|               | functions.**                                         |
+---------------+------------------------------------------------------+
| **A           | **The interfaces functional specification shall be   |
| SD_IFS.1.2C** | internally consistent.**                             |
+---------------+------------------------------------------------------+
| **A           | **The interface functional specification shall       |
| SD_IFS.1.3C** | identify and describe all the external system        |
|               | security function interfaces, including the          |
|               | behaviour of those interfaces.**                     |
+---------------+------------------------------------------------------+
| **A           | **The interface functional specification shall cover |
| SD_IFS.1.4C** | all the system security functions.**                 |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| SD_IFS.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall determine whether the          |
| SD_IFS.1.2E** | interface functional specification is a complete     |
|               | instantiation of the system security functional      |
|               | requirements.**                                      |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #### S        |                                                      |
| ubsystem Desi |                                                      |
| gn Allocation |                                                      |
|  (ASD_SSD.2)  |                                                      |
| {#subsystem-d |                                                      |
| esign-allocat |                                                      |
| ion-asd_ssd.2 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | ASD_SSD.1 Subsystem design.                          |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator shall provide a subsystem |
| SD_SSD.2.1D** | design.**                                            |
+---------------+------------------------------------------------------+
| **A           | **The subsystem design shall be internally           |
| SD_SSD.2.1C** | consistent.**                                        |
+---------------+------------------------------------------------------+
| **A           | **The subsystem design shall allocate the portion of |
| SD_SSD.2.2C** | the SSF to each represented subsystem in terms of    |
|               | minor and major subsystems.**                        |
+---------------+------------------------------------------------------+
| **A           | **The subsystem design shall describe the security   |
| SD_SSD.2.3C** | functionality provided by each subsystem.**          |
+---------------+------------------------------------------------------+
| **A           | **The subsystem design shall identify all hardware,  |
| SD_SSD.2.4C** | firmware, and software required by the SSF allocated |
|               | to the subsystem.**                                  |
+---------------+------------------------------------------------------+
| **A           | **The subsystem design shall allocate the portion of |
| SD_SSD.2.5C** | the SSF to each represented subsystem in terms of    |
|               | minor and major subsystems.**                        |
+---------------+------------------------------------------------------+
| **A           | **The subsystem design shall identify the interfaces |
| SD_SSD.2.6C** | to the subsystem security functions**.               |
+---------------+------------------------------------------------------+
| **A           | **The subsystem design shall describe the interfaces |
| SD_SSD.2.7C** | to each subsystem, in terms of their purpose and     |
|               | method of use of the effects, exceptions and error   |
|               | messages.**                                          |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| SD_SSD.2.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall determine whether the          |
| SD_SSD.2.2E** | subsystem design is a complete instantiation of the  |
|               | operational system security functional               |
|               | requirements.**                                      |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #### Imple    |                                                      |
| mentation Rep |                                                      |
| resentation ( |                                                      |
| ASD_IMP.1) {# |                                                      |
| implementatio |                                                      |
| n-representat |                                                      |
| ion-asd_imp.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator shall provide an          |
| SD_IMP.1.1D** | implementation representation of the system          |
|               | design.**                                            |
+---------------+------------------------------------------------------+
| **A           | **The implementation representation shall be         |
| SD_IMP.1.1C** | internally consistent.**                             |
+---------------+------------------------------------------------------+
| **A           | **The implementation representation identify the     |
| SD_IMP.1.2C** | system functionality, and the system components that |
|               | when integrated provide that functionality to the    |
|               | operational system.**                                |
+---------------+------------------------------------------------------+
| **A           | **The implementation representation shall describe   |
| SD_IMP.1.3C** | the security functionality provided by the           |
|               | integration of each component in terms of its        |
|               | specific configuration requirements.**               |
+---------------+------------------------------------------------------+
| **A           | **The implementation representation shall identify   |
| SD_IMP.1.4C** | any hardware, firmware, and software integration and |
|               | configuration issues, as identified, prior to, or    |
|               | during the operational system evaluation, that will  |
|               | need to be revisited.**                              |
+---------------+------------------------------------------------------+
| **A           | **The implementation representation shall identify   |
| SD_IMP.1.5C** | the integrated components and their required         |
|               | configuration to the system security functions**.    |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| SD_IMP.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall determine whether the          |
| SD_IMP.1.2E** | implementation representation is a complete          |
|               | instantiation of the integrated operational system   |
|               | security functional requirements.**                  |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #### Operat   |                                                      |
| ional System  |                                                      |
| Security Conc |                                                      |
| ept of Operat |                                                      |
| ions (ASD_COM |                                                      |
| .1) {#operati |                                                      |
| onal-system-s |                                                      |
| ecurity-conce |                                                      |
| pt-of-operati |                                                      |
| ons-asd_com.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The system owner/management shall provide a system |
| SD_COM.1.1D** | operations policy documents.**                       |
+---------------+------------------------------------------------------+
| **A           | **The system owner/integrator shall incorporate      |
| SD_COM.1.2D** | system policy enforcement requirements and           |
|               | capabilities into the policy documents provided by   |
|               | the system management, and provide the system        |
|               | operations policy documents with the system          |
|               | enforcement capabilities, and their bounds.**        |
+---------------+------------------------------------------------------+
| **A           | **The system concept of operations and enforcement   |
| SD_COM.1.1C** | documents subsystem shall be internally              |
|               | consistent.**                                        |
+---------------+------------------------------------------------------+
| **A           | **The operational system operations policy documents |
| SD_COM.1.2C** | shall identify the system capabilities for           |
|               | enforcement of information flow across the           |
|               | operational system interconnects within the          |
|               | operational system boundaries.**                     |
+---------------+------------------------------------------------------+
| **A           | **The operational system operations policy documents |
| SD_COM.1.3C** | shall identify the system capabilities for           |
|               | enforcement of information flow across the           |
|               | operational system interconnects to external         |
|               | operational systems.**                               |
+---------------+------------------------------------------------------+
| **A           | **The operational system operations policy documents |
| SD_COM.1.4C** | shall identify the system capabilities for           |
|               | enforcement of local and remote access to the        |
|               | operational system.**                                |
+---------------+------------------------------------------------------+
| **A           | **The operational system operations policy documents |
| SD_COM.1.5C** | shall identify the system capabilities for           |
|               | enforcement of access to operational system          |
|               | resources based upon access mediation rules.**       |
+---------------+------------------------------------------------------+
| **A           | **The operational system operations policy documents |
| SD_COM.1.6C** | shall identify the modes of operation provided by    |
|               | the system, and the enforcement mechanisms to        |
|               | provide secure operations in each of the identified  |
|               | system modes of operation.**                         |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| SD_COM.2.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall determine whether the system   |
| SD_COM.2.2E** | design is a complete instantiation of the            |
|               | operational system security concept of operations in |
|               | support of the operational mission.**                |
+---------------+------------------------------------------------------+

### Tests (ATE)

+---------------+------------------------------------------------------+
| ###           |                                                      |
| # System Secu |                                                      |
| rity Controls |                                                      |
|  Testing (ATE |                                                      |
| _AST.3) {#sys |                                                      |
| tem-security- |                                                      |
| controls-test |                                                      |
| ing-ate_ast.3 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | AGD_OCD.1 System operational configuration           |
|               | definition.                                          |
|               |                                                      |
|               | AGD_USR.1 User guidance                              |
|               |                                                      |
|               | ASD_IFS.1 System interface functional definition     |
|               |                                                      |
|               | ASD_IMP.1 Implementation representation              |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator shall provide evidence of |
| TE_AST.3.1D** | test verification planning.**                        |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator shall provide an analysis |
| TE_AST.3.2D** | of level of detail of integrated security controls   |
|               | testing.**                                           |
+---------------+------------------------------------------------------+
| **A           | **The developer shall provide test documentation and |
| TE_AST.3.3D** | the the System TOE for testing.**                    |
+---------------+------------------------------------------------------+
| **A           | **The analysis of the security controls verification |
| TE_AST.3.1C** | shall demonstrate that the correspondence between    |
|               | the security controls as identified in the SST and   |
|               | the tests identified in the test documentation is    |
|               | complete.**                                          |
+---------------+------------------------------------------------------+
| **A           | **The level of detail analysis shall show that the   |
| TE_AST.3.2C** | integrated security controls tests identified in the |
|               | test documentation are able to sufficiently          |
|               | demonstrate that the system security controls        |
|               | integrated into the System TSF operates in           |
|               | accordance with its high level design.**             |
+---------------+------------------------------------------------------+
| **A           | **The level of detail analysis shall show that the   |
| TE_AST.3.3C** | integrated security controls tests identified in the |
|               | test documentation are able to sufficiently          |
|               | demonstrate that the system security controls        |
|               | integrated into the System TSF; and are a correct    |
|               | implementation.**                                    |
+---------------+------------------------------------------------------+
| **A           | **The System TOE shall be suitable for testing.**    |
| TE_AST.3.4C** |                                                      |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| TE_AST.3.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall test a subset of the system    |
| TE_AST.3.2E** | TSF to confirm that the system TOE operates as       |
|               | specified in its intended operational environment.** |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| ####          |                                                      |
| Analysis of C |                                                      |
| overage (ATE_ |                                                      |
| COV.2) {#anal |                                                      |
| ysis-of-cover |                                                      |
| age-ate_cov.2 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | ASD_IFS.1 System interface functional definition     |
|               |                                                      |
|               | ATE_FUN.1 Functional testing                         |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator shall provide an analysis |
| TE_COV.2.1D** | of the test coverage.**                              |
+---------------+------------------------------------------------------+
| **A           | **The analysis of test coverage shall demonstrate    |
| TE_COV.2.1C** | that the correspondence between the TSF as described |
|               | in the functional specification and the tests        |
|               | identified in the test documentation is complete.**  |
+---------------+------------------------------------------------------+
| **A           | **The analysis of the test coverage shall            |
| TE_COV.2.2C** | demonstrate tha the correspondence between the TSF   |
|               | as described in the functional specification and the |
|               | tests identified in the test documentation is        |
|               | complete.**                                          |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| TE_AST.3.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| ###           |                                                      |
| # Testing: hi |                                                      |
| gh-level desi |                                                      |
| gn (ATE_DPT.1 |                                                      |
| ) {#testing-h |                                                      |
| igh-level-des |                                                      |
| ign-ate_dpt.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | ASD_IFS.1 System interface functional definition     |
|               |                                                      |
|               | ATE_FUN.1 Functional testing                         |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator shall provide an analysis |
| TE_DPT.1.1D** | of the depth of testing.**                           |
+---------------+------------------------------------------------------+
| **A           | **The depth analysis shall demonstrate that the      |
| TE_DPT.1.1C** | tests identified in the test documentation are       |
|               | sufficient to demonstrate that the TSF operates in   |
|               | accordance with its high-level design.**             |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| TE_DPT.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #             |                                                      |
| ### Functiona |                                                      |
| l Testing (AT |                                                      |
| E_FUN.1) {#fu |                                                      |
| nctional-test |                                                      |
| ing-ate_fun.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator shall test the TSF and    |
| TE_FUN.1.1D** | documents the results.**                             |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator shall provide test        |
| TE_FUN.1.2D** | documentation.**                                     |
+---------------+------------------------------------------------------+
| **A           | **The test documentation shall consist of test       |
| TE_FUN.1.1C** | plans, test procedure descriptions, expected test    |
|               | results and actual test results.**                   |
+---------------+------------------------------------------------------+
| **A           | **The test plans shall identify the security         |
| TE_FUN.1.2C** | functions to be tested and describe the goal of the  |
|               | tests to be performed.**                             |
+---------------+------------------------------------------------------+
| **A           | **The test procedure descriptions shall identify the |
| TE_FUN.1.3C** | tests to be performed and describe the scenarios for |
|               | testing each security function. These scenarios      |
|               | shall include any ordering dependencies on the       |
|               | results of other tests.**                            |
+---------------+------------------------------------------------------+
| **A           | **The expected test results shall show the           |
| TE_FUN.1.4C** | anticipated outputs from a successful execution of   |
|               | the tests.**                                         |
+---------------+------------------------------------------------------+
| **A           | **The test results from the developer/integrator     |
| TE_FUN.1.5C** | execution of the tests shall demonstrate that each   |
|               | test security function behaved as specified.**       |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| TE_FUN.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #### In       |                                                      |
| dependent tes |                                                      |
| ting -- sampl |                                                      |
| e (ATE_IND.2) |                                                      |
|  {#independen |                                                      |
| t-testing-sam |                                                      |
| ple-ate_ind.2 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | AGD_USR.1 User guidance                              |
|               |                                                      |
|               | ASD_IFS.1 System interface functional definition     |
|               |                                                      |
|               | ATE_FUN.1 Functional testing                         |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator/system owner shall        |
| TE_IND.2.1D** | provide the TOE for testing.**                       |
+---------------+------------------------------------------------------+
| **A           | **The TOE shall be suitable for testing.**           |
| TE_IND.2.1C** |                                                      |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator/system owner shall        |
| TE_IND.2.2C** | provide an equivalent set of resources to those that |
|               | were used in the developer/integrator/system owner's |
|               | functional testing of the TSF**                      |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| TE_IND.2.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall test a subset of the TSF as      |
| TE_IND.2.2E** | appropriate to confirm that the TOE operates as      |
|               | specified.                                           |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall execute a sample of tests in   |
| TE_IND.2.3E** | the test documentation to verify the developer test  |
|               | results.**                                           |
+---------------+------------------------------------------------------+

### Vulnerability Assessment (AVA)

+---------------+------------------------------------------------------+
| #### Examin   |                                                      |
| ation of Guid |                                                      |
| ance (AVA_MSU |                                                      |
| .1) {#examina |                                                      |
| tion-of-guida |                                                      |
| nce-ava_msu.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | ADO_IGS.1 Installation, generation, and start-up     |
|               | procedures                                           |
|               |                                                      |
|               | AGD_USR.1 User guidance                              |
|               |                                                      |
|               | ASD_IFS.1 Operational System Interface Functional    |
|               | Specification                                        |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator shall provide guidance    |
| VA_MSU.1.1D** | documentation.**                                     |
+---------------+------------------------------------------------------+
| **A           | **The guidance documentation shall identify all      |
| VA_MSU.1.1C** | possible modes of operation of the TOE (including    |
|               | operation following failure or operational error),   |
|               | their consequences and implications for maintaining  |
|               | secure operation.**                                  |
+---------------+------------------------------------------------------+
| **A           | **The guidance documentation shall be complete,      |
| VA_MSU.1.2C** | clear, consistent and reasonable.**                  |
+---------------+------------------------------------------------------+
| **A           | **The guidance documentation shall list all          |
| VA_MSU.1.3C** | assumptions about the intended environment.**        |
+---------------+------------------------------------------------------+
| **A           | **The guidance documentation shall list all          |
| VA_MSU.1.4C** | requirements for external security measures          |
|               | (including external procedural, physical and         |
|               | personnel controls).**                               |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that the information   |
| VA_MSU.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.**                          |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall repeat all configuration and   |
| VA_MSU.1.2E** | installation procedures to confirm that the TOE can  |
|               | be configured and used securely using only the       |
|               | supplied guidance documentation**.                   |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall determine that the use of      |
| VA_MSU.1.3E** | guidance documentation allows all insecure states to |
|               | be detected.**                                       |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #             |                                                      |
| ### Strength  |                                                      |
| of TOE securi |                                                      |
| ty function e |                                                      |
| valuation (AV |                                                      |
| A_SOF.1) {#st |                                                      |
| rength-of-toe |                                                      |
| -security-fun |                                                      |
| ction-evaluat |                                                      |
| ion-ava_sof.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | ASD_SSD.2 Subsystem design allocation                |
|               |                                                      |
|               | ASD_IFS.1 Operational system interface functional    |
|               | specification                                        |
|               |                                                      |
|               | ASD_COM.1 Operational system security concept of     |
|               | operations                                           |
+---------------+------------------------------------------------------+
| **A           | **The developer/system owner/integrator shall        |
| VA_SOF.1.1D** | perform a strength of TOE security function analysis |
|               | for each mechanism identified in the SST as having a |
|               | strength of TOE security function claim.**           |
+---------------+------------------------------------------------------+
| **A           | **For each mechanism with a strength of TOE security |
| VA_SOF.1.1C** | function claim the strength of TOE security function |
|               | analysis shall show that it meets or exceeds the     |
|               | minimum strength level defined in the SPP/SST.**     |
+---------------+------------------------------------------------------+
| **A           | **For each mechanism with a strength of TOE security |
| VA_SOF.1.2C** | function claim the strength of TOE security function |
|               | analysis shall show that it meets or exceeds the     |
|               | specific strength of function metric defined in the  |
|               | SPP/SST.**                                           |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that the information   |
| VA_SOF.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.**                          |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that the strength      |
| VA_SOF.1.2E** | claims are correct.**                                |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| ##            |                                                      |
| ## Developer/ |                                                      |
| System owner  |                                                      |
| vulnerability |                                                      |
|  analysis (AV |                                                      |
| A_VLA.1) {#de |                                                      |
| velopersystem |                                                      |
| -owner-vulner |                                                      |
| ability-analy |                                                      |
| sis-ava_vla.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | ASD_SSD.2 Subsystem design allocation                |
|               |                                                      |
|               | ASD_IFS.1 Operational system interface functional    |
|               | specification                                        |
|               |                                                      |
|               | ASD_COM.1 Operational system security concept of     |
|               | operations                                           |
|               |                                                      |
|               | AGD_USR.1 User guidance                              |
+---------------+------------------------------------------------------+
| **A           | **The developer/system owner shall perform a         |
| VA_VLA.1.1D** | vulnerability analysis.**                            |
+---------------+------------------------------------------------------+
| **A           | **The developer/system owner shall provide           |
| VA_VLA.1.2D** | vulnerability analysis documentation**               |
+---------------+------------------------------------------------------+
| **A           | **The vulnerability analysis documentation shall     |
| VA_VLA.1.1C** | describe the analysis of the TOE deliverables        |
|               | performed to search for obvious ways n which a user  |
|               | can violate the TSP.**                               |
+---------------+------------------------------------------------------+
| **A           | **The vulnerability analysis documentation shall     |
| VA_VLA.1.2C** | describe the disposition of obvious                  |
|               | vulnerabilities.**                                   |
+---------------+------------------------------------------------------+
| **A           | **The vulnerability analysis documentation shall     |
| VA_VLA.1.3C** | show, for all identified vulnerabilities, that the   |
|               | vulnerability cannot be exploited in the intended    |
|               | environment of the TOE.**                            |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that the information   |
| VA_VLA.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.**                          |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall conduct penetration testing,   |
| VA_VLA.1.2E** | building on the developer/system owner vulnerability |
|               | analysis, to ensure obvious vulnerabilities have     |
|               | been addressed**.                                    |
+---------------+------------------------------------------------------+

