CSMS

Cyber Security Management System

Conformity Assessment
Schemefor the CSMS Certification Criteria（IEC 62443-2-1:2010）

Cyber Security Management Systeof the CSMS
1 Purpose
Conformity Assessment Scheme
The CSMS (Cyber Security Management System)

and Control System (IACS). The CSMS Scheme is aimed

Conformity Assessment Scheme (hereinafter the ‘CSMS

at contributing to the improvement of security of control

Scheme’*1) is a third-party certification scheme*2 for cybersystems in Japan, and ensuring and maintaining security

security management systems on the Industrial Automation

measures to win the trust of all stakeholders.

*1： ‘CSMS’ in the CSMS Scheme refers to the security management system for control systems. (News release by the Ministry of Economy, Trade and Industry dated April 25, 2014).
*2：

The CSMS Scheme was established by utilizing the outcome of the government project to develop certification infrastructures for securing the control system, one of
the themes in the Ministry of Economy, Trade and Industry’s project to develop global certification infrastructures, funded in the FY2012 supplementary budget.

2 CSMS Overview
Necessity of security measures for control systems
IACS refers to industrial automation and control systems

general-purpose technologies developed for businessthat support social and industrial infrastructures in theapplication systems (computer and server infrastructures /fields of energies (electricity, gas, etc.), petroleum /environment, protocols such as TCP/IP), networks

chemical / steel plants, transportation (including(remote operation, remote maintenance, etc.) and media

railways), machinery, food production / processing,(data extraction, parameter changes).

building management, etc.

The shutdown of IACS with cyber-attacks could not only

Conventionally, it was considered that there was no realaffect social infrastructures and business continuity, butsecurity threat for IACS, as it was composed of dedicatedalso have serious impacts on the HSE*3. Accordingly,systems, unconnected to external networks. However,

the introduction of CSMS has become essential to

IACS is increasingly becoming a potential target for

appropriately manage security measures, designed tocyber-attacks following the recent proliferation ofprotect each organization’s IACS from cyber-attacks.

*3：HSE stands for Health, Safety and Environment. It refers to the responsibility of protecting the health and safety for employees and surrounding communities, andmanaging and maintaining a high level of competency in the environment. (as defined in the IEC 62443-2-1 3.1.16)

Target Organization of CSMS
In view of the life cycle of control systems, CSMS

and maintenance of existing systems and systemcovers organizations that own control systems, as

integrators that develop control systems.

well as organizations that handle the modification

Organizationthat
own controlsystems(asset owners)

Organizationthatdevelop controlsystems(system integrators)

1IACSDevelopmentOperationAnd
maintenance

Organizationthat handle
the operationand maintenance ofcontrol systems

emof the CSMS
3 Operation
Conformity Assessment Scheme
The CSMS scheme has a comprehensive structure,bodies” that certify and register CSMS auditors, andcomposed of “certification bodies” that assess andthe “accreditation body” that assesses the competence

certify an applicant organization‘s CSMS based on theof those bodies in implementing such tasks.

CSMS Certification criteria; “personnel certification
Structure of the Conformity Assessment Scheme
Apply

Apply

Certification Bodies

Personnel Certification Bodies
Assess(accredit)

Apply

Assess(accredit)
Assess(approve)

AccreditationBodyAssess(certify)(IMS Promotion Center,JIPDEC)
Comments,Complaints,etc

Applicant Organizations

Evaluate(certify)
Apply

ApplyApplicantsfor Auditors

Issue the certificateof successful
completion

Attenda trainingcourse

Auditor Training Bodies

Impartiality, Transparency and Objectivity of the CSMS Scheme Operation
To ensure impartiality, transparency and objectivity ofcomprised of experts, has also been set up to consider

the CSMS scheme, some committees have been set up

and decide accreditation of certification bodies andin JIPDEC: one of them is the Steering Committee

personnel certification bodies.

comprised of academic and relevant industry experts,

For further information on the activities on theseand another one is its sub-committee, the Technicalcommittees, please visit our website

Committee. The accreditation review board, which is

http://www.isms.jipdec.or.jp/org/index.html

Senior Executive

Internal Audit

Steering Committee

provides advice on the policy
regarding operation of the scheme

Accreditation
Review Board
considers and makes decision on accreditation of certification bodies

Director

Registration GroupAssessment Groupdeals with tasks related toregistration of accreditationand operation of the scheme

conducts accreditationassessment

CSMS TechnicalCommittee
develops criteria andguides for the dissemination of this scheme

External
Accreditation
Assessors
2Cyber Security Management Syste
4 Benefits of developing and managing CSMS
By developing and managing CSMS, an organization can gain the following benefits:● Reduce risk of cyber attacks

The development and management of CSMS enhanceorganizational understanding of risk management,
leading to security initiatives with a higher sense ofpurpose. Implementing security measures based on
CSMS can also reduce risk of cyber-attacks.

●Strictly adhere to the best practice guidelines for security controls on IACS administrators

Ensuring that the administrators of IACS adhere to
the best practice guidelines can reduce the possibilityof a security incident caused by human errors ororganizational factors. Also, implementing educational
curriculum including incident trainings can enhanceawareness on security.

● Facilitate continual improvement of security measures

By developing and managing CSMS, the organization canconduct practical revision of its security guidelines, clarify
the application states of these guidelines among its sites,
and continually improve its security measures throughsuch activates. In addition, developing and managing
CSMS enables the organization to gain confidence in andhave convincing justification for design, delivery andinstallation concerning the security of control systems.

5 Benefits of achieving CSMS certification
By achieving CSMS certification, an organization can gain the following benefits:● Provide objective proof for organizational cyber security management system
Obtaining CSMS certification can not only strengthen
also provide objective proof to show external parties thatthe organization’s cyber security management system,but
the organization fulfills its social responsibility.
● Receive security checks from a third-party viewpoint

The third-party audit by auditors from a certification body highlights areas that are difficult to detect in self-checks.
● Reinforce the strength of an organization’s brand

CSMS certification is third-party proof that the system
supplied by an integrator can be established in thehighly secured environment, thereby reinforcing thestrength of an organization’s brand.

6 CSMS Certification Criteria
The framework for security management system isstandards that can be applied to formulate control

necessary for an organization handling IACS

system security. Based on the IEC 62443-2-1, thedevelopment and