### Assurance Maintenance (AMA)

+---------------+------------------------------------------------------+
| #### As       |                                                      |
| surance Maint |                                                      |
| enance (AMA_A |                                                      |
| MP.1) {#assur |                                                      |
| ance-maintena |                                                      |
| nce-ama_amp.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | No dependencies.                                     |
+---------------+------------------------------------------------------+
| **A           | **The developer/integrator shall provide an AM       |
| MA_AMP.1.1D** | Plan.**                                              |
+---------------+------------------------------------------------------+
| **A           | **The AM Plan shall contain or reference a brief     |
| MA_AMP.1.1C** | description of the TOE including the security        |
|               | functionality it provides.**                         |
+---------------+------------------------------------------------------+
| **A           | **The AM Plan shall identify the certified version   |
| MA_AMP.1.2C** | of the system TOE, and shall reference the           |
|               | evaluation results..**                               |
+---------------+------------------------------------------------------+
| **A           | **The AM Plan shall reference the TOE component      |
| MA_AMP.1.3C** | categorization report for the certified version of   |
|               | the TOE.**                                           |
+---------------+------------------------------------------------------+
| **A           | **The AM Plan shall define the scope of changes to   |
| MA_AMP.1.4C** | the STOE that are covered by the plan.**             |
+---------------+------------------------------------------------------+
| **A           | **The AM Plan shall describe the TOE life-cycle, and |
| MA_AMP.1.5C** | shall identify the current plans for any new         |
|               | releases of the TOE, together with a brief           |
|               | description of any planned changes that are likely   |
|               | to have a significant security impact.**             |
+---------------+------------------------------------------------------+
| **A           | **The AM Plan shall describe the assurance           |
| MA_AMP.1.6C** | maintenance cycle, stating and justifying the        |
|               | planned schedule of AM audits and the target date of |
|               | the next re-evaluation of the TOE.**                 |
+---------------+------------------------------------------------------+
| **A           | **The AM Plan shall identify the individual(s) who   |
| MA_AMP.1.7C** | will assume the role of developer/system owner       |
|               | security analyst for the system TOE.**               |
+---------------+------------------------------------------------------+
| **A           | **The AM Plan shall describe how the                 |
| MA_AMP.1.8C** | developer/system owner security analyst role will    |
|               | ensure that the procedures documented or referenced  |
|               | in the AM Plan are followed.**                       |
+---------------+------------------------------------------------------+
| **A           | **The AM Plan shall describe how the                 |
| MA_AMP.1.9C** | developer/system owner security analyst role will    |
|               | ensure that all developer/integrator actions         |
|               | involved in the analysis of the security impact of   |
|               | changes affecting the TOE are performed correctly.** |
+---------------+------------------------------------------------------+
| **AM          | **The AM Plan shall justify why the identified       |
| A_AMP.1.10C** | developer/system owner security analyst(s) have      |
|               | sufficient familiarity with the security target,     |
|               | functional specification and (where appropriate)     |
|               | high level design of the TOE, and with the           |
|               | evaluation results and all applicable assurance      |
|               | requirements for the certified version of the TOE.** |
+---------------+------------------------------------------------------+
| **AM          | **The AM Plan shall describe or reference the        |
| A_AMP.1.11C** | procedures to be applied to maintain the assurance   |
|               | in the TOE, which shall include the procedures for   |
|               | configuration management, maintenance of assurance   |
|               | evidence, performance of the analysis of the         |
|               | security impact of changes affecting the TOE, and    |
|               | flaw remediation.**                                  |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the information     |
| MA_AMP.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.                            |
+---------------+------------------------------------------------------+
| **A           | The evaluator shall confirm that the proposed        |
| MA_AMP.1.2E** | schedules for AM audits and re-evaluation of the TOE |
|               | are acceptable and consistent with the proposed      |
|               | changes to the TOE.                                  |
+---------------+------------------------------------------------------+

##  {#section-5 .unnumbered}

+---------------+------------------------------------------------------+
| #### TOE      |                                                      |
| component cat |                                                      |
| egorization r |                                                      |
| eport (AMA_CA |                                                      |
| T.1) {#toe-co |                                                      |
| mponent-categ |                                                      |
| orization-rep |                                                      |
| ort-ama_cat.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | **ACM_CAP.2 Configuration items**                    |
+---------------+------------------------------------------------------+
| **A           | **The developer/system owner shall provide a system  |
| MA_CAT.1.1D** | TOE component categorization report for the          |
|               | certified version of the system TOE.**               |
+---------------+------------------------------------------------------+
| **A           | **The TOE component categorization report shall      |
| MA_CAT.1.1C** | categorize each component of the system TOE,         |
|               | identifiable in each TSF representation from the     |
|               | most abstract to the least abstract, according to    |
|               | its relevance to security; system TOE component      |
|               | categorization must indicate whether the component   |
|               | is TSP-enforcing or non-TSP enforcing.**             |
+---------------+------------------------------------------------------+
| **AMA_CAT.    | **The system TOE component categorization report     |
| 1.2C**        | shall describe the categorization scheme used, so    |
|               | that it can be determined how to categorize new      |
|               | components introduce into the system TOE, and also   |
|               | when to re-categorize existing system TOE components |
|               | following changes to the system TOE or its security  |
|               | target.**                                            |
+---------------+------------------------------------------------------+
| **AMA_CAT.    | **The system TOE component categorization report     |
| 1.3C**        | shall identify any tools used in the development *or |
|               | operational* environment that, if modified, will     |
|               | have an impact on the assurance that the system TOE  |
|               | satisfies its security target.**                     |
+---------------+------------------------------------------------------+
| **AMA_CAT.    | **The evaluator shall confirm that the information   |
| 1.1E**        | provided meets all requirements for content and      |
|               | presentation of evidence.**                          |
+---------------+------------------------------------------------------+
| **AMA_CAT.    | **The evaluator shall confirm that the               |
| 1.2E**        | categorization of system TOE components and tools,   |
|               | and the categorization scheme used, are appropriate  |
|               | and consistent with the evaluation results for the   |
|               | certified version.**                                 |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #             |                                                      |
| ### Evidence  |                                                      |
| of maintenanc |                                                      |
| e process (AM |                                                      |
| A_EVD.1) {#ev |                                                      |
| idence-of-mai |                                                      |
| ntenance-proc |                                                      |
| ess-ama_evd.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | AMA_AMP.1 Assurance maintenance process              |
|               |                                                      |
|               | AMA_SIA.1 Sampling of security impact analysis       |
+---------------+------------------------------------------------------+
| **A           | **The developer/system owner security analyst shall  |
| MA_EVD.1.1D** | provide AM documentation for the current version of  |
|               | the TOE.**                                           |
+---------------+------------------------------------------------------+
| **A           | **The AM documentation shall include a configuration |
| MA_EVD.1.1C** | list that comprises the current version of the       |
|               | TOE.**                                               |
+---------------+------------------------------------------------------+
| **A           | **The configuration list shall describe the          |
| MA_EVD.1.2C** | configuration items that comprise the current        |
|               | version of the TOE.**                                |
+---------------+------------------------------------------------------+
| **A           | **The AM documentation shall provide evidence that   |
| MA_EVD.1.3C** | the procedures documented or referenced in the AM    |
|               | Plan are being followed.**                           |
+---------------+------------------------------------------------------+
| **A           | **The list of identified vulnerabilities in the      |
| MA_EVD.1.4C** | current version of the TOE shall show, for each      |
|               | vulnerability, that the vulnerability cannot be      |
|               | exploited in the intended environment for the TOE.** |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that the information   |
| MA_EVD.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.**                          |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that the procedures    |
| MA_EVD.1.2E** | documented or referenced in the AM Plan are being    |
|               | followed.**                                          |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that the security      |
| MA_EVD.1.3E** | impact analysis for the current version of the TOE   |
|               | is consistent with the configuration list.**         |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that all changes       |
| MA_EVD.1.4E** | documented in the security impact analysis for the   |
|               | current version of the TOE are within the scope of   |
|               | changes covered by the AM Plan.**                    |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that functional        |
| MA_EVD.1.5E** | testing has been performed on the current version of |
|               | the Toe, to a degree commensurate with the level of  |
|               | assurance being maintained.**                        |
+---------------+------------------------------------------------------+

+---------------+------------------------------------------------------+
| #### Sampli   |                                                      |
| ng of securit |                                                      |
| y impact anal |                                                      |
| ysis (AMA_SIA |                                                      |
| .1) {#samplin |                                                      |
| g-of-security |                                                      |
| -impact-analy |                                                      |
| sis-ama_sia.1 |                                                      |
|  .unnumbered} |                                                      |
+---------------+------------------------------------------------------+
| Dependencies: | AMA_CAT.1 TOE component categorization report        |
+---------------+------------------------------------------------------+
| **A           | **The developer/system owner security analyst shall, |
| MA_SIA.1.1D** | for the current version of the TOAE, provide a       |
|               | security impact analysis that covers all changes     |
|               | affecting the TOE as compared with the certified     |
|               | version.**                                           |
+---------------+------------------------------------------------------+
| **A           | **The security impact analysis shall identify the    |
| MA_SIA.1.1C** | certified TOE from which the current version of the  |
|               | TOE was derived.**                                   |
+---------------+------------------------------------------------------+
| **A           | **The security impact analysis shall identify all    |
| MA_SIA.1.2C** | new and modified TOE components that are categorised |
|               | as TSP-enforcing.**                                  |
+---------------+------------------------------------------------------+
| **A           | **The security impact analysis shall, for each       |
| MA_SIA.1.3C** | change affecting the security target or TSF          |
|               | representations, briefly describe the change and any |
|               | effects it has on lower representation levels.**     |
+---------------+------------------------------------------------------+
| **A           | **The security impact analysis shall, for each       |
| MA_SIA.1.4C** | change affecting the security target or TSF          |
|               | representations, identify all IT security functions  |
|               | and all TOE components categorised as TSF enforcing  |
|               | that are affected by the change.**                   |
+---------------+------------------------------------------------------+
| **A           | **The security impact analysis shall, for each       |
| MA_SIA.1.5C** | change which results in a modification of the        |
|               | implementation representation of the TSF or the IT   |
|               | environment, identify the test evidence that shows,  |
|               | to the required level of assurance, that the TSF     |
|               | continues to be correctly implemented following the  |
|               | change.**                                            |
+---------------+------------------------------------------------------+
| **A           | **The security impact analysis shall for each        |
| MA_SIA.1.6C** | applicable assurance requirements in the             |
|               | configuration management (ACM), life cycle support   |
|               | (ALC), delivery and operation (ADO), and guidance    |
|               | documents (AGD) assurance classes, identify any      |
|               | evaluation deliverables that have changed, and       |
|               | provide a brief description of each change and its   |
|               | impact on assurance.**                               |
+---------------+------------------------------------------------------+
| **A           | **The security impact analysis shall for each        |
| MA_SIA.1.7C** | applicable assurance requirement in the              |
|               | vulnerability assessment (AVA) assurance class,      |
|               | identify which evaluation deliverables have changed  |
|               | and which have not, and give reasons for the         |
|               | decision taken as to whether or not to update the    |
|               | deliverable.**                                       |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm that the information   |
| MA_SIA.1.1E** | provided meets all requirements for content and      |
|               | presentation of evidence.**                          |
+---------------+------------------------------------------------------+
| **A           | **The evaluator shall confirm, by sampling that the  |
| MA_SIA.1.2E** | security impact analysis documents changes to an     |
|               | appropriate level of detail, together with           |
|               | appropriate justifications that assurance has been   |
|               | maintained in the current version of the TOE.**      |
+---------------+------------------------------------------------------+

## Security Requirements for the IT Environment

The STOE has no requirements for the external IT environment, other than
those stipulated by the organizational security policies (refer to
section 3.3).

## Security Requirements for the Non-IT Environment

The STOE has no requirements for the external non-IT environment, other
than those stipulated by the organizational security policies (refer to
section 3.3).

# SPP Application Notes

This section of the document contains supporting information that will
be useful in developing more focused system protection profiles (SPPs)
or system security targets (SSTs) for specific classes of industrial
control systems, for example SCADA systems, or for specific applications
of industrial control systems.

## SPP Overview

### SPP Purpose

A System Protection Profile provides an implementation-independent set
of security requirements for a category of one or more systems. Unlike a
traditional Protection Profile (PP) that focuses on the IT security
requirements for a product, a SPP also captures management and
operational security requirements to ensure the overall effectiveness of
a system's security regime. Collectively, these requirements are
referred to as the technical, operational and management security
requirements of a system.

The term *system* is defined as the combination of physical, personnel,
procedures and processes (derived from the operational and management
security requirements) integrated with technology-based functions and
mechanisms (derived from the technical security requirements), applied
together to establish an acceptable level of residual risk in a defined
operational environment.

This SPP has documented the minimum set of security requirements
applicable to a generic industrial control system. However, while this
document has attempted to model a "generic" ICS, it is acknowledged that
not all security requirements will apply to all ICS instantiations.
Where compliance to a set of security requirements for a specific ICS is
required, another SPP should be written to address specific industry
needs. A discussion of this relationship between the SPP-ICS and further
SPPs and SSTs follows.

As shown by Figure 3 below, the SPP-ICS can be viewed as a high-level
object in an object-class hierarchy. In this case, the high-level object
is the SPP-ICS and lower-level objects can take the form of one or more
SPPs or SSTs.

![](media/image5.wmf)

Figure 3 - Relationship between SPP-ICS and other potential SPP\'s and
SST\'s

In the case of a lower-level SPP, one may use the security requirements
in the SPP-ICS as a baseline for further refinement. The end result will
produce an SPP addressing the security needs of a particular ICS type
(e.g. SCADA). Alternatively, an SST author may claim compliance to the
SPP-ICS by writing an SST based on the SPP-ICS. In this latter case, the
SST author should be aware that further refinement is still required to
claim conformance. Such refinements for either a lower-level SPP or a
compliant SST have been discussed later in this section.

Regardless of how the SPP-ICS is applied, the SPP-ICS has been developed
to be flexible and scalar in nature. That is, the SPP-ICS may be refined
to address an entire ICS system, or be refined to address the security
needs of specific subsystems commonly used in the process control
industry.

Finally, it is envisaged that the SPP-ICS will be used to help ensure
interoperability between process control systems, provide for a
consistent implementation of security controls across systems and
maintain a level of confidence in the security functions and mechanisms
used to protect ICS systems and their related assets.

### SPP Structure

The structure of the SPP-ICS has been developed following the
specification of protection profiles defined by the Common Criteria.
However, as the SPP-ICS is a *system* PP, the authors have extended the
specification to incorporate several differences unique to systems that
are not typically found in product-based protection profile
specifications. These differences, and their relationships to the main
elements defined by the SPP-ICS, have been captured below in Figure 4.

A discussion of each of the elements and their interrelationships in the
SPP-ICS is provided below. Please note that each of these elements
correspond to a different chapter in the SPP-ICS.

![](media/image6.wmf) Figure 4 -- SPP-ICS Structure

#### Security Environment (Chapter 3)

> The security environment describes the security aspects of the ICS
> operational environment. As for any CC-based specification, the
> SPP-ICS contains a statement of the assumptions, threats and
> organizational security policies applicable to the STOE. However, the
> SPP-ICS has expanded the definition of threats to include the
> following attributes:

-   **Threat Agents** conducting an attack against the assets protected
    by the STOE. A threat agent is characterized by the following:

    -   The level of **expertise** of the agent

    -   The **resources** available to the agent to stage the attack

    -   The **motivation** of the agent

-   An **attack** which is characterized by the following:

    -   The **method** used by the threat agent to perform the attack

    -   The **vulnerabilities** exploited to gain access to the
        protected assets

    -   The window of **opportunity** open to the threat agent to
        conduct the attack

-   The **asset** (protected by the STOE) that is subject to the attack

> This approach to specifying the threats reduces ambiguity. It also
> allows the SST author to thoroughly understand the nature of the
> threat so that a variety of security controls can be deployed to
> counter the threat.

#### Security Risks (Chapter 4)

The security risks are a further instantiation of the security problem.
The element of risk is captured by the SPP-ICS to determine the relative
importance of the security needs of the STOE and its operating
environment. They also guide the specification of the security
objectives by ensuring that only those security needs seen as critical
to the organization are addressed by the STOE or its operating
environment.

Each risk is a product of asset value, assessed level of relevant
threats, and associated vulnerabilities (as identified by the security
environment). It represents the potential that a given threat will
exploit vulnerabilities to cause loss or damage to an asset or group of
assets, and hence directly or indirectly to the organization responsible
for the ICS.

Please note that the SPP-ICS has only listed the categories of risks
applicable to a generic ICS. Guidance on the identification of the risks
within these categories can be found in section 7.3.2.1.

#### Security Objectives (Chapter 5)

The security objectives are a concise statement of the intended response
to the security problem. In order to ensure a cost-effective system
design, the inclusion of any security objective should be based on the
outcomes of a risk assessment. For the purposes of the SPP-ICS, it is
assumed that the owner of the ICS has a well-developed risk management
process capable of identifying the risks to the ICS assets. Once
identified, the risks should be prioritized and the organization's
management should determine how best to treat those risks of high
importance. Once this has been decided, any treatment strategies
(including the specification of additional security controls needed to
mitigate the risk) should be represented in the statement of the
security objectives.

#### Security Requirements (Chapter 6)

The security requirements define both the functional and assurance
security requirements that the STOE and the supporting evidence for its
evaluation need to satisfy in order to meet the security objectives.
Once specified, the security requirements then determine the selection
of security controls required to ensure the protection of the STOE
assets.

The SPP-ICS has included security functional requirements and security
assurance requirements that extend ISO 15408 to cover issues associated
with systems. These extensions are based on current ISO subcommittee
work to extend ISO 15408 to cover the accreditation of systems and the
evaluation of system protection profiles and system security targets.
These extensions broaden consideration of security controls to include
non-technical controls based on procedural and management functions.

#### Security Controls

The selection of appropriate security controls is driven by the
specification of the STOE security requirements. Security controls are
the management, operational, and technical safeguards and
countermeasures prescribed for an information system which, taken
together, adequately protect the confidentiality, integrity, and
availability of the system and its information. Please note that the
selection of security controls is not performed during an SPP. Rather,
the selection of controls is left to the discretion of the SST author
(refer to section 7.4.1.1 for guidance).

### SPP Application

As discussed above, the SPP-ICS has been developed to capture the
"generic" security needs of the process control industry. In doing so,
it is expected that the SPP-ICS will be updated as it is applied in
practice. This may include further instantiations of the SPP-ICS to
address the needs of specific ICS types, such as those related to SCADA
systems.

## SPP Application: Risk Management

Risk management is recognized as an integral part of good management
practice. It is an iterative process consisting of steps, which, when
undertaken in sequence, enable continual improvement in decision making
to meet the business needs of an organization.

Generally, information security risk management methods and techniques
are applied to complete information systems and facilities, but they can
also be directed to individual system components or services where this
is practicable, realistic and helpful.

The risk management process involves establishing the context,
identifying, analyzing, evaluating, treating, communicating and
monitoring of risks. Each of these stages of the process should be
performed in parallel to the SPP or SST development.

Importantly, the risk management process should be applied at all stages
in the life cycle of a product or system. The following section has been
included to equip the SPP reader with a brief understanding of the risk
management process. The terminology defined in the next section is used
throughout the remainder of the application notes.

### Risk Management Process

Several forms of the risk management process for IT systems have been
adopted by industry (e.g. NIST Special Publication 800-30). Many of
these processes follow a common approach in addressing information
security risk in systems. A summary of the approach includes the
following steps (as illustrated by Figure 5):

#### Context Establishment

Establishes the strategic, organizational and risk management context in
which the rest of the process will take place. Includes characterizing
the system with respect to its boundaries, functions, data criticality
and data sensitivity.

#### Risk Identification

Identify what, where and how things can arise as the basis for further
analysis.

#### Risk Assessment

Assessment of risks enables an organization to determine which risks can
be accepted and which risks require controls to reduce them. ISO 17799
and NIST Special Publication 800-53 establish a code of practice for
selecting information security controls.

##### Risk Analysis

Determine the existing controls and analyze risks in terms of impact and
likelihood in the context of these controls. The analysis should
consider the range of potential impact and how likely those impacts are
to occur. Impact and likelihood are typically combined to produce an
estimated level of risk.

Analysis of risks depends on the following factors:

-   The nature of the business information and systems

-   The business purpose for which the information is going to be used

-   The environment in which the system is used and operated

-   The protection provided by the controls in place.

##### Risk Evaluation

Compare estimated levels of risk against pre-established criteria. This
enables risks to be ranked so as to identify management priorities. If
the levels of risk established are low, then risks may fall into an
acceptable category and treatment may not be required.

#### Risk Treatment

Accept and monitor low‑priority risks. For other risks, develop and
implement a specific risk management plan with the ultimate goal of
reducing the level of risk down to an acceptable level (through the
application of one or more technical, management or operational
controls). The resultant risk (after security controls have been
applied) is referred to as the residual risk.

Options for risk treatment (which are not necessarily mutually exclusive
or appropriate in all circumstances), include the following:

-   Risk Avoidance: risks can be avoided by deciding not to process with
    the activity likely to generate the risk (where this is practicable)

-   Reduction of Likelihood: the likelihood of occurrence of risk events
    may be reduced by reducing threats or vulnerabilities through the
    application of security controls

-   Reduction of Impact: the impacts of risk events may be reduced by
    reducing threats or vulnerabilities through the application of
    security controls or modification of the assets at risk in some
    other way

-   Risk Transference: transfer the risk (in whole or part) to other
    parties (e.g. insurance agencies)

-   Risk Retention: after unacceptable risks have been reduced or
    transferred, residual risks may be retained

#### Monitor and review

Monitor and review the performance of the risk management system and
changes that might affect it. Monitor residual risks in accordance with
a risk management plan.

#### Communicate and consult

Communicate and consult with internal and external stakeholders as
appropriate at each stage of the risk management process and concerning
the process as a whole.

The following figure illustrates the logical flow of the risk management
process:

![](media/image7.wmf)

Figure 5 -- Overview of the Risk Management Process

Please note that the risk management process outlined above should not
replace an organization's own risk management methodology. This model
has only been included to illustrate the relationship of the main
elements of the risk management process to the SPP-ICS.

## SPP Application: SPP

This section provides guidance on how to refine the SPP-ICS into further
SPP's for specific ICS systems (e.g. SCADA systems).

### Refinement of the Security Environment

#### Assumptions, Threats and OOSPs

> Due to the high-level nature of the SPP-ICS, it was difficult to
> specify detailed assumptions for a generic ICS implementation, as the
> operational environment is relatively diverse amongst the different
> process industry sectors. Using the included assumptions as a guide,
> the SPP author should make a concerted effort to ensure that the
> assumptions about the security aspects of the environment and/or the
> manner in which the STOE is intended to be used are clearly defined.
>
> Conversely, the statement of threats in the SPP-ICS covers a broad
> range of threats against the confidentiality, integrity and
> availability of the STOE. It is noted that not all of these threats
> may be applicable to the STOE. The SPP author should first seek to
> confirm whether all of the threat components (i.e. threat agent, the
> attack and asset) are applicable to their operational environment.
> Organizations with a well-developed risk management process will have
> a better indication of whether or not these variables are applicable
> to their ICS' operational environment. Therefore, it is recommended
> that the validation of threats be performed against the results of
> previous risk assessments, security audits etc that have previously
> identified and assessed the types of threats relevant to the ICS.
>
> The overarching organizational security policies (OOSPs) common to
> most organizations within the process industry have been included in
> the SPP. The SPP author should ensure that these cover both the
> security policies of the organization with responsibility of operating
> the ICS, as well as those for any external organizations interfacing
> with the ICS.

#### System Assets

The system assets protected by the STOE include:

-   Physical and logical components of the ICS itself (e.g. actuator,
    controller, HMI, etc)

-   Remote diagnostics and maintenance services and supporting
    mechanisms

-   Communications Infrastructure services and technology

-   The process subject to control by the ICS

-   Process control information

-   Process control business or financial information

These asset groupings address the most critical parts of any ICS.
However, they are generic in nature and should be refined in accordance
with the ICS type. For example, a SCADA implementation may warrant the
explicit definition of the Central Monitoring System (CMS) and the
components housed within the control room.

Example asset categories that should be considered when developing a
specific SPP include:

-   Information assets: databases and data files, voice records, image
    files, system documentation, user manuals, training material,
    operational or support procedures, continuity plans, fallback
    arrangements;

-   Paper documents: contracts, guidelines, company documentation,
    documents containing important business or financial data;

-   Software assets: application software, system software, development
    tools and utilities;

-   Physical assets: computer and communications equipment, magnetic
    media (tapes and disks), other technical equipment (power supplies,
    air ­conditioning units), furniture, accommodation;

-   Marketing assets: company image and reputation; and

-   Services: computing and communications services, other technical
    services (heating, lighting, power, air‑conditioning).

#### Vulnerability and Threat Analysis

A vulnerability and/or threat analysis is typically performed during the
risk analysis stage of a risk assessment. The SPP author should use the
results of any vulnerability or threat analyses applicable to the ICS to
confirm the list of vulnerabilities and threats in the SPP-ICS, and
refine the definitions as appropriate. Threats and vulnerabilities not
applicable to the STOE operating environment may be removed from the
SPP. Please note that a relationship exists between a vulnerability and
a threat. The SPP author should exercise caution when removing a threat
to ensure that it's corresponding vulnerability is still exploitable by
another threat.

### Risk Identification

#### Identification of Risks to the System

The SPP-ICS has only focused on the categories of risks applicable to a
generic ICS. The SPP author should use each category as a guide when
performing risk identification. The following categories of risk have
been included:

-   Management of the security infrastructure (RISK.MANAGE)

-   Development and implementation of Security Policies (RISK.SECPOLICY)

-   Management of the risk assessment process (RISK.RISKMAN)

-   Compliance with internal, legal and statutory requirements
    (RISK.COMPLY)

-   Asset classification and control (RISK.ASSETCTRL)

-   Personnel security (RISK.PERSONNEL)

-   Physical security (RISK.PHYSICAL)

-   Impact of natural disasters (RISK.ENVIRON)

-   Illegal access to ICS components (RISK.EVIL_ACCESS)

-   Confidentiality of information (RISK.NEED2KNOW)

-   Integration of security requirements (RISK.INTEGRATE)

-   Protection of network communications (RISK.NETCOMMS)

-   Connection of IT systems (RISK.CONNECT)

-   Use of Internet and email services (RISK.INTERNET)

-   Remote access to the ICS network (RISK.REMOTE)

-   Delivery of online services in support of ICS operation
    (RISK.ONLINE)

-   Operational management (RISK.OPSMANAGE)

-   Monitoring and detection of security breeches (RISK.IDS)

-   Continuity of ICS operations (RISK.CONTINUITY)

    Obviously, not all of the categories will apply to all ICS types.
    For example, RISK.REMOTE will not apply to those organizations that
    do not allow users to connect remotely to the ICS. The technique
    used by the SPP author to identify the risks (and other risk-related
    activities) should be in accordance with the organization's risk
    management policy.

    Once the risk identification is complete, the SPP author may then
    complete the risk analysis by determining the level of risk
    (following the risk assessment process adopted by the organization).
    Once the risks have been evaluated and prioritized the SPP author
    should obtain management endorsement so that treatment strategies
    for the critical and other important risks can be developed and
    captured in the SPP. After the risks and their treatment strategies
    have been endorsed, the SPP author has a set of risks capable of
    guiding the selection of the security objectives (see next section).
    The treatment strategies may also be used to guide the selection of
    security controls in an SST (refer to section 7.4.1).

#### Prior Risk Assessment

Ideally, a risk assessment should be performed prior to SPP development.
However, tight schedules and economic constraints may prevent this from
happening in practice. Therefore, one cannot always assume that a risk
assessment has been conducted, nor assume that the allocation of
security controls (which are selected to meet the security requirements)
for the system has been prioritized in accordance with the
organization's security and/or risk management policies.

Assuming that a risk assessment has been conducted, the results of the
risk assessment can be used to help refine the various sections of the
SPP-ICS, including:

-   The system context of the risk assessment can be used to help refine
    the STOE description, including the boundaries and security features
    implemented by the system (defined in chapter 2 of the SPP-ICS)

-   The results of the risk analysis, such as threat and vulnerability
    assessments, can be used to ensure that all the relevant threats to
    the assets have been captured in the STOE operational environment
    (defined in chapter 3 of the SPP-ICS)

-   The security requirements for confidentiality, integrity and system
    availability defined by the risk assessment can be used to extract a
    set of requirements to be met by the system that are consistent with
    the business needs of the organization (defined in chapter 6 of the
    SPP-ICS)

-   The security objectives of the system can be refined by focusing on
    the greatest areas of risk, or those residual risks that need to be
    monitored in accordance with the organizational risk management plan
    (defined in chapter 5 of the SPP-ICS)

As can be seen from the above points, there are significant advantages
in having a risk assessment conducted prior to SPP development.
Therefore, the SPP author should ensure that the results of previous
risk assessments are used as input during the development of the SPP.

### Refinement of the Security Objectives

The security objectives in the SPP-ICS have been selected based on the
needs of the process control industry. However, as mentioned in section
7.3.2.1, the set of security objectives should be driven by the
organizational \[prioritized\] need to mitigate identified risk.
Ideally, the SPP author can reference previous risk assessments to
determine the risks considered critical to the secure operation of the
STOE and the protection of its assets. These risks should be used to
determine the selection of the security objectives.

The SPP author may refine, modify or remove any security objective that
does complement the security functionality supported by the ICS,
provided that all of the risks corresponding to that objective have been
satisfied by another security objective. Further, the SPP author should
not feel obligated to keep those security objectives that do not
contribute to the mitigation of the identified risks.

In the scenario that an identified risk to the organization is not
mitigated by an STOE security objective, the SPP author may defer the
treatment of that risk to the STOE external operating environment. The
external operating environment is defined as everything outside the
scope and boundary of the STOE, as defined by the STOE Description.
Specification of security objectives on the external operating
environment will differ for each ICS implementation given the diverse
nature of the process control industry.

### Refinement of the IT Security Requirements

A significant number of security assurance and functional requirements
have been included in the SPP-ICS. This is due to the complicated nature
of system security specification. However, not all requirements will be
relevant to every ICS implementation. Therefore, the SPP author should
use discretion when selecting the requirements for their STOE, and be
guided by the security objectives (which are, in turn, guided by the
identified risks to the system). Specifying too many security
requirements may result in a costly and time-consuming process should
the STOE undergo formal evaluation or security audit against the SPP
security requirements.

The SPP author should also ensure that all operations on the security
functional requirements have been completed.

### Supporting Rationale

#### Security Risks Rationale

The security risks rationale is an extension to the standard PP
specification. It is included in the SPP-ICS to demonstrate that the
identified risks of the STOE are relevant to the security problem. This
is achieved by extracting the identified threats, vulnerabilities and
assets from the security environment and mapping them to one or more
risk categories. If at least one asset, threat and vulnerability
combination can map to one or more risk categories then the security
risks are an accurate and complete representation of the security
problem.

As mentioned in section 7.3.2.1, the SPP author should use the risk
categories as guidance to complement the risk identification phase of
the ICS risk assessment. Once the risk identification is complete, the
SPP author should ensure that every risk is a product of the threat,
vulnerability and asset combination. This may also require modification
to the security environment to ensure consistency between the SPP
sections.

Please note that arguments for the sufficiency of the security risks
addressing the identified threats, vulnerabilities and assets should
also be completed in the security risks rationale.

#### Security Objectives Rationale

The security objectives rationale has also been extended to cover the
integration of risk. Specifically, the security objectives rationale
must demonstrate that the security objectives are sufficient to meet the
identified risks to the STOE. This is achieved by showing that at least
one risk maps to one or more security objectives.

Please note that arguments for the sufficiency of the security
objectives mitigating the identified risks to the STOE should also be
completed in the security objectives rationale.

## SPP Application: SST

This section provides guidance on how to claim conformance to the
SPP-ICS for specific ICS systems. Please note that the guidance for "SPP
Application: SPP" in section 7.3 is also relevant to an SST. Therefore,
this section has only focused on those areas of an SST not already
addressed by the previous section.

### STOE Summary Specification

#### Selection of Controls 

Security controls are included in the SST to satisfy the security
functional and assurance requirements. It is beyond the scope of this
document to provide guidance on the selection of security controls.
However, it is strongly recommended that the SPP author refer to
'pre-defined' libraries or catalogues of security controls to ensure
that an adequate selection of technical, management and operational
controls are included in the SST. Recommended security control
catalogues include ISO 17799 and NIST Special Publication 800-53.

It is worth noting that the term 'security control' is equivalent to the
term 'security function' used by the CC. However, whereas the focus on
the CC is to specify IT-based security functions (aka TOE security
functions), the application of the CC to systems has also introduced the
notion of non-IT security functions to ensure the correct management and
operation of the STOE. For the sake of consistency with other industry
standards (e.g. NIST Special Publications 800-53 and 800-30), security
functions should be referred to as security controls in an SST. In
addition, security controls should be categorized as either technical,
management or operational in nature.

#### Selection of Assurance Measures

The assurance measures are included in the SST to satisfy the security
assurance requirements. SST authors should note that the assurance
requirements (and the functional requirements) included in the SPP-ICS
are an extension to the CC to address the security needs of systems.
Therefore, the selection of assurance measures is likely to be derived
(in part) from management and operational security controls.

### SPP Claims

#### Conformance to the SPP-ICS

SST authors should note that conformance to the SPP-ICS requires a
significant amount of refinement to the existing SPP-ICS content. This
is because in an SPP not all aspects of the operational environment are
known, and as a consequence a risk analysis cannot be completed (only
the categories of risk have been identified in the SPP-ICS). Therefore,
it is recommended that SST authors refine the SPP content prior to
developing the SST content. Guidance on how to refine the SPP has been
included throughout this chapter.

### Supporting Rationale

Application guidance on the completion and/or refinement of the
rationale has been included in section 7.3.5. However, since security
controls are only relevant to an SST, additional guidance is provided
below.

#### STOE Summary Specification Rationale

In a product evaluation, the ST author must demonstrate that the IT
security functions contribute to the satisfaction of one or more
security functional requirements. While the approach is identical for an
STOE, the following points should be noted:

-   IT security functions are referred to as security controls in an
    STOE.

-   Security controls are classified as either technical, management or
    operational in nature. All three types of security controls are
    usually required to satisfy a security requirement, although this is
    left to the discretion of the SST author.

#  {#section-6 .unnumbered}

# Rationale

## Security Risks Rationale

The purpose of this rationale is to demonstrate that the identified
security risks are suitable, that is they are sufficient to address the
security needs, and that they are necessary, ie, there are no redundant
security risks.

### All Assets, Threats and Vulnerabilities Addressed

The need to demonstrate that there are no redundant security risks is
satisfied as follows:

-   The first section (Table 14) shows that all of the assets, threats
    to security, and vulnerabilities have been addressed.

-   The second section (Table 15) shows that each security risk
    addresses at least one assumption, policy, and threat combination.

[]{#__RefHeading___Toc69732178 .anchor}Table 14 - Mapping of Assets,
Threats and Vulnerabilities to Security Risks

+-------------------------------------+--------------------------------+
| > **Asset/Threat/Vulnerability      | > **Associated Security Risk** |
| > Label**                           |                                |
+=====================================+================================+
| > A.ACTUATOR                        | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.PHYSICAL                   |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > T.BAD_COMMAND                     | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.IDS                        |
+-------------------------------------+--------------------------------+
| > V.PLAINTEXT                       | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NEED2KNOW                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > A.SENSOR                          | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.COMPLY                     |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.PHYSICAL                   |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.IDS                        |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > T.REPUDIATE                       | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.IDS                        |
+-------------------------------------+--------------------------------+
| > V.SERVICES                        | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NEED2KNOW                  |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.IDS                        |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > A.CONTROLLER                      | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.COMPLY                     |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.PHYSICAL                   |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.IDS                        |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > T.PRIVILEGE                       | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
+-------------------------------------+--------------------------------+
| > V.REMOTE                          | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NEED2KNOW                  |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > A.HMI                             | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.COMPLY                     |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.PHYSICAL                   |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.IDS                        |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > T.NO_FAULT_RECORD                 | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.IDS                        |
+-------------------------------------+--------------------------------+
| > V.ARCHITECTURE                    | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.COMPLY                     |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.PHYSICAL                   |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NEED2KNOW                  |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > A.REMOTE                          | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.COMPLY                     |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.PHYSICAL                   |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > T.INFECTION                       | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > V.NOPOLICIES                      | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.COMPLY                     |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.PHYSICAL                   |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > A.COMMS                           | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.COMPLY                     |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.PHYSICAL                   |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > T.DISCLOSURE                      | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NEED2KNOW                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
+-------------------------------------+--------------------------------+
| > V.NOTRAINING                      | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.COMPLY                     |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.PHYSICAL                   |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > A.CTRLPROCESS                     | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.COMPLY                     |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > T.EVIL_ANALYSIS                   | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NEED2KNOW                  |
+-------------------------------------+--------------------------------+
| > V.3RDPARTY                        | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.COMPLY                     |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NEED2KNOW                  |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > A.CTRLINFO                        | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.COMPLY                     |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NEED2KNOW                  |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > T.PHYSICAL_ACCESS                 | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.PHYSICAL                   |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > V.NORISK                          | > R.MANAGE                     |
|                                     | >                              |
|                                     | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.COMPLY                     |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.IDS                        |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.PHYSICAL                   |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NEED2KNOW                  |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > C.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
+-------------------------------------+--------------------------------+
| > A.BUSINFO                         | > R.SECPOLICY                  |
|                                     | >                              |
|                                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.COMPLY                     |
|                                     | >                              |
|                                     | > R.ASSETCTRL                  |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NEED2KNOW                  |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > T.DISASTER                        | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
+-------------------------------------+--------------------------------+
| > V.SPOF                            | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.ENVIRON                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.INTEGRATE                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTER.ONLINE             |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > T.EVIL_MOD                        | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
+-------------------------------------+--------------------------------+
| > T.EVIL_DESTRUCTION                | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > T.CTRL_TAMPER                     | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+
| > T.SPOOF                           | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.PERSONNEL                  |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NEED2KNOW                  |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
+-------------------------------------+--------------------------------+
| > T.DOS                             | > R.RISKMAN                    |
|                                     | >                              |
|                                     | > R.EVIL_ACCESS                |
|                                     | >                              |
|                                     | > R.NETCOMMS                   |
|                                     | >                              |
|                                     | > R.CONNECT                    |
|                                     | >                              |
|                                     | > R.INTERNET                   |
|                                     | >                              |
|                                     | > R.REMOTE                     |
|                                     | >                              |
|                                     | > R.ONLINE                     |
|                                     | >                              |
|                                     | > R.OPSMANAGE                  |
|                                     | >                              |
|                                     | > R.CONTINUITY                 |
+-------------------------------------+--------------------------------+

Table 15 shows that there are no unnecessary IT security risks.

[]{#__RefHeading___Toc69732179 .anchor}Table 15 - Mapping of Security
Risks to Assets, Threats and Vulnerabilities

+-----------------+------------------+--------------+-----------------+
| > **Risk        | > **Threats**    | > **Vulne    | > **Assets**    |
| > Category      |                  | rabilities** |                 |
| > Label**       |                  |              |                 |
+=================+==================+==============+=================+
| >               | > T.BAD_COMMAND, | >            | >               |
| **RISK.MANAGE** | > T.REPUDIATE,   | V.PLAINTEXT, | ASSET.ACTUATOR, |
|                 | > T.PRIVILEGE,   | >            | > ASSET.SENSOR, |
|                 | > T.             |  V.SERVICES, | > AS            |
|                 | NO_FAULT_RECORD, | > V.REMOTE,  | SET.CONTROLLER, |
|                 |                  | > V.A        | > ASSET.HMI,    |
|                 |                  | RCHITECTUREV | > ASSET.REMOTE, |
|                 |                  | .NOPOLICIES, | > ASSET.COMMS,  |
|                 |                  | > V          | > AS            |
|                 |                  | .NOTRAINING, | SET.CTRLPROCESS |
|                 |                  | > V.3RDPARTY |                 |
|                 |                  | > V.NORISK   |                 |
+-----------------+------------------+--------------+-----------------+
| > **R           | > T.BAD_COMMAND, | >            | >               |
| ISK.SECPOLICY** | > T.REPUDIATE,   | V.PLAINTEXT, | ASSET.ACTUATOR, |
|                 | > T.PRIVILEGE,   | >            | > ASSET.SENSOR, |
|                 | > T.             |  V.SERVICES, | > AS            |
|                 | NO_FAULT_RECORD, | > V.REMOTE,  | SET.CONTROLLER, |
|                 | > T.INFECTION    | > V.A        | > ASSET.HMI,    |
|                 |                  | RCHITECTUREV | > ASSET.REMOTE, |
|                 |                  | .NOPOLICIES, | > ASSET.COMMS,  |
|                 |                  | > V          | > ASS           |
|                 |                  | .NOTRAINING, | ET.CTRLPROCESS, |
|                 |                  | > V.3RDPARTY | >               |
|                 |                  | > V.NORISK   | ASSET.CTRLINFO, |
|                 |                  |              | > ASSET.BUSINFO |
+-----------------+------------------+--------------+-----------------+
| > *             | > T.DISCLOSURE,  | >            | >               |
| *RISK.RISKMAN** | >                | V.PLAINTEXT, | ASSET.ACTUATOR, |
|                 | T.EVIL_ANALYSIS, | >            | > ASSET.SENSOR, |
|                 | > T.EV           |  V.SERVICES, | > AS            |
|                 | IL_MODIFICATION, | > V.REMOTE,  | SET.CONTROLLER, |
|                 | > T.E            | > V.A        | > ASSET.HMI,    |
|                 | VIL_DESTRUCTION, | RCHITECTURE, | > ASSET.REMOTE, |
|                 | > T.CTRL_TAMPER, | > V.SPOF,    | > ASSET.COMMS,  |
|                 | > T.BAD_COMMAND, | > V          | > ASS           |
|                 | > T.SPOOF,       | .NOPOLICIES, | ET.CTRLPROCESS, |
|                 | > T.REPUDIATE,   | > V          | >               |
|                 | > T.DOS,         | .NOTRAINING, | ASSET.CTRLINFO, |
|                 | > T.PRIVILEGE,   | > V.3RDPARTY | > ASSET.BUSINFO |
|                 | > T.             | > V.NORISK   |                 |
|                 | NO_FAULT_RECORD, |              |                 |
|                 | > T.DISASTER,    |              |                 |
|                 | > T.INFECTION,   |              |                 |
|                 | > T              |              |                 |
|                 | .PHYSICAL_ACCESS |              |                 |
+-----------------+------------------+--------------+-----------------+
| >               | > TBD            | > V.A        | >               |
| **RISK.COMPLY** |                  | RCHITECTUREV | ASSET.ACTUATOR, |
|                 |                  | .NOPOLICIES, | > ASSET.SENSOR, |
|                 |                  | > V          | > AS            |
|                 |                  | .NOTRAINING, | SET.CONTROLLER, |
|                 |                  | > V.3RDPARTY | > ASSET.HMI,    |
|                 |                  | > V.NORISK   | > ASSET.REMOTE, |
|                 |                  |              | > ASSET.COMMS,  |
|                 |                  |              | > ASS           |
|                 |                  |              | ET.CTRLPROCESS, |
|                 |                  |              | >               |
|                 |                  |              | ASSET.CTRLINFO, |
|                 |                  |              | > ASSET.BUSINFO |
+-----------------+------------------+--------------+-----------------+
| > **R           | > T.REPUDIATE,   | >            | >               |
| ISK.ASSETCTRL** | > T.PRIVILEGE,   | V.PLAINTEXT, | ASSET.ACTUATOR, |
|                 | > T.INFECTION,   | >            | > ASSET.SENSOR, |
|                 | > T              |  V.SERVICES, | > AS            |
|                 | .PHYSICAL_ACCESS | > V.REMOTE,  | SET.CONTROLLER, |
|                 |                  | > V.         | > ASSET.HMI,    |
|                 |                  | ARCHITECTURE | > ASSET.REMOTE, |
|                 |                  | > V          | > ASSET.COMMS,  |
|                 |                  | .NOPOLICIES, | > ASS           |
|                 |                  | > V          | ET.CTRLPROCESS, |
|                 |                  | .NOTRAINING, | >               |
|                 |                  | > V.3RDPARTY | ASSET.CTRLINFO, |
|                 |                  | > V.NORISK   | > ASSET.BUSINFO |
+-----------------+------------------+--------------+-----------------+
| > **R           | > T.BAD_COMMAND, | >            | >               |
| ISK.PERSONNEL** | > T.SPOOF,       | V.PLAINTEXT, | ASSET.ACTUATOR, |
|                 | > T.REPUDIATE,   | >            | > ASSET.SENSOR, |
|                 | > T.PRIVILEGE,   |  V.SERVICES, | > AS            |
|                 | > T.             | > V.REMOTE,  | SET.CONTROLLER, |
|                 | NO_FAULT_RECORD, | > V.A        | > ASSET.HMI,    |
|                 | > T.DISASTER,    | RCHITECTURE, | > ASSET.REMOTE, |
|                 | > T.INFECTION,   | > V.SPOF,    | > ASSET.COMMS,  |
|                 | > T              | > V          | > ASS           |
|                 | .PHYSICAL_ACCESS | .NOPOLICIES, | ET.CTRLPROCESS, |
|                 |                  | > V          | >               |
|                 |                  | .NOTRAINING, | ASSET.CTRLINFO, |
|                 |                  | > V.3RDPARTY | > ASSET.BUSINFO |
|                 |                  | > V.NORISK   |                 |
+-----------------+------------------+--------------+-----------------+
| > **            | > T              | > V.A        | >               |
| RISK.PHYSICAL** | .PHYSICAL_ACCESS | RCHITECTUREV | ASSET.ACTUATOR, |
|                 |                  | .NOPOLICIES, | > ASSET.SENSOR, |
|                 |                  | > V          | > AS            |
|                 |                  | .NOTRAINING, | SET.CONTROLLER, |
|                 |                  | > V.NORISK   | > ASSET.HMI,    |
|                 |                  |              | > ASSET.REMOTE, |
|                 |                  |              | > ASSET.COMMS   |
+-----------------+------------------+--------------+-----------------+
| > *             | > T.DISASTER     | > V.ARCHITE  | >               |
| *RISK.ENVIRON** |                  | CTUREV.SPOF, | ASSET.ACTUATOR, |
|                 |                  | > V          | > ASSET.SENSOR, |
|                 |                  | .NOPOLICIES, | > AS            |
|                 |                  | > V          | SET.CONTROLLER, |
|                 |                  | .NOTRAINING, | > ASSET.HMI,    |
|                 |                  | > V.NORISK   | > ASSET.REMOTE, |
|                 |                  |              | > ASSET.COMMS,  |
|                 |                  |              | > ASS           |
|                 |                  |              | ET.CTRLPROCESS, |
|                 |                  |              | >               |
|                 |                  |              | ASSET.CTRLINFO, |
|                 |                  |              | > ASSET.BUSINFO |
+-----------------+------------------+--------------+-----------------+
| > **RIS         | > T.DISCLOSURE,  | >            | >               |
| K.EVIL_ACCESS** | >                | V.PLAINTEXT, | ASSET.ACTUATOR, |
|                 | T.EVIL_ANALYSIS, | >            | > ASSET.SENSOR, |
|                 | > T.EV           |  V.SERVICES, | > AS            |
|                 | IL_MODIFICATION, | > V.REMOTE,  | SET.CONTROLLER, |
|                 | > T.E            | > V.A        | > ASSET.HMI,    |
|                 | VIL_DESTRUCTION, | RCHITECTURE, | > ASSET.REMOTE, |
|                 | > T.CTRL_TAMPER, | > V.SPOF,    | > ASSET.COMMS,  |
|                 | > T.BAD_COMMAND, | > V          | > ASS           |
|                 | > T.SPOOF,       | .NOPOLICIES, | ET.CTRLPROCESS, |
|                 | > T.REPUDIATE,   | > V          | >               |
|                 | > T.DOS,         | .NOTRAINING, | ASSET.CTRLINFO, |
|                 | > T.PRIVILEGE,   | > V.3RDPARTY | > ASSET.BUSINFO |
|                 | > T              | > V.NORISK   |                 |
|                 | .NO_FAULT_RECORD |              |                 |
+-----------------+------------------+--------------+-----------------+
| > **R           | > T.DISCLOSURE,  | >            | > ASSET.REMOTE, |
| ISK.NEED2KNOW** | >                | V.PLAINTEXT, | > ASSET.COMMS,  |
|                 | T.EVIL_ANALYSIS, | >            | > ASS           |
|                 | > T.SPOOF,       |  V.SERVICES, | ET.CTRLPROCESS, |
|                 | > T.PRIVILEGE    | > V.REMOTE,  | >               |
|                 |                  | > V.A        | ASSET.CTRLINFO, |
|                 |                  | RCHITECTUREV | > ASSET.BUSINFO |
|                 |                  | .NOPOLICIES, |                 |
|                 |                  | > V          |                 |
|                 |                  | .NOTRAINING, |                 |
|                 |                  | > V.3RDPARTY |                 |
|                 |                  | > V.NORISK   |                 |
+-----------------+------------------+--------------+-----------------+
| > **R           | > TBD            | >            | >               |
| ISK.INTEGRATE** |                  |  V.SERVICES, | ASSET.ACTUATOR, |
|                 |                  | > V.REMOTE,  | > ASSET.SENSOR, |
|                 |                  | > V.A        | > AS            |
|                 |                  | RCHITECTURE, | SET.CONTROLLER, |
|                 |                  | > V.SPOF,    | > ASSET.HMI,    |
|                 |                  | > V          | > ASSET.REMOTE, |
|                 |                  | .NOPOLICIES, | > ASSET.COMMS,  |
|                 |                  | > V          | > ASS           |
|                 |                  | .NOTRAINING, | ET.CTRLPROCESS, |
|                 |                  | > V.3RDPARTY | >               |
|                 |                  | > V.NORISK   | ASSET.CTRLINFO, |
|                 |                  |              | > ASSET.BUSINFO |
+-----------------+------------------+--------------+-----------------+
| > **            | > T.DISCLOSURE,  | >            | >               |
| RISK.NETCOMMS** | >                | V.PLAINTEXT, | ASSET.ACTUATOR, |
|                 | T.EVIL_ANALYSIS, | >            | > ASSET.SENSOR, |
|                 | > T.CTRL_TAMPER, |  V.SERVICES, | > AS            |
|                 | > T.SPOOF,       | > V.REMOTE,  | SET.CONTROLLER, |
|                 | > T.DOS,         | > V.A        | > ASSET.HMI,    |
|                 | > T.             | RCHITECTURE, | > ASSET.REMOTE, |
|                 | NO_FAULT_RECORD, | > V.SPOF,    | > ASSET.COMMS,  |
|                 | > T.INFECTION,   | > V          | > ASS           |
|                 | > T              | .NOPOLICIES, | ET.CTRLPROCESS, |
|                 | .PHYSICAL_ACCESS | > V          | >               |
|                 |                  | .NOTRAINING, | ASSET.CTRLINFO, |
|                 |                  | > V.3RDPARTY | > ASSET.BUSINFO |
|                 |                  | > V.NORISK   |                 |
+-----------------+------------------+--------------+-----------------+
| > *             | > T.DISCLOSURE,  | >            | >               |
| *RISK.CONNECT** | >                | V.PLAINTEXT, | ASSET.ACTUATOR, |
|                 | T.EVIL_ANALYSIS, | >            | > ASSET.SENSOR, |
|                 | > T.EV           |  V.SERVICES, | > AS            |
|                 | IL_MODIFICATION, | > V.REMOTE,  | SET.CONTROLLER, |
|                 | > T.E            | > V.A        | > ASSET.HMI,    |
|                 | VIL_DESTRUCTION, | RCHITECTURE, | > ASSET.REMOTE, |
|                 | > T.CTRL_TAMPER, | > V.SPOF,    | > ASSET.COMMS,  |
|                 | > T.SPOOF,       | > V          | > ASS           |
|                 | > T.DOS,         | .NOPOLICIES, | ET.CTRLPROCESS, |
|                 | > T.PRIVILEGE,   | > V          | >               |
|                 | > T.             | .NOTRAINING, | ASSET.CTRLINFO, |
|                 | NO_FAULT_RECORD, | > V.3RDPARTY | > ASSET.BUSINFO |
|                 | > T.INFECTION    | > V.NORISK   |                 |
+-----------------+------------------+--------------+-----------------+
| > **            | > T.DISCLOSURE,  | >            | >               |
| RISK.INTERNET** | >                | V.PLAINTEXT, | ASSET.ACTUATOR, |
|                 | T.EVIL_ANALYSIS, | >            | > ASSET.SENSOR, |
|                 | > T.EV           |  V.SERVICES, | > AS            |
|                 | IL_MODIFICATION, | > V.REMOTE,  | SET.CONTROLLER, |
|                 | > T.E            | > V.A        | > ASSET.HMI,    |
|                 | VIL_DESTRUCTION, | RCHITECTURE, | > ASSET.REMOTE, |
|                 | > T.CTRL_TAMPER, | > V.SPOF,    | > ASSET.COMMS,  |
|                 | > T.SPOOF,       | > V          | > ASS           |
|                 | > T.DOS,         | .NOPOLICIES, | ET.CTRLPROCESS, |
|                 | > T.PRIVILEGE,   | > V          | >               |
|                 | > T.INFECTION    | .NOTRAINING, | ASSET.CTRLINFO, |
|                 |                  | > V.3RDPARTY | > ASSET.BUSINFO |
|                 |                  | > V.NORISK   |                 |
+-----------------+------------------+--------------+-----------------+
| >               | > T.DISCLOSURE,  | >            | >               |
| **RISK.REMOTE** | >                | V.PLAINTEXT, | ASSET.ACTUATOR, |
|                 | T.EVIL_ANALYSIS, | >            | > ASSET.SENSOR, |
|                 | > T.EV           |  V.SERVICES, | > AS            |
|                 | IL_MODIFICATION, | > V.REMOTE,  | SET.CONTROLLER, |
|                 | > T.E            | > V.A        | > ASSET.HMI,    |
|                 | VIL_DESTRUCTION, | RCHITECTURE, | > ASSET.REMOTE, |
|                 | > T.CTRL_TAMPER, | > V.SPOF,    | > ASSET.COMMS,  |
|                 | > T.SPOOF,       | > V          | > ASS           |
|                 | > T.DOS,         | .NOPOLICIES, | ET.CTRLPROCESS, |
|                 | > T.PRIVILEGE,   | > V          | >               |
|                 | > T.INFECTION    | .NOTRAINING, | ASSET.CTRLINFO, |
|                 |                  | > V.3RDPARTY | > ASSET.BUSINFO |
|                 |                  | > V.NORISK   |                 |
+-----------------+------------------+--------------+-----------------+
| >               | > T.DISCLOSURE,  | >            | >               |
| **RISK.ONLINE** | > T.DOS,         | V.PLAINTEXT, | ASSET.ACTUATOR, |
|                 | > T.             | >            | > ASSET.SENSOR, |
|                 | NO_FAULT_RECORD, |  V.SERVICES, | > AS            |
|                 | > T.INFECTION    | > V.REMOTE,  | SET.CONTROLLER, |
|                 |                  | > V.A        | > ASSET.HMI,    |
|                 |                  | RCHITECTURE, | > ASSET.REMOTE, |
|                 |                  | > V.SPOF,    | > ASSET.COMMS,  |
|                 |                  | > V          | > ASS           |
|                 |                  | .NOPOLICIES, | ET.CTRLPROCESS, |
|                 |                  | > V          | >               |
|                 |                  | .NOTRAINING, | ASSET.CTRLINFO, |
|                 |                  | > V.3RDPARTY | > ASSET.BUSINFO |
|                 |                  | > V.NORISK   |                 |
+-----------------+------------------+--------------+-----------------+
| > **R           | > T.DISCLOSURE,  | >            | >               |
| ISK.OPSMANAGE** | >                | V.PLAINTEXT, | ASSET.ACTUATOR, |
|                 | T.EVIL_ANALYSIS, | >            | > ASSET.SENSOR, |
|                 | > T.EV           |  V.SERVICES, | > AS            |
|                 | IL_MODIFICATION, | > V.REMOTE,  | SET.CONTROLLER, |
|                 | > T.E            | > V.A        | > ASSET.HMI,    |
|                 | VIL_DESTRUCTION, | RCHITECTURE, | > ASSET.REMOTE, |
|                 | > T.CTRL_TAMPER, | > V.SPOF,    | > ASSET.COMMS,  |
|                 | > T.BAD_COMMAND, | > V          | > ASS           |
|                 | > T.SPOOF,       | .NOPOLICIES, | ET.CTRLPROCESS, |
|                 | > T.REPUDIATE,   | > V          | >               |
|                 | > T.DOS,         | .NOTRAINING, | ASSET.CTRLINFO, |
|                 | > T.PRIVILEGE,   | > V.3RDPARTY | > ASSET.BUSINFO |
|                 | > T.             | > V.NORISK   |                 |
|                 | NO_FAULT_RECORD, |              |                 |
|                 | > T.DISASTER,    |              |                 |
|                 | > T.INFECTION,   |              |                 |
|                 | > T              |              |                 |
|                 | .PHYSICAL_ACCESS |              |                 |
+-----------------+------------------+--------------+-----------------+
| > **RISK.IDS**  | > T.BAD_COMMAND, | >            | >               |
|                 | > T.REPUDIATE,   |  V.SERVICES, | ASSET.ACTUATOR, |
|                 | > T.             | > V          | > ASSET.SENSOR, |
|                 | NO_FAULT_RECORD, | .NOPOLICIES, | > AS            |
|                 |                  | > V          | SET.CONTROLLER, |
|                 |                  | .NOTRAINING, | > ASSET.HMI,    |
|                 |                  | > V.NORISK   | > ASSET.REMOTE, |
|                 |                  |              | > ASSET.COMMS,  |
|                 |                  |              | > AS            |
|                 |                  |              | SET.CTRLPROCESS |
+-----------------+------------------+--------------+-----------------+
| > **RI          | > T.E            | >            | >               |
| SK.CONTINUITY** | VIL_DESTRUCTION, | V.PLAINTEXT, | ASSET.ACTUATOR, |
|                 | > T.CTRL_TAMPER, | >            | > ASSET.SENSOR, |
|                 | > T.BAD_COMMAND, |  V.SERVICES, | > AS            |
|                 | > T.DOS,         | > V.REMOTE,  | SET.CONTROLLER, |
|                 | > T.DISASTER,    | > V.A        | > ASSET.HMI,    |
|                 | > T.INFECTION,   | RCHITECTURE, | > ASSET.REMOTE, |
|                 | > T              | > V.SPOF,    | > ASSET.COMMS,  |
|                 | .PHYSICAL_ACCESS | > V          | > ASS           |
|                 |                  | .NOPOLICIES, | ET.CTRLPROCESS, |
|                 |                  | > V          | >               |
|                 |                  | .NOTRAINING, | ASSET.CTRLINFO, |
|                 |                  | > V.3RDPARTY | > ASSET.BUSINFO |
|                 |                  | > V.NORISK   |                 |
+-----------------+------------------+--------------+-----------------+

### Security Risks are Sufficient

Due to the generic nature of this SPP and the need for additional
refinement of the sources of risks and identified assets, threats and
vulnerabilities, sufficiency arguments have not been included. SPP/SST
authors should note that additional rationale is required in order to
demonstrate that the risks are sufficient to address the security needs
(refer to the application notes for guidance).

## Security Objectives Rationale

The purpose of this rationale is to demonstrate that the identified
security objectives are suitable, that is they are sufficient to address
the security needs, and that they are necessary, ie, there are no
redundant security objectives.

### All Assumptions, Threats and Policies Addressed

The need to demonstrate that there are no redundant security objectives
is satisfied as follows:

-   The first section (Table 16) shows that all of the secure usage
    assumptions, threats to security, and organizational security
    policies have been addressed.

-   The second section (Table 17) shows that each security objective
    counters at least one assumption, policy, or threat.

[]{#__RefHeading___Toc69732180 .anchor}Table 16 - Mapping of
Assumptions, Threats, and OSPs to Security Objectives

+-----------------------------------+----------------------------------+
| > **Threat/Policy/Assumption      | > **Associated Security          |
| > Label**                         | > Objective**                    |
+===================================+==================================+
| > A.PHYSICAL_ACCESS               | > O.PHYSICAL                     |
|                                   | >                                |
|                                   | > O.INTERCONNECTIVITY            |
|                                   | >                                |
|                                   | > O.CONTINUITY                   |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.MONITORING                   |
|                                   | >                                |
|                                   | > O.AUDIT                        |
|                                   | >                                |
|                                   | > O.IDS                          |
|                                   | >                                |
|                                   | > O.RISK                         |
+-----------------------------------+----------------------------------+
| > T.DISCLOSURE                    | > O.RISK                         |
|                                   | >                                |
|                                   | > O.INTERCONNECTIVITY            |
|                                   | >                                |
|                                   | > O.DATA_AUTHENTICATION          |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.COMPLIANCE                   |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.SECURE_COMMS                 |
|                                   | >                                |
|                                   | > O.DATA_INTEGRITY               |
|                                   | >                                |
|                                   | > O.CONFIDENTIALITY              |
+-----------------------------------+----------------------------------+
| > P.EVENT                         | > O.PHYSICAL                     |
|                                   | >                                |
|                                   | > O.RISK                         |
|                                   | >                                |
|                                   | > O.INTERCONNECTIVITY            |
|                                   | >                                |
|                                   | > O.CONTINUITY                   |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.SECURE_COMMS                 |
|                                   | >                                |
|                                   | > O.AVAILABILITY                 |
|                                   | >                                |
|                                   | > O.MONITORING                   |
+-----------------------------------+----------------------------------+
| > A.COMMS_ACCESS                  | > O.PHYSICAL                     |
|                                   | >                                |
|                                   | > O.INTERCONNECTIVITY            |
|                                   | >                                |
|                                   | > O.CONTINUITY                   |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.AVAILABILITY                 |
+-----------------------------------+----------------------------------+
| > T.EVIL_ANALYSIS                 | > O.PHYSICAL                     |
|                                   | >                                |
|                                   | > O.INTERCONNECTIVITY            |
|                                   | >                                |
|                                   | > O.DATA_INTEGRITY               |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.SYSTEM INTEGRITY             |
|                                   | >                                |
|                                   | > O.MONITORING                   |
|                                   | >                                |
|                                   | > O.AUDIT                        |
+-----------------------------------+----------------------------------+
| > P.PERSONNEL                     | > O.PHYSICAL                     |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.DATA_INTEGRITY               |
|                                   | >                                |
|                                   | > O.SYSTEM_INTEGRITY             |
|                                   | >                                |
|                                   | > O.MONITORING                   |
|                                   | >                                |
|                                   | > O.IDS                          |
|                                   | >                                |
|                                   | > O.AUDIT                        |
+-----------------------------------+----------------------------------+
| > A.EXTERNAL                      | > O.INTERCONNECTIVITY            |
|                                   | >                                |
|                                   | > O.CONTINUITY                   |
|                                   | >                                |
|                                   | > O.MIGRATION                    |
|                                   | >                                |
|                                   | > O.COMPLIANCE                   |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.SECURE_COMMS                 |
|                                   | >                                |
|                                   | > O.DATA_INTEGRITY               |
|                                   | >                                |
|                                   | > O.AVAILABILITY                 |
|                                   | >                                |
|                                   | > O.MONITORING                   |
+-----------------------------------+----------------------------------+
| > T.EVIL_MODIFICATION             | > O.PHYSICAL                     |
|                                   | >                                |
|                                   | > O.SYSTEM_INTEGRITY             |
|                                   | >                                |
|                                   | > O.MONITORING                   |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.SECURE_COMMS                 |
|                                   | >                                |
|                                   | > O.DATA_AUTHENTICATION          |
|                                   | >                                |
|                                   | > DATA_INTEGRITY                 |
+-----------------------------------+----------------------------------+
| > P.INFRASTRUCTURE                | > O.RISK                         |
|                                   | >                                |
|                                   | > O.NON_INTERFERENCE             |
|                                   | >                                |
|                                   | > O.DATA_BACKUP                  |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.CONTINUITY                   |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.MIGRATION                    |
|                                   | >                                |
|                                   | > O.COMPLIANCE                   |
|                                   | >                                |
|                                   | > O.IDS                          |
+-----------------------------------+----------------------------------+
| > A.REMOTE                        | > O.PHYSICAL                     |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.CONFIDENTIALITY              |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.SYSTEM_INTEGRITY             |
|                                   | >                                |
|                                   | > O.MONITORING                   |
|                                   | >                                |
|                                   | > O.IDS                          |
+-----------------------------------+----------------------------------+
| > T.EVIL_DESTRUCTION              | > O.DATA_INTEGRITY               |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.MONITORING                   |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.AVAILABILTIY                 |
+-----------------------------------+----------------------------------+
| > P.CONFIGURATION                 | > O.PHYSICAL                     |
|                                   | >                                |
|                                   | > O.INTERCONNECTIVITY            |
|                                   | >                                |
|                                   | > O.DATA_AUTHENTICATION          |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.MIGRATION                    |
|                                   | >                                |
|                                   | > O.SYSTEM_INTEGRITY             |
+-----------------------------------+----------------------------------+
| > T.CTRL_TAMPER                   | > O.PHYSICAL                     |
|                                   | >                                |
|                                   | > O.DATA_AUTHENTICATION          |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.SECURE_COMMS                 |
|                                   | >                                |
|                                   | > O.DATA_INTEGRITY               |
|                                   | >                                |
|                                   | > O.SYSTEM_INTEGRITY             |
|                                   | >                                |
|                                   | > O.SYSTEM_DIAGNOSTICS           |
|                                   | >                                |
|                                   | > O.MONITORING                   |
+-----------------------------------+----------------------------------+
| > P.PHYSICAL                      | > O.PHYSICAL                     |
|                                   | >                                |
|                                   | > O.INTERCONNECTIVITY            |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.SECURE_COMMS                 |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.SYSTEM_INTEGRITY             |
|                                   | >                                |
|                                   | > O.MONITORING                   |
|                                   | >                                |
|                                   | > O.IDS                          |
+-----------------------------------+----------------------------------+
| > T.BAD_COMMAND                   | > O.NON_INTERFERENCE             |
|                                   | >                                |
|                                   | > O.DATA_AUTHENTICATION          |
|                                   | >                                |
|                                   | > O.SECURE_COMMS                 |
|                                   | >                                |
|                                   | > O.DATA_INTEGRITY               |
|                                   | >                                |
|                                   | > O.CONFIDENTIALITY              |
|                                   | >                                |
|                                   | > O.AVAILABILITY                 |
|                                   | >                                |
|                                   | > O.SYSTEM_INTEGRITY             |
|                                   | >                                |
|                                   | > O.SYSTEM_DIAGNOSTICS           |
+-----------------------------------+----------------------------------+
| > P.POLICY                        | > O.RISK                         |
|                                   | >                                |
|                                   | > O.NON_INTERFERENCE             |
|                                   | >                                |
|                                   | > O.DATA_BACKUP                  |
|                                   | >                                |
|                                   | > O.DATA_AUTHENTICATION          |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.CONFIDENTIALITY              |
|                                   | >                                |
|                                   | > O.CONTINUITY                   |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.MIGRATION                    |
|                                   | >                                |
|                                   | > O.COMPLIANCE                   |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.IDS                          |
|                                   | >                                |
|                                   | > O.AUDIT                        |
+-----------------------------------+----------------------------------+
| > T.SPOOF                         | > O.DATA_AUTHENTICATION          |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.CONFIDENTIALITY              |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.SYSTEM_INTEGRITY             |
+-----------------------------------+----------------------------------+
| > P.ASSETS                        | > O.RISK                         |
|                                   | >                                |
|                                   | > O.MIGRATIOON                   |
|                                   | >                                |
|                                   | > O.COMPLIANCE                   |
+-----------------------------------+----------------------------------+
| > T.REPUDIATE                     | > O.DATA_AUTHENTICATION          |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.DATA_INTEGRITY               |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
+-----------------------------------+----------------------------------+
| > P.SAFETY                        | > O.NON-INTERFERENCE             |
|                                   | >                                |
|                                   | > O.CONTINUITY                   |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.MIGRATION                    |
|                                   | >                                |
|                                   | > O.COMPLIANCE                   |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.SYSTEM_DIAGNOSTICS           |
+-----------------------------------+----------------------------------+
| > T.DOS                           | > O.CONTINUITY                   |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.ACCESS_CONTORL               |
|                                   | >                                |
|                                   | > O.SECURE_COMMS                 |
|                                   | >                                |
|                                   | > O.AVAILABILITY                 |
|                                   | >                                |
|                                   | > O.AUDIT                        |
+-----------------------------------+----------------------------------+
| > P.NO_INTERFERE                  | > O.NON_INTERFERENCE             |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.MIGRATION                    |
|                                   | >                                |
|                                   | > O.COMPLIANCE                   |
+-----------------------------------+----------------------------------+
| > T.PRIVILEGE                     | > O.DATA_AUTHENTICATION          |
|                                   | >                                |
|                                   | > O.MIGRATION                    |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.DATA_INTEGRITY               |
|                                   | >                                |
|                                   | > O.CONFIDENTIALITY              |
|                                   | >                                |
|                                   | > O.SYSTEM_INTEGRITY             |
|                                   | >                                |
|                                   | > O.MONITORING                   |
|                                   | >                                |
|                                   | > O.IDS                          |
+-----------------------------------+----------------------------------+
| > P.BUSINESS                      | > O.DATA_BACKUP                  |
|                                   | >                                |
|                                   | > O.CONTINUITY                   |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.MIGRATION                    |
|                                   | >                                |
|                                   | > O.AVAILABILITY                 |
+-----------------------------------+----------------------------------+
| > T.NO_FAULT_RECORD               | > O.SYSTEM_DIAGNOSTICS           |
|                                   | >                                |
|                                   | > O.MONITORING                   |
|                                   | >                                |
|                                   | > O.AUDIT                        |
|                                   | >                                |
|                                   | > O.IDS                          |
+-----------------------------------+----------------------------------+
| > P.RISK                          | > O.RISK                         |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.MIGRATION                    |
+-----------------------------------+----------------------------------+
| > T.DISASTEER                     | > O.CONTINUITY                   |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.MIGRATION                    |
|                                   | >                                |
|                                   | > O.AVAILABILTIY                 |
+-----------------------------------+----------------------------------+
| > P.ENVIRONMENT                   | > O.PHYSICAL                     |
|                                   | >                                |
|                                   | > O.RISK                         |
|                                   | >                                |
|                                   | > O.NON_INTERFERENCE             |
|                                   | >                                |
|                                   | > O.MANAGEMENT                   |
|                                   | >                                |
|                                   | > O.CONTINUITY                   |
|                                   | >                                |
|                                   | > O.MIGRATION                    |
|                                   | >                                |
|                                   | > O.SYSTEM_INTEGRITY             |
|                                   | >                                |
|                                   | > O.AVAILABILTIY                 |
+-----------------------------------+----------------------------------+
| > T.OUTAGE                        | > O.AVAILABILITY                 |
|                                   | >                                |
|                                   | > O.CONTINUITY                   |
|                                   | >                                |
|                                   | > O.NON_INTERFERENCE             |
|                                   | >                                |
|                                   | > O.DATA_BACKUP                  |
+-----------------------------------+----------------------------------+
| > T.INFECTION                     | > O.INTERCONNECTIVITY            |
|                                   | >                                |
|                                   | > O.DATA_BACKUP                  |
|                                   | >                                |
|                                   | > O.DATA_AUTHENTICATION          |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.SECURE_COMMS                 |
|                                   | >                                |
|                                   | > O.DATA_INTEGRITY               |
|                                   | >                                |
|                                   | > O.SYSTEM_INTEGRITY             |
|                                   | >                                |
|                                   | > O.MONITORING                   |
+-----------------------------------+----------------------------------+
| > T.PHYSICAL_ACCESS               | > O.PHYSICAL                     |
|                                   | >                                |
|                                   | > O.RISK                         |
|                                   | >                                |
|                                   | > O.INTERCONNECTIVITY            |
|                                   | >                                |
|                                   | > O.3RDPARTY                     |
|                                   | >                                |
|                                   | > O.REMOTE                       |
|                                   | >                                |
|                                   | > O.ACCESS_CONTROL               |
|                                   | >                                |
|                                   | > O.SYSTEM_INTEGRITY             |
|                                   | >                                |
|                                   | > O.MONITORING                   |
|                                   | >                                |
|                                   | > O.AUDIT                        |
|                                   | >                                |
|                                   | > O.IDS                          |
+-----------------------------------+----------------------------------+

Table 17 shows that there are no unnecessary IT security objectives.

[]{#__RefHeading___Toc69732181 .anchor}Table 17 - Mapping of Security
Objectives to Threats, Policies and Assumptions

+-------------------+-----------------+--------------+----------------+
| > **Security      | > **Threats**   | >            | > *            |
| > Objective**     |                 | **Policies** | *Assumptions** |
+===================+=================+==============+================+
| > **O.PHYSICAL**  | > T             | > P.EVENT,   | > A.P          |
|                   | .EVIL_ANALYSIS, | >            | HYSICAL_ACCESS |
|                   | > T.EVIL        | P.PERSONNEL, | > A            |
|                   | _MOIDIFICATION, | > P.CO       | .COMMS_ACCESS, |
|                   | > T.            | NFIGURATION, | > A.REMOTE,    |
|                   | CONTROL_TAMPER, | > P.PHYSICAL |                |
|                   | > T..           | > P          |                |
|                   | PHYSICAL_ACCESS | .ENVIRONMENT |                |
+-------------------+-----------------+--------------+----------------+
| > **O.RISK**      | > T.DISCLOSURE, | > P.EVENT,   | > A.P          |
|                   | > T.            | > P.IN       | HYISCAL_ACCESS |
|                   | PHYSICAL_ACCESS | FRASTRUCTURE |                |
|                   |                 | > P.POLICY,  |                |
|                   |                 | > P.ASSETS   |                |
|                   |                 | > P.RISK,    |                |
|                   |                 | > P          |                |
|                   |                 | .ENVIRONMENT |                |
+-------------------+-----------------+--------------+----------------+
| > **O.N           | > T.OUTAGE      | > P.IN       |                |
| ON_INTERFERENCE** |                 | FRASTRUCTURE |                |
|                   |                 | > P.POLICY,  |                |
|                   |                 | > P.SAFETY,  |                |
|                   |                 | > P.N        |                |
|                   |                 | O_INTERFERE, |                |
|                   |                 | > P          |                |
|                   |                 | .ENVIRONMENT |                |
+-------------------+-----------------+--------------+----------------+
| > **O.IN          | > T.DISCLOSURE  | > P.EVENT    | > A.PH         |
| TERCONNECTIVITY** | >               | > P.         | YSICAL_ACCESSA |
|                   | >               | CONFIGURATIO | .COMMS_ACCESS, |
|                   | T.EVIL_ANALYSIS | N,P.PHYSICAL | > A.EXTERNAL   |
|                   | >               |              |                |
|                   | > T.INFECTION   |              |                |
|                   | >               |              |                |
|                   | > T.            |              |                |
|                   | PHYSICAL_ACCESS |              |                |
+-------------------+-----------------+--------------+----------------+
| >                 | > T.OUTAGE,     | > P.POLICY,  |                |
| **O.DATA_BACKUP** | > T.INFECTION   | >            |                |
|                   |                 |  P.BUSINESS, |                |
+-------------------+-----------------+--------------+----------------+
| > **O.DATA        | > T.DISCLOSURE, | > P.CO       |                |
| _AUTHENTICATION** | >               | NFIGURATION, |                |
|                   | > T.EVI         | >            |                |
|                   | L_MODIFICATION, | > P.POLICY   |                |
|                   | >               |              |                |
|                   | > T.CTRL_TAMPER |              |                |
|                   | >               |              |                |
|                   | > T.BAD_COMMAND |              |                |
|                   | >               |              |                |
|                   | > T.SPOOF       |              |                |
|                   | >               |              |                |
|                   | > T.REPUDIATE   |              |                |
|                   | >               |              |                |
|                   | > T.PRIVILEGE   |              |                |
|                   | >               |              |                |
|                   | > T.INFECTION   |              |                |
+-------------------+-----------------+--------------+----------------+
| >                 | > T.DOS,        | > P.EVENT,   | > **A.PHYS     |
|  **O.CONTINUITY** | >               | >            | ICAL_ACCESS,** |
|                   | > T.DISASTER    | > P.IN       | >              |
|                   | >               | FRASTRUCTURE | > **A.C        |
|                   | > T.OUTAGE      | >            | OMMS_ACCESS,** |
|                   |                 | > P.POLICY,  | >              |
|                   |                 | >            | >              |
|                   |                 | >            | **A.EXTERNAL** |
|                   |                 |  P.BUSINESS, |                |
|                   |                 | >            |                |
|                   |                 | > P          |                |
|                   |                 | .ENVIRONMENT |                |
+-------------------+-----------------+--------------+----------------+
| >                 | > T.DISCLOSURE, | > P.EVENT,   | > **A.C        |
|  **O.MANAGEMENT** | >               | >            | OMMS_ACCESS,** |
|                   | > T.SPOOF,      | >            | >              |
|                   | >               | P.PERSONNEL, | >              |
|                   | > T.REPUDIATE   | >            |  **A.REMOTE,** |
|                   | >               | > P.IN       |                |
|                   | > T.DISASTER    | FRASTRUCTURE |                |
|                   |                 | >            |                |
|                   |                 | > P.CO       |                |
|                   |                 | NFIGURATION, |                |
|                   |                 | >            |                |
|                   |                 | > P.POLICY   |                |
|                   |                 | >            |                |
|                   |                 | > P.SAFETY   |                |
|                   |                 | >            |                |
|                   |                 | > P.         |                |
|                   |                 | NO_INTERFERE |                |
|                   |                 | >            |                |
|                   |                 | > P.BUSINESS |                |
|                   |                 | >            |                |
|                   |                 | > P.RISK     |                |
|                   |                 | >            |                |
|                   |                 | > P          |                |
|                   |                 | .ENVIRONMENT |                |
+-------------------+-----------------+--------------+----------------+
| > **O.MIGRATION** | > T.PRIVILEGE   | > P.IN       | > *            |
|                   | >               | FRASTRUCTURE | *A.EXTERNAL;** |
|                   | > T.DISASTER    | >            |                |
|                   |                 | > P.C        |                |
|                   |                 | ONFIGURATION |                |
|                   |                 | >            |                |
|                   |                 | > P.ASSETS   |                |
|                   |                 | >            |                |
|                   |                 | > P.SAFETY   |                |
|                   |                 | >            |                |
|                   |                 | > P.         |                |
|                   |                 | NO_INTERFERE |                |
|                   |                 | >            |                |
|                   |                 | > P.BUSINESS |                |
|                   |                 | >            |                |
|                   |                 | > P.RISK     |                |
|                   |                 | >            |                |
|                   |                 | > P          |                |
|                   |                 | .ENVIRONMENT |                |
+-------------------+-----------------+--------------+----------------+
| >                 | > T.DISCLOSURE  | > P.IN       | >              |
|  **O.COMPLIANCE** |                 | FRASTRUCTURE | **A.EXTERNAL** |
|                   |                 | >            |                |
|                   |                 | > P.PO       |                |
|                   |                 | LICYP.ASSETS |                |
|                   |                 | >            |                |
|                   |                 | > P.SAFETY   |                |
|                   |                 | >            |                |
|                   |                 | > P.         |                |
|                   |                 | NO_INTERFERE |                |
+-------------------+-----------------+--------------+----------------+
| > **O.3RDPARTY**  | > T.DISCLOSURE  | > P.EVENT    | > **A.         |
|                   | >               | >            | COMMS_ACCESS** |
|                   | >               | >            | >              |
|                   | T.EVIL_ANALYSIS |  P.PERSONNEL | >              |
|                   | >               | >            | **A.EXTERNAL** |
|                   | > T.E           | > P.POLICY   | >              |
|                   | VIL_DESTRUCTION | >            | > **A.REMOTE** |
|                   | >               | > P.SAFETY   |                |
|                   | > T.SPOOF       |              |                |
|                   | >               |              |                |
|                   | > T.DOS         |              |                |
|                   | >               |              |                |
|                   | > T.PRIVILEGE   |              |                |
|                   | >               |              |                |
|                   | > T.INFECTION   |              |                |
|                   | >               |              |                |
|                   | > T.            |              |                |
|                   | PHYSICAL_ACCESS |              |                |
+-------------------+-----------------+--------------+----------------+
| > **O.REMOTE**    | > T.DISCLOSURE  | > P.EVENT    | > **A.PHY      |
|                   | >               | >            | SICAL_ACCESS** |
|                   | >               | > P.PHYSICAL | >              |
|                   | T.EVIL_ANALYSIS | >            | > **A.         |
|                   | >               | > P.POLICY   | COMMS_ACCESS** |
|                   | > T.EV          | >            | >              |
|                   | IL_MODIFICATION | > P.SAFETY   | > **A.REMOTE** |
|                   | >               |              |                |
|                   | > T.E           |              |                |
|                   | VIL_DESTRUCTION |              |                |
|                   | >               |              |                |
|                   | > T.SPOOF       |              |                |
|                   | >               |              |                |
|                   | > T.DOS         |              |                |
|                   | >               |              |                |
|                   | > T.PRIVILEGE   |              |                |
|                   | >               |              |                |
|                   | > T.INFECTION   |              |                |
|                   | >               |              |                |
|                   | > T.            |              |                |
|                   | PHYSICAL_ACCESS |              |                |
+-------------------+-----------------+--------------+----------------+
| > **O             | > T.E           | > P.EVENT    | > **A.PHY      |
| .ACCESS_CONTROL** | VIL_DESTRUCTION | >            | SICAL_ACCESS** |
|                   | >               | >            | >              |
|                   | > T.CTRL_TAMPER |  P.PERSONNEL | > **A.         |
|                   | >               | >            | COMMS_ACCESS** |
|                   | > T.SPOOF       | > P.IN       | >              |
|                   | >               | FRASTRUCTURE | > **A.REMOTE** |
|                   | > T.REPUDIATE   | >            |                |
|                   | >               | > P.PHYSICAL |                |
|                   | > T.DOS         | >            |                |
|                   | >               | > P.POLICY   |                |
|                   | > T.PRIVILEGE   |              |                |
|                   | >               |              |                |
|                   | > T.            |              |                |
|                   | PHYSICAL_ACCESS |              |                |
+-------------------+-----------------+--------------+----------------+
| > *               | > T.DISCLOSURE  | > P.EVENT    | >              |
| *O.SECURE_COMMS** | >               | >            | **A.EXTERNAL** |
|                   | > T.EV          | > P.PHYSICAL |                |
|                   | IL_MODIFICATION |              |                |
|                   | >               |              |                |
|                   | > T.CTRL_TAMPER |              |                |
|                   | >               |              |                |
|                   | > T.BAD_COMMAND |              |                |
|                   | >               |              |                |
|                   | > T.INFECTION   |              |                |
+-------------------+-----------------+--------------+----------------+
| > **O             | > T.DISCLOSURE  | >            | >              |
| .DATA_INTEGRITY** | >               |  P.PERSONNEL | **A.EXTERNAL** |
|                   | >               |              |                |
|                   | T.EVIL_ANALYSIS |              |                |
|                   | >               |              |                |
|                   | > T.EV          |              |                |
|                   | IL_MODIFICATION |              |                |
|                   | >               |              |                |
|                   | > T.E           |              |                |
|                   | VIL_DESTRUCTION |              |                |
|                   | >               |              |                |
|                   | > T.CTRL_TAMPER |              |                |
|                   | >               |              |                |
|                   | > T.BAD_COMMAND |              |                |
|                   | >               |              |                |
|                   | > T.REPUDIATE   |              |                |
|                   | >               |              |                |
|                   | > T.PRIVILEGE   |              |                |
|                   | >               |              |                |
|                   | > T.INFECTION   |              |                |
+-------------------+-----------------+--------------+----------------+
| > **O.            | > T.DISCLOSURE  | > P.POLICY   | > **A.REMOTE** |
| CONFIDENTIALITY** | >               |              |                |
|                   | > T.BAD_COMMAND |              |                |
|                   | >               |              |                |
|                   | > T.SPOOF       |              |                |
|                   | >               |              |                |
|                   | > T.PRIVILEGE   |              |                |
+-------------------+-----------------+--------------+----------------+
| > *               | > T.BAD_COMMAND | > P.EVENT    | > **A.         |
| *O.AVAILABILITY** | >               | >            | COMMS_ACCESS** |
|                   | > T.DOS         | > P.BUSINESS | >              |
|                   | >               | >            | >              |
|                   | > T.DISASTER    | > P          | **A.EXTERNAL** |
|                   | >               | .ENVIRONMENT |                |
|                   | > T.OUTAGE      |              |                |
+-------------------+-----------------+--------------+----------------+
| > **O.S           | >               | >            | > **A.REMOTE** |
| YSTEM_INTEGRITY** | T.EVIL_ANALYSIS |  P.PERSONNEL |                |
|                   | >               | >            |                |
|                   | > T.EV          | > P.C        |                |
|                   | IL_MODIFICATION | ONFIGURATION |                |
|                   | >               | >            |                |
|                   | > T.CTRL_TAMPER | > P.PHYSICAL |                |
|                   | >               | >            |                |
|                   | > T.BAD_COMMAND | > P          |                |
|                   | >               | .ENVIRONMENT |                |
|                   | > T.SPOOF       |              |                |
|                   | >               |              |                |
|                   | > T.PRIVILEGE   |              |                |
|                   | >               |              |                |
|                   | > T.INFECTION   |              |                |
|                   | >               |              |                |
|                   | > T.            |              |                |
|                   | PHYSICAL_ACCESS |              |                |
+-------------------+-----------------+--------------+----------------+
| > **O.SYS         | > T.CTRL_TAMPER | > P.SAFETY   |                |
| TEM_DIAGNOSTICS** | >               |              |                |
|                   | > T.BAD_COMMAND |              |                |
|                   | >               |              |                |
|                   | > T.            |              |                |
|                   | NO_FAULT_RECORD |              |                |
+-------------------+-----------------+--------------+----------------+
| >                 | >               | > P.EVENT    | > **A.PHY      |
|  **O.MONITORING** | T.EVIL_ANALYSIS | >            | SICAL_ACCESS** |
|                   | >               | >            | >              |
|                   | > T.EV          |  P.PERSONNEL | >              |
|                   | IL_MODIFICATION |              | **A.EXTERNAL** |
|                   | >               |              | >              |
|                   | > T.E           |              | > **A.REMOTE** |
|                   | VIL_DESTRUCTION |              | >              |
|                   | >               |              | >              |
|                   | > T.CTRL-TAMPER |              | **P.PHYSICAL** |
|                   | >               |              |                |
|                   | > T.PRIVILEGE   |              |                |
|                   | >               |              |                |
|                   | > T.            |              |                |
|                   | NO_FAULT_RECORD |              |                |
|                   | >               |              |                |
|                   | > T.INFECTION   |              |                |
|                   | >               |              |                |
|                   | > T.            |              |                |
|                   | PHYSICAL_ACCESS |              |                |
+-------------------+-----------------+--------------+----------------+
| > **O.AUDIT**     | >               | >            | > **A.PHY      |
|                   | T.EVIL_ANALYSIS |  P.PERSONNEL | SICAL_ACCESS** |
|                   | >               | >            |                |
|                   | > T.DOS         | > P.POLICY   |                |
|                   | >               |              |                |
|                   | > T.            |              |                |
|                   | NO_FAULT_RECORD |              |                |
|                   | >               |              |                |
|                   | > T.            |              |                |
|                   | PHYSICAL_ACCESS |              |                |
|                   | >               |              |                |
|                   | > T.OUTAGE      |              |                |
+-------------------+-----------------+--------------+----------------+
| > **O.IDS**       | > T.            | > P.POLICY   | > **A.REMOTE** |
|                   | PHYSICAL_ACCESS | >            | >              |
|                   | >               | > P.PHYSICAL | > **A.PHY      |
|                   | > T.            | >            | SICAL_ACCESS** |
|                   | NO_FAULT_RECORD | > P.IN       |                |
|                   | >               | FRASTRUCTURE |                |
|                   | > T.PRIVILEGE   | >            |                |
|                   | >               | >            |                |
|                   | > T.DOS         |  P.PERSONNEL |                |
+-------------------+-----------------+--------------+----------------+

### Security Objectives are Sufficient

Due to the generic nature of this SPP and the need for additional
refinement of the identified security objectives, assumptions, threats
and organizational security policies, sufficiency arguments have not
been included. SPP/SST authors should note that additional rationale is
required in order to demonstrate that the security objectives are
sufficient to address the security needs (refer to the application notes
for guidance).

### Suitability of the Security Objectives to counter identified Risks

The purpose of this section is to show that the security objectives are
suitable to address the identified security risks. Table 18 and Table 19
show that each security objective is necessary, that is, each security
risk is addressed by at least one security objective and vice versa.

[]{#__RefHeading___Toc69732182 .anchor}Table 18 - Mapping of Security
Risks to Security Objectives

+-------------------------------+--------------------------------------+
| > **Security Risk**           | > **Security Objectives**            |
+===============================+======================================+
| > R.MANAGE                    | > O.DATA_AUTHENTICATION              |
|                               | >                                    |
|                               | > O.MANAGEMENT                       |
|                               | >                                    |
|                               | > O.3RDPARTY                         |
|                               | >                                    |
|                               | > O.AUDIT                            |
+-------------------------------+--------------------------------------+
| > R.SECPOLICY                 | > O.DATA_AUTHENTICATION              |
|                               | >                                    |
|                               | > O.REMOTE                           |
|                               | >                                    |
|                               | > O.AVAILABILITY                     |
|                               | >                                    |
|                               | > O.DATA_BACKUP                      |
|                               | >                                    |
|                               | > O.3RDPARTY                         |
|                               | >                                    |
|                               | > O.RISK                             |
|                               | >                                    |
|                               | > O.MANAGEMENT                       |
|                               | >                                    |
|                               | > O.COMPLIANCE                       |
+-------------------------------+--------------------------------------+
| > R.RISKMAN                   | > O.RISK                             |
|                               | >                                    |
|                               | > O.DATA_INTEGRITY                   |
|                               | >                                    |
|                               | > O.ACCESS_CONTROL                   |
+-------------------------------+--------------------------------------+
| > R.COMPLY                    | > O.COMPLIANCE                       |
+-------------------------------+--------------------------------------+
| > R.ASSETCTRL                 | > O.MANAGEMENT                       |
|                               | >                                    |
|                               | > O.MIGRATION                        |
+-------------------------------+--------------------------------------+
| > R.PERSONNEL                 | > O.MANAGEMENT                       |
|                               | >                                    |
|                               | > O.RISK                             |
|                               | >                                    |
|                               | > O.ACCESS_CONTROL                   |
|                               | >                                    |
|                               | > O.MIGRATION                        |
+-------------------------------+--------------------------------------+
| > R.PHYSICAL                  | > O.PHYSICAL                         |
+-------------------------------+--------------------------------------+
| > R.ENVIRON                   | > O.CONTINUITY                       |
|                               | >                                    |
|                               | > O.AVAILABILITY                     |
+-------------------------------+--------------------------------------+
| > R.EVIL_ACCESS               | > O.DATA_INTEGRITY                   |
|                               | >                                    |
|                               | > O.SECURE_COMMS                     |
|                               | >                                    |
|                               | > O.ACCESS_CONTROL                   |
|                               | >                                    |
|                               | > O.SYSTEM_INTEGRITY                 |
+-------------------------------+--------------------------------------+
| > R.NEED2KNOW                 | > O.CONFIDENTIALITY                  |
|                               | >                                    |
|                               | > O.ACCESS_CONTROL                   |
+-------------------------------+--------------------------------------+
| > R.INTEGRATE                 | > O.3RDPARTY                         |
|                               | >                                    |
|                               | > O.MIGRATION                        |
|                               | >                                    |
|                               | > O.NON_INTERFERENCE                 |
+-------------------------------+--------------------------------------+
| > R.NETCOMMS                  | > O.SECURE_COMMS                     |
|                               | >                                    |
|                               | > O.ACCESS_CONTROL                   |
|                               | >                                    |
|                               | > O.DATA_AUTHENTICATION              |
+-------------------------------+--------------------------------------+
| > R.CONNECT                   | > O.INTERCONNECTIVITY                |
|                               | >                                    |
|                               | > O.COMPLIANCE                       |
|                               | >                                    |
|                               | > O.DATA_AUTHENTICATION              |
|                               | >                                    |
|                               | > O.REMOTE                           |
+-------------------------------+--------------------------------------+
| > R.INTERNET                  | > O.COMPLIANCE                       |
|                               | >                                    |
|                               | > O.MONITORING                       |
+-------------------------------+--------------------------------------+
| > R.REMOTE                    | > O.3RDPARTY                         |
|                               | >                                    |
|                               | > O.REMOTE                           |
|                               | >                                    |
|                               | > O.DATA_INTEGRITY                   |
|                               | >                                    |
|                               | > O.MONITORING                       |
|                               | >                                    |
|                               | > O.DATA_AUTHENTICATION              |
+-------------------------------+--------------------------------------+
| > R.ONLINE                    | > O.DATA_AUTHENTICATION              |
|                               | >                                    |
|                               | > O.INTERCONNECTIVITY                |
|                               | >                                    |
|                               | > O.MONITORING                       |
|                               | >                                    |
|                               | > O.AUDIT                            |
|                               | >                                    |
|                               | > O.REMOTE                           |
+-------------------------------+--------------------------------------+
| > R.OPSMANAGE                 | > O.SYSTEM_INTEGRITY                 |
|                               | >                                    |
|                               | > O.SYSTEM_DIAGNOSTICS               |
|                               | >                                    |
|                               | > O.MONITORING                       |
|                               | >                                    |
|                               | > O.NON_INTERFERENCE                 |
|                               | >                                    |
|                               | > O.DATA_AUTHENTICATION              |
|                               | >                                    |
|                               | > O.RISK                             |
|                               | >                                    |
|                               | > O.MANAGEMENT                       |
|                               | >                                    |
|                               | > O.MIGRATION                        |
|                               | >                                    |
|                               | > O.CONFIDENTIALITY                  |
+-------------------------------+--------------------------------------+
| > R.IDS                       | > O.IDS                              |
|                               | >                                    |
|                               | > O.MONITORING                       |
|                               | >                                    |
|                               | > O.AUDIT                            |
+-------------------------------+--------------------------------------+
| > R.CONTINUITY                | > O.CONTINUITY                       |
|                               | >                                    |
|                               | > O.INTERCONNECTIVITY                |
|                               | >                                    |
|                               | > O.AVAILABILITY                     |
|                               | >                                    |
|                               | > O.DATA_BACKUP                      |
+-------------------------------+--------------------------------------+

[]{#__RefHeading___Toc69732183 .anchor}Table 19 - Mapping of Security
Objectives to Security Risks

+-------------------------------+--------------------------------------+
| > **Security Objective**      | > **Security Risks**                 |
+===============================+======================================+
| > O.PHYSICAL                  | > R.PHYSICAL                         |
+-------------------------------+--------------------------------------+
| > O.RISK                      | > R.SECPOLICY                        |
|                               | >                                    |
|                               | > R.RISKMAN                          |
|                               | >                                    |
|                               | > R.PERSONNEL                        |
|                               | >                                    |
|                               | > R.OPSMANAGE                        |
+-------------------------------+--------------------------------------+
| > O.NON_INTERFERENCE          | > R.INTEGRATE                        |
|                               | >                                    |
|                               | > R.OPSMANAGE                        |
+-------------------------------+--------------------------------------+
| > O.INTERCONNECTIVITY         | > R.CONNECT                          |
|                               | >                                    |
|                               | > R.ONLINE                           |
|                               | >                                    |
|                               | > R.CONTINUITY                       |
+-------------------------------+--------------------------------------+
| > O.DATA_BACKUP               | > R.SECPOLICY                        |
|                               | >                                    |
|                               | > R.CONTINUITY                       |
+-------------------------------+--------------------------------------+
| > O.DATA_AUTHENTICATION       | > R.MANAGE                           |
|                               | >                                    |
|                               | > R.SECPOLICY                        |
|                               | >                                    |
|                               | > R.NETCOMMS                         |
|                               | >                                    |
|                               | > R.CONNECT                          |
|                               | >                                    |
|                               | > R.REMOTE                           |
|                               | >                                    |
|                               | > R.ONLINE                           |
|                               | >                                    |
|                               | > R.OPSMANAGE                        |
+-------------------------------+--------------------------------------+
| > O.CONTINUITY                | > R.ENVIRON                          |
|                               | >                                    |
|                               | > R.CONTINUITY                       |
+-------------------------------+--------------------------------------+
| > O.MANAGEMENT                | > R.MANAGE                           |
|                               | >                                    |
|                               | > R.SECPOLICY                        |
|                               | >                                    |
|                               | > R.ASSETCTRL                        |
|                               | >                                    |
|                               | > R.PERSONNEL                        |
|                               | >                                    |
|                               | > R.OPSMANAGE                        |
+-------------------------------+--------------------------------------+
| > O.MIGRATION                 | > R.ASSETCTRL                        |
|                               | >                                    |
|                               | > R.INTEGRATE                        |
|                               | >                                    |
|                               | > R.OPSMANAGE                        |
+-------------------------------+--------------------------------------+
| > O.COMPLIANCE                | > R.SECPOLICY                        |
|                               | >                                    |
|                               | > R.COMPLY                           |
|                               | >                                    |
|                               | > R.CONNECT                          |
|                               | >                                    |
|                               | > R.INTERNET                         |
+-------------------------------+--------------------------------------+
| > O.3RDPARTY                  | > R.MANAGE                           |
|                               | >                                    |
|                               | > R.SECPOLICY                        |
|                               | >                                    |
|                               | > R.INTEGRATE                        |
|                               | >                                    |
|                               | > R.REMOTE                           |
+-------------------------------+--------------------------------------+
| > O.REMOTE                    | > R.SECPOLICY                        |
|                               | >                                    |
|                               | > R.CONNECT                          |
|                               | >                                    |
|                               | > R.REMOTE                           |
|                               | >                                    |
|                               | > R.ONLINE                           |
+-------------------------------+--------------------------------------+
| > O.ACCESS_CONTROL            | > R.RISKMAN                          |
|                               | >                                    |
|                               | > R.PERSONNEL                        |
|                               | >                                    |
|                               | > R.EVIL_ACCESS                      |
|                               | >                                    |
|                               | > R.NEED2KNOW                        |
|                               | >                                    |
|                               | > R.NETCOMMS                         |
+-------------------------------+--------------------------------------+
| > O.SECURE_COMMS              | > R.EVIL_ACCESS                      |
|                               | >                                    |
|                               | > R.NETCOMMS                         |
+-------------------------------+--------------------------------------+
| > O.DATA_INTEGRITY            | > R.RISKMAN                          |
|                               | >                                    |
|                               | > R.EVIL_ACCESS                      |
|                               | >                                    |
|                               | > R.REMOTE                           |
+-------------------------------+--------------------------------------+
| > O.CONFIDENTIALITY           | > R.NEED2KNOW                        |
|                               | >                                    |
|                               | > R.OPSMANAGE                        |
+-------------------------------+--------------------------------------+
| > O.AVAILABILITY              | > R.SECPOLICY                        |
|                               | >                                    |
|                               | > R.ENVIRON                          |
|                               | >                                    |
|                               | > R.CONTINUITY                       |
+-------------------------------+--------------------------------------+
| > O.SYSTEM_INTEGRITY          | > R.OPSMANAGE                        |
|                               | >                                    |
|                               | > R.EVIL_ACCESS                      |
|                               | >                                    |
|                               | > R.OPSMANAGE                        |
+-------------------------------+--------------------------------------+
| > O.SYSTEM_DIAGNOSTICS        | > R.OPSMANAGE                        |
+-------------------------------+--------------------------------------+
| > O.MONITORING                | > R.INTERNET                         |
|                               | >                                    |
|                               | > R.REMOTE                           |
|                               | >                                    |
|                               | > R.ONLINE                           |
|                               | >                                    |
|                               | > R.OPSMANAGE                        |
|                               | >                                    |
|                               | > R.IDS                              |
+-------------------------------+--------------------------------------+
| > O.AUDIT                     | > R.MANAGE                           |
|                               | >                                    |
|                               | > R.ONLINE                           |
|                               | >                                    |
|                               | > R.IDS                              |
+-------------------------------+--------------------------------------+
| > O.IDS                       | > R.IDS                              |
+-------------------------------+--------------------------------------+

### Sufficiency of the Security Objectives to counter identified Risks

Due to the generic nature of this SPP and the need for additional
refinement of the sources of risk and the identified security
objectives, sufficiency arguments have not been included. SPP/SST
authors should note that additional rationale is required in order to
demonstrate that the security objectives are sufficient to counter the
identified security risks (refer to the application notes for guidance).

## Security Requirements Rationale

### Suitability of the Security Requirements

The purpose of this section is to show that the identified security
requirements are suitable to meet the security objectives. Table 20 and
Table 21 show that each security requirement is necessary, that is, each
security objective is addressed by at least one security requirement and
vice versa. Note that some objectives are partially satisfied by the
STOE and partially satisfied by the IT environment. Security Objectives
for the STOE are satisfied by security functional and assurance
requirements. Security Objectives for the Environment are satisfied by
IT requirements for the environment.

[]{#__RefHeading___Toc69732184 .anchor}Table 20 - Mapping of Security
Objectives to Security Requirements

+------------------------------+---------------------------------------+
| > **Security Objectives**    | > **Security Requirements**           |
+==============================+=======================================+
| > O.Boundary_Protection      | > FPT_PHP.1, FPT_PHP.2, FPT_PHP.3     |
|                              | >                                     |
|                              | > FPT_PHP.4, PHY_SOB.1                |
+------------------------------+---------------------------------------+
| > O.Risk                     | > AVA_VLA.2                           |
|                              | >                                     |
|                              | > AMA_AMP.1                           |
|                              | >                                     |
|                              | > AMA_EVD.1                           |
+------------------------------+---------------------------------------+
| > O.Non_Interference         | > FTP_ITC.1 FTP_TRP.1, FPT_SEP.1      |
|                              | >                                     |
|                              | > AVA_MSU.2                           |
+------------------------------+---------------------------------------+
| > O.Data_Backup              | > FDP_UIT.2, FPT_RCV.2, FPT_RCV.3,    |
|                              | > FPT_RCV.4, FPT_FLS.1, FPT_AMT.1,    |
|                              | > FPT_TST.1                           |
+------------------------------+---------------------------------------+
| > O.Data_Authentication      | > FIA_UAU.3, FIA_UAU.4, FIA_UAU.7,    |
|                              | > FIA_UID.1, FDP_DAU.2, FMT_MTD.1,    |
|                              | > FMT_SMR.1, FPT_RPL.1                |
+------------------------------+---------------------------------------+
| > O.Continuity               | > P.Business_Continuity               |
|                              | >                                     |
|                              | > FRU_FLT.1, FPT_FLS.1, FPT_RCV.5     |
|                              | >                                     |
|                              | > FMT_SMF.1                           |
+------------------------------+---------------------------------------+
| > O.Verify                   | > ATE_FUN.1, ATE_IND.2, ATE_AST.1,    |
|                              | > ADO_IGS.1, FPT_AMT.1, FPT_TST.1     |
+------------------------------+---------------------------------------+
| > O.Ownership                | > FMT_SMR.1, FMT_SMR.2, FMT_MOF.1,    |
|                              | > FMT_MOF.2, FMT_REV.1, FMT_SMF.1,    |
|                              | > P.Personnel, P.Infrastructure       |
+------------------------------+---------------------------------------+
| > O.Migration                | > P.Assurance_Maintenance             |
|                              | >                                     |
|                              | > P.Personnel                         |
+------------------------------+---------------------------------------+
| > O.Compliance               | > P.Policy_Procdures                  |
+------------------------------+---------------------------------------+
| > O.Collaborate              | > P.Policy_Procedures                 |
+------------------------------+---------------------------------------+
| > O.Access_Control           | > FDP_ACC.1, FDP_ACF.1, FDP_IFC.1,    |
|                              | > FDP_IFF.1, FIA_UAU.1, FIA_UAU.2,    |
|                              | > FIA_UID.2, FMT_REV.1, FMT_MOF.2,    |
|                              | > FIA_AFL.1, FTP_TRP.1, FTA_TSE.1,    |
|                              | > FIA_SOS.1, FIA_SOS.2, FMT_SAE.1,    |
|                              | > FPT_STM.1, FPT_SEP                  |
+------------------------------+---------------------------------------+
| > O.Comms_Integrity          | > FPT_ITA.1, FPT_ITC.1, FPT_ITI.1,    |
|                              | > FPT_ITI.2, FPT_RCV.5, FPT_RPL.1,    |
|                              | > FPT_SSP.1, FPT_SSP.2, FPT_STM.1,    |
|                              | > FPT_TDC.1, FTP_ITC.1, FTP_TRP.1     |
|                              | > FPT_TST.1, FDP_ETC.1, FDP_ETC.2,    |
|                              | > FDP_ITC.1, FDP_ITC.2, FDP_UCT.1,    |
|                              | > FDP_UIT.1, FDP_UIT.2, FDP_IFF.1,    |
|                              | > FCS_COP.1, FCS_CKM.4, FMT_MOF.1,    |
+------------------------------+---------------------------------------+
| +----------+-------------+   |                                       |
| | > O.A    | >           |   |                                       |
| | vailable |  FPT_FLS.1, |   |                                       |
| |          | >           |   |                                       |
| |          |  FPT_TRC.1, |   |                                       |
| |          | >           |   |                                       |
| |          |  FPT_ITA.1, |   |                                       |
| |          | >           |   |                                       |
| |          |  FRU_FLT.1, |   |                                       |
| |          | >           |   |                                       |
| |          |  FRU_PRS.1, |   |                                       |
| |          | > FRU_PRS.2 |   |                                       |
| +----------+-------------+   |                                       |
| | > O.C    | >           |   |                                       |
| | ontrol_I |  FMT_MSA.1, |   |                                       |
| | ntegrity | >           |   |                                       |
| |          |  FPT_TST.1, |   |                                       |
| |          | >           |   |                                       |
| |          |  FPT_AMT.1, |   |                                       |
| |          | > FPT_FLS.1 |   |                                       |
| +----------+-------------+   |                                       |
| | >        | >           |   |                                       |
| |  O.Event |  FAU_ARP.1, |   |                                       |
| | _Monitor | >           |   |                                       |
| |          |  FAU_SAA.1, |   |                                       |
| |          | > FAU_SAA.2 |   |                                       |
| |          | >           |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_SAA.3, |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_SAA.4, |   |                                       |
| |          | > FAU_SEL.1 |   |                                       |
| |          | >           |   |                                       |
| |          | >           |   |                                       |
| |          |  FPT_ITI.1, |   |                                       |
| |          | > FPT_ITI.2 |   |                                       |
| |          | >           |   |                                       |
| |          | >           |   |                                       |
| |          |  FEM_EDI.1, |   |                                       |
| |          | >           |   |                                       |
| |          |  FEM_EDI.2, |   |                                       |
| |          | >           |   |                                       |
| |          |  FEM_EDI.3, |   |                                       |
| |          | >           |   |                                       |
| |          |  FEM_EDI.4, |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU.GEN.1, |   |                                       |
| |          | > FAU_GEN.2 |   |                                       |
| |          | >           |   |                                       |
| |          | >           |   |                                       |
| |          |  FPT_TDC.1, |   |                                       |
| |          | >           |   |                                       |
| |          |  FMT_SMF.1, |   |                                       |
| |          | > FMT_SMR.1 |   |                                       |
| +----------+-------------+   |                                       |
| | > O.E    | >           |   |                                       |
| | vent_Log |  FAU_GEN.1, |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_GEN.2, |   |                                       |
| |          | > FAU_SEL.1 |   |                                       |
| |          | >           |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_SAR.1, |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_SAR.2, |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_SAR.3, |   |                                       |
| |          | >           |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_STG.1, |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_STG.2, |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_STG.3, |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_STG.4, |   |                                       |
| |          | > FPT_STM   |   |                                       |
| +----------+-------------+   |                                       |
| | > O.IDS  | > FAU_ARP.1 |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_SAA.1, |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_SAA.2, |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_SAA.3, |   |                                       |
| |          | >           |   |                                       |
| |          |  FAU_SAA.4, |   |                                       |
| |          | >           |   |                                       |
| |          |  FPT_ITI.1, |   |                                       |
| |          | >           |   |                                       |
| |          |  FPT_ITI.2, |   |                                       |
| |          | >           |   |                                       |
| |          |  FEM_EDI.1, |   |                                       |
| |          | > FEM_EDI.2 |   |                                       |
| +----------+-------------+   |                                       |
+------------------------------+---------------------------------------+

[]{#__RefHeading___Toc69732185 .anchor}Table 21 - Mapping of Security
Requirements to Security Objectives

+-------------------------------+--------------------------------------+
| > **Requirements**            | > **Objective**                      |
+===============================+======================================+
| > FAU_ARP.1                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FAU_GEN.1                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FAU_GEN.2                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FAU_SAA.1                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FAU_SAA.2                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FAU_SAA.3                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FAU_SAA.4                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FAU_SEL.1                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FCS_CKM.4                   | > O.Comms_Integrity                  |
+-------------------------------+--------------------------------------+
| > FCS_COP.1                   | > O.Comms_Integrity                  |
+-------------------------------+--------------------------------------+
| > FDP_ACC.1                   | > O.Access_Control                   |
+-------------------------------+--------------------------------------+
| > FDP_ACF.1                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FSP_DAU.2                   | > O.Data_Authentication              |
+-------------------------------+--------------------------------------+
| > FDP_ETC.1                   | > O.Comms_Integrity                  |
+-------------------------------+--------------------------------------+
| > FDP_ETC.2                   | > O.Comms_Integrity                  |
+-------------------------------+--------------------------------------+
| > FDP_IFF.1                   | > O.Comms_Integrity                  |
|                               | >                                    |
|                               | > O.Access_Control                   |
+-------------------------------+--------------------------------------+
| > FDP_ITC.2                   | > O.Comms_Integrity                  |
+-------------------------------+--------------------------------------+
| > FDP_UCT.1                   | > O.Comms_Integrity                  |
+-------------------------------+--------------------------------------+
| > FDP_UIT.1                   | > O.Comms_Integrity                  |
+-------------------------------+--------------------------------------+
| > FDP_UIT.2                   | > O.Comms_Integrity                  |
|                               | >                                    |
|                               | > O.Data_Backup                      |
+-------------------------------+--------------------------------------+
| > FEM_EDI.1                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FEM_EDI.2                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FEM_EDI.3                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FEM_EDI.4                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FIA_AFL.1                   | > O.Access_Control                   |
+-------------------------------+--------------------------------------+
| > FIA_SOS.1                   | > O.Access_Control                   |
+-------------------------------+--------------------------------------+
| > FIA_SOS.2                   | > O.Access_Control                   |
+-------------------------------+--------------------------------------+
| > FIA_UAU.1                   | > O.Access_Control                   |
+-------------------------------+--------------------------------------+
| > FIA_UAU.2                   | > O.Access_Control                   |
+-------------------------------+--------------------------------------+
| > FIA_UAU.3                   | > O.Data_Authentication              |
+-------------------------------+--------------------------------------+
| > FIA_UAU.4                   | > O.Data_Authentication              |
+-------------------------------+--------------------------------------+
| > FIA_UAU.7                   | > O.Data_Authentication              |
+-------------------------------+--------------------------------------+
| > FIA_UID.1                   | > O.Data_Authentication              |
+-------------------------------+--------------------------------------+
| > FIA_UID.2                   | > O.Access_Control                   |
+-------------------------------+--------------------------------------+
| > FMT_MOF.1                   | > O.Comms_Integrity                  |
|                               | >                                    |
|                               | > O.Ownership                        |
+-------------------------------+--------------------------------------+
| > FMT_MOF.2                   | > O.Access_Control                   |
|                               | >                                    |
|                               | > O.Ownership                        |
+-------------------------------+--------------------------------------+
| > FMT_MSA.1                   | > O.Control_Integrity                |
+-------------------------------+--------------------------------------+
| > FMT_MTD.1                   | > O.Data_Authentication              |
+-------------------------------+--------------------------------------+
| > FMT_REV.1                   | > O.Ownership                        |
+-------------------------------+--------------------------------------+
| > FMT_REV.2                   | > O.Access_Control                   |
+-------------------------------+--------------------------------------+
| > FMT_SAE.1                   | > O.Access_Control                   |
+-------------------------------+--------------------------------------+
| > FMT_SMF.1                   | > O.Event_Monitor                    |
|                               | >                                    |
|                               | > O.Ownership                        |
|                               | >                                    |
|                               | > O.Continuity                       |
+-------------------------------+--------------------------------------+
| > FMT_SMR.1                   | > O.Event_Monitor                    |
|                               | >                                    |
|                               | > O.Ownership                        |
|                               | >                                    |
|                               | > O.Data_Authentication              |
+-------------------------------+--------------------------------------+
| > FMT_SMR.2                   | > O.Ownership                        |
+-------------------------------+--------------------------------------+
| > FPT_AMT.1                   | > O.Control_Integrity                |
|                               | >                                    |
|                               | > O.Verify                           |
|                               | >                                    |
|                               | > O.Data_Backup                      |
+-------------------------------+--------------------------------------+
| > FPT_FLS.1                   | > O.Control_Integrity, O.Data_Backup |
|                               | >                                    |
|                               | > O.Available                        |
|                               | >                                    |
|                               | > O.Continuity                       |
+-------------------------------+--------------------------------------+
| > FPT_ITA.1                   | > O.Available                        |
+-------------------------------+--------------------------------------+
| > FPT_ITC.1                   | > O.Comms_Integrity                  |
+-------------------------------+--------------------------------------+
| > FPT_ITI.1                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FPT_ITI.2                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FPT_PHP.1                   | > O.Boundary_Protection              |
+-------------------------------+--------------------------------------+
| > FPT_PHP.2                   | > O.Boundary_Protection              |
+-------------------------------+--------------------------------------+
| > FPT_PHP.3                   | > O.Boundary_Protection              |
+-------------------------------+--------------------------------------+
| > FPT_PHP.4                   | > O.Boundary_Protection              |
+-------------------------------+--------------------------------------+
| > FPT_RCV.2                   | > O.Data_Backup                      |
+-------------------------------+--------------------------------------+
| > FPT_RCV.3                   | > O.Data_Backup                      |
+-------------------------------+--------------------------------------+
| > FPT_RCV.4                   | > O.Data_Backup                      |
+-------------------------------+--------------------------------------+
| > FPT_RPL.1                   | > O.Comms_Integrity                  |
|                               | >                                    |
|                               | > O.Data_Authentication              |
+-------------------------------+--------------------------------------+
| > FPT_SEP.1                   | > O.Non-Interference                 |
|                               | >                                    |
|                               | > O.Comms_Integrity                  |
+-------------------------------+--------------------------------------+
| > FPT_SSP.1                   | > O.Comms_Integrity                  |
+-------------------------------+--------------------------------------+
| > FPT_SSP.2                   | > O.Comms_Integrity                  |
+-------------------------------+--------------------------------------+
| > FPT_STM.1                   | > O.Comms_Integrity                  |
|                               | >                                    |
|                               | > O.Access_Control                   |
+-------------------------------+--------------------------------------+
| > FPT_TDC.1                   | > O.Event_Monitor                    |
+-------------------------------+--------------------------------------+
| > FPT_TRC.1                   | > O.Available                        |
+-------------------------------+--------------------------------------+
| > FPT_TST.1                   | > O.Control_Integrity                |
|                               | >                                    |
|                               | > O.Verify                           |
|                               | >                                    |
|                               | > O.Data_Backup                      |
+-------------------------------+--------------------------------------+
| > FRU_FLT.1                   | > O.Available                        |
|                               | >                                    |
|                               | > O.Continuity                       |
+-------------------------------+--------------------------------------+
| > FRU_PRS.1                   | > O.Available                        |
+-------------------------------+--------------------------------------+
| > FRU_PRS.2                   | > O.Available                        |
+-------------------------------+--------------------------------------+
| > FTA_TSE.1                   | > O.Access_Control                   |
+-------------------------------+--------------------------------------+
| > FTP_ITC.1                   | > O.Comms_Integrity                  |
|                               | >                                    |
|                               | > O.Non-Interference                 |
+-------------------------------+--------------------------------------+
| > FTP_TRP.1                   | > O.Comms_Integrity                  |
|                               | >                                    |
|                               | > O.Access_Control                   |
|                               | >                                    |
|                               | > O.Non-Interference                 |
+-------------------------------+--------------------------------------+

### Sufficiency of the Security Requirements

Due to the generic nature of this SPP and the need for additional
refinement of the sources of risk and the identified security
objectives, sufficiency arguments have not been included. SPP/SST
authors should note that additional rationale is required in order to
demonstrate that the security objectives are sufficient to counter the
identified security risks (refer to the application notes for guidance).

### Satisfaction of Dependencies

Due to the generic nature of this SPP and the need for additional
refinement of the security requirements, a dependency analysis has not
been included. SPP/SST authors should note that a dependency analysis is
required in order to show that the dependencies between the security
requirements have been addressed by the SPP/SST (refer to the
application notes for guidance).

## Rationale for Extensions

### Augmentation for Assurance Background Information

This section provides the rationale for the inclusion of the explicit
system assurance requirements, as noted in Table 18. An overview for
each class will address from a security controls perspective, the
contribution to system security provided by the noted assurance
component(s).

#### Class ASA: Security awareness 

The need to communicate the security responsibilities expected of
personnel can be supported with the development of complete and
consistent documentation describing those expectations. Although, the
ISO/IEC 15408 Part 3 AGD class could easily be interpreted to include
the procedural security functions as well as the IT security functions,
the provider and focus of the documentation is different. In a systems
context, the usage documentation will contain specifics about the system
that product documentation cannot.

The security policy and procedures documents class, PPD, provides the
requirements for documentation describing security expectations,
procedures and policies for personnel accessing the assets. The
component(s) in this class are used to gain confidence that personnel
are informed of those procedural expectations so that the security can
be maintained.

#### Class ASC System operational and management security controls

The ASC class is closely derived from the technical security control
based assurance ASD class. Operational security is concerned with the
physical, policy, procedural, personnel, and other organisational
security control measures that are used in the operational environment
to protect the STOE; as well as support its business function. For
instance System support of degraded operations, as part of continuing
business operations in response to natural or man-made events (see PBC
in section 4). Management security is concerned with the provision of
management and infrastructure support enable the operational security
controls and technical security controls to effectively be used. The
objective of this activity is to assess the completeness, accuracy, and
usability of the system operational and management security controls
components of the system, and to verify that the security and
operational policies, procedures, organization and physical assets
support the system security requirements that are allocated to them.
This is achieved through examination of the policies and procedures and
physical system control security attributes, and any associated design
and configuration documentation. The latter becomes especially important
if there is a direct interface to the IT part of the system security.
This may also include observation and interviews with personnel to gain
insight to the strength of the organization security infrastructure. As
noted above, the PPD class will also contribute to confidence gained
that personnel are informed of the system security related procedures.

#### Class ACM: Configuration Management

The objective of Configuration Management during evaluation is to
provide assurance that the evaluator has the correct version of all
system components for the other evaluation activities. It applies
therefore to measures within the development environment, not the
operational environment. When the operational system is deployed,
configuration management is a series of system capabilities allowing
operational decision makers to control the configuration and changes to
it. The most recent evaluation evolves to be the baseline, and will be
maintained as such by the organization. Any proposed modifications, bug
fixes, or system capability upgrades/enhancements will be controlled and
evaluated against the most recent evaluated baseline, and that baseline
will be updated accordingly. Additionally, operational and maintenance
security controls will also be updated as necessary to respond to the
changing threat and operational environment. These too will be evaluated
from a system security impact perspective and changes will be controlled
accordingly, as part of the system security configuration.

#### Class ADO: Delivery and operation

The purpose of the system delivery and operation activity is to judge
the adequacy of the documentation of the procedures used to ensure:

-   That the system components can be delivered to the operating
    organization without modification;

-   That the system can be accepted by the operating organization and
    that it is put under configuration control;

-   That the system components can be installed, generated and started
    into an initial secure configuration that verifies interoperability
    between components;

-   That the system can be configured to enforce the policies that
    govern day-to-day operations.

-   Site interoperability can be ensured, such that the security
    relevant system, subsystem, external and component interfaces that
    comprise the System TOE, especially those to legacy security
    controls can be started up, and interoperate in a secure manner in
    the intended operational environment

The ADO_IGS documentation shall be used to assure that the system
transition incorporating the patch, upgrade, or new components into the
operational environment can be conducted transparently and without
disruption to system availability and integrity.

#### Class ASD: System Architecture, Design and Configuration Documentation

The ASD assurance class is closely derived from the ADV class in ISO/IEC
15408 Part 3. However, the necessary development and integration
information appropriate for systems is different enough from those in
the current status that it was determined that a separate class was
appropriate avoid confusion.

The purpose of this class is to assess the completeness, coherency and
consistency of the system architecture, design and operational
configuration documentation and to verify that the system architecture,
design and configuration reflect the security requirements allocated to
the various subsystems and components of the system. This is achieved
through examination of increasingly refined descriptions of the System
Security Function (SSF) architecture, design and configuration
documentation.

This class is closely related to the ADV assurance class for product
design abstractions. However, because so many changes are needed to meet
the needs of system level design, a complete new class is added. This
may be merged at a later time with ADV but for now the differences are
viewed significant enough that a new class is warranted.

#### Class AGD Guidance documents

The purpose of the guidance document family is to judge the adequacy of
the documentation describing the integration and operational use of the
system. Such documentation includes that aimed at system integrators,
trusted administrators and non-administrative users whose incorrect
actions could adversely affect the security behaviour and
characteristics of the system, as well as that aimed at normal users
whose incorrect actions could adversely affect the ability of the system
to provide the required protection capabilities for their own data.

Therefore, the AGD activity is closely related to the processes and
procedures defined by the operational security requirements. The user
and administrator guidance includes information regarding the technology
aspects of the system as well as the operational and human processes of
the system.

There are additional types of users in a distributed system, and their
roles and responsibilities extend beyond the traditional user and
administrator categories required user documentation. Each of the user
roles need to know both the technical and management and operational
security controls needed to accomplish their business mission.

One of these users may be external systems that are considered outside
the STOE. The critical issue is that if there is a component that
interfaces with the STOE but for whatever reason the component is not
part of the STOE, then it is necessary to:

a)  Define the interfaces between the STOE and the external component;

b)  Define the security properties, if any, that are provided by or that
    are provided across the interfaces,

c)  Define how the STOE and external component will authenticate
    themselves to each other;

d)  Define the secure method by which the STOE and the external
    component will communicate such that a security policy is enforced;

e)  Define the security agreement between the parties with
    responsibility for operating the STOE and the external component to
    establish the business rules that govern how that interface is to be
    used and maintained over time.

f)  Define the security relevant configuration parameters that allow
    implementation, integration, and enforcement of system security
    policies.

The guidance documents family applies to those functions and interfaces
which are related to the security of the system as a whole. In
principle, the notion of providing users 'all information necessary to
maintain the security\...' applies directly to system evaluations.
However, in practice, a product administrator guide will provide
instructions on how to change settings; in a system context the values
to be set are decided so the administrator guidance will instruct on
exactly how to configure the system to optimize security in its
distributed environment. In addition, it could be that the AGD
components cover all the evidence of security controls that require that
users be made aware of policies and procedures because they provide the
information required for the user to securely operate within and as part
of the system.

It is often wrongly assumed that there would only be one guidance
document for the system administrator, while in fact there could be
multiple pieces of guidance for different administrator roles. This is
particularly true in a distributed system context where different
portions of the system may be administered and maintained by completely
different roles. This may also apply to the operational user guidance -
different types of users may be issued different guidance documents. In
addition, the system integrator is considered a user of the system and
requires detailed integration and check-out procedural guidance to
ensure that any given component/product is securely integrated into the
system.

#### Class ALC Life cycle support

The purpose of the life-cycle support class is to judge the adequacy of
the procedures used during the integration and operational life-cycle of
the system. These procedures include the security measures used
throughout system development (i.e., integration), the life-cycle model
used by the integrator, and the tools used by the integrator throughout
the life-cycle of the system.

The process of life cycle support is much more extensive, and
increasingly important in a system context. This is due to the
composition of a system being a collection of various products that are
integrated together to support business operations and security
requirements that protect those operations. The system, which may be
widely distributed, requires procedures to monitor and track the system
from its inception as an operational entity, until it is securely
retired from the organisation. System security controls need to be
evaluated at regular intervals; and the system components tracked both
from a parts obsolescence perspective, related supportability aspects,
and modifications to increase functionality, replace obsolete parts,
take advantage of more efficient technology, add a interface to another
system, and respond to a new or different threat environment. In this
regard, following the STOE's initial verification and authorisation for
operation, ALC becomes inherently tightly coupled to AMA. ALC aspects
may be considered more of a local issue, where the system is monitored
for maintenance and performance. An example being that a bug may be
found, or an obsolete part notification might be received from a vendor,
or a software end of support life notice. These issues would be handled
more informally with the vendor or by the system IT department. They may
also be contractual obligations that drive the organisation's response,
and the vendor's requirements. Whereas upgrading the STOE for a new
capability, adding an interface, or response to a new threat, would be
more broad brushed, and have a potentially greater impact on the
System's security contribution, both from technical security and
operational and management security controls perspective. The Life Cycle
Development plan and procedures and the Assurance Maintenance Plan
should complement and support each other. Any proposed or actual change
would still require an impact analysis to ensure that the change will
not have a negative impact to either system performance or functionality
for business or security support.

As with ACM, once the system has been received and enters day-to-day
operations, the system has to be entered into the organisation's
configuration management and life cycle support systems. The system
integrator then may play a prominent role in the day-to-day maintenance
of the system in support of its operations. ALC and its product and
development focused activities, would then literally transform to
operations related activities that, in turn would closely track and
support AMA activities.

As such, from operations assurance perspective, it is proposed that one
family be introduced, ALC_OPS, from which the system would transition to
(from ALC_DEV), following its introduction into day-to-day operations.
ALC_FLR while germane for systems, the general responsibility becomes
more organisation focused, with system integrator, or organisation IT
personnel playing a larger role, and developer responsibilities being
more contractual in nature. The premise for systems is that following
the established procedure in the operational environment should provide
greater confidence that evaluation results remain sound. However, the
flaw correction and related information will still be subject to the
impact analysis and evaluation process defined in AMA, as part of the
continuous monitoring and change process.

#### Class ATE Test

The purpose of this family is to verify that the system components, when
installed, integrated and configured in accordance with the system
architecture and system configuration evidence, meet the security
functional requirements specified in the SST and are effective in
enforcing the system security concept of operations. System
architecture, integration and design documentation aid in test
development and execution. This is accomplished by determining that the
SSF has been configured as specified by the configuration specification,
tested against the relevant architecture and design evidence, by
performing a sample of the developer's tests, and by independently
testing a subset of the SSF.

The term 'test campaign' is used to denote the entirety of the test
activities performed.

A system presents the following issues that are addressed by the test
campaign:

a)  Physical distribution of the system components;

b)  Whether or not the system components have been evaluated. In the
    case where the component is evaluated, the differences between the
    evaluated configuration and the configuration of the component when
    used in the system context raises issues;

c)  The impact of the specific operational environment and its
    contribution to assurance;

d)  Achieving secure integration of system components through
    development of specialized functionality;

e)  Varying levels of assurance allocated to different physical or
    logical components of the system.

The system evaluation test criteria accommodates the need for a flexible
test campaign that provides for the following:

a)  the availability of evaluated products and evidence about the
    products,

b)  the degree of assurance desired for the various parts of the system,

c)  the existence of specialised functionality to integrate components
    into the system and the degree of assurance required for that
    specialised functionality.

d)  the specific configuration decisions that enable the system to
    implement the system security requirements and system security
    concept of operation.

##### ATE_AST: AST Family - Testing the operational and management security controls

System testing must address the operational and management security
controls of the system in addition to the technical security control
portion. The system introduces concerns for maintaining the system
configuration on a day-to-day basis in response to a changing
environment and the need for repeated vulnerability assessments to
ensure that the system continues to provide effective countermeasures.
This class addresses the testing of the operational and management
security controls aspects of system security, and verifies its
contribution to system security. The test effort is primarily two-fold;
the first tests that there is a well-documented mapping of the policy,
applicable procedures personnel and physical attributes of the
organisation to the system TSF. Second that there is a testable, clear
and unambiguous communications medium to status, exchange and report
security information among the various security controls of the System.

#### Class AVA Vulnerability analysis

The purpose of the vulnerability assessment activity is to determine the
existence and exploitability of flaws or weaknesses in the system as
configured for, and implemented in its intended environment. This
determination is based upon analysis performed by the developer and the
evaluator, with inputs from the consumer; and is supported by evaluator
testing.

Inherently, the AVA activity is closely related to the system security
policy and procedures, physical security measures, personnel security,
and having security infrastructure in place to effectively counter any
system vulnerabilities. The system strength of security function
encompasses all security controls aspects to ensure that the system
remains secure and any breaches can be effectively countered.

The notion of vulnerability assessment is greatly expanded in a system
context, due to the added complexity when compared to a product. The
added system complexity not only can increase the vulnerability access
points, but it also can increase potential ways to counter a
vulnerability. This is because system security measures can be more
robust because of the systems approach, which inherently encompasses a
broader type set. Additionally, the system also encompasses operational
and management security controls aspects, such as physical boundary
monitoring, auditing mechanisms, and more extensive and better training
of personnel to create a broader corporate atmosphere of security
awareness. The vulnerability assessment activity should be conducted
throughout the system life cycle to ensure that the security controls
change, as needed, and remain effective in the changing threat
environment.

#### Class AMA Assurance maintenance

The purpose of the assurance maintenance activity is to assure that the
system will continue to maintain its security assurance baseline as
changes are made to the system itself or to its environment. Such
changes may include new threats or vulnerabilities, changes to the
system or environment that can have a security impact, changes in
personnel, and modifications or changes to the system's external
interfaces. This activity includes both technical and operational and
management security controls elements.

The notion of assurance maintenance is pronounced in a system context
because of the typical system complexity and incorporation of the mix of
security controls features. Therefore, any change/modification/upgrade
to any of the security components of the system will require an analysis
to determine the impact to secure system operation itself; and to
determine if an unrelated feature may have to be modified to contribute
to system security, due to those changes.

The assurance maintenance activity is an ongoing activity that is
applicable to any changes in the system environment that may impact
security, throughout the system life cycle. These changes could range
from a new facility intrusion detection system, to the addition of a new
emergency generator that will be used by the system, to an additional
external interface that the system must exchange data with. And in fact,
an additional external interface to the system, would involve the
definition of that interface, any new vulnerabilities that could be
introduced via that interface, and both technical and operational and
management security controls related documentation would necessarily
need to be updated, driven by the system need to accommodate the new
interface.

A change in the operational environment itself will necessitate an
evaluation of security aspects of the system security baseline, and how
best to accommodate that change. That change may be all-inclusive and
impact the system as a whole, or it may impact a single domain of the
system. In the latter case, existing system components may be able to
accommodate the security aspects of the change, or by just tweaking the
configuration to accommodate security aspects of the operational
environment. There needs to be a change mechanism in place and
documented in

AMA for a product is typically a developer function. However, that role
will necessarily shift to the system owner for a system. This is due
primarily to the interaction of technical and operational security
controls of the system, especially when considering the operational
security policies and procedures that will govern human behavior, which
typically tends to evolve over time. The length and breadth of security
controls system components, which includes event monitoring, augments
system security but also necessarily increases the role of the system
owner in support of this function.

## Strength of Function Claims

This SPP does not include any strength of functions claims.

# Appendix A -- Acronyms {#appendix-a-acronyms .unnumbered}

  --------------- -------------------------------------------------------
  CC              Common Criteria

  EAL             Evaluation Assurance Level

  ICS             Industrial Control System

  IT              Information Technology

  NIAP            National Information Assurance Partnership

  NIST            National Institute of Standards and Technology

  NSA             National Security Agency

  PP              Protection Profile

  PSF             Procedural, Policy, Personnel & Physical Security
                  Functions

  SF              Security Function

  SFP             Security Function Policy

  SOF             Strength of Function

  SP              Special Publication

  SPP             System Protection Profile

  ST              Security Target

  SST             System Security Target

  STOE            System Target of Evaluation

  TSC             TSF Scope of Control

  TSF             Technical Security Functions

  SSF             System Security Functions

  TSFI            TSF Interface

  TSP             TOE Security Policy
  --------------- -------------------------------------------------------

[^1]: The descriptions for expertise, resources and motivation
    correspond to those defined for "capability of the attacker",
    "resources of the attacker", and "intent of the attacker" from
    Appendix E of NIST Special Publication 800-53: Recommended Security
    Controls for Federal Information Systems.

[^2]: The description for opportunity relates to whether the attack can
    be conducted within the ICS network (locally) or outside the
    protected boundary of the ICS network (remotely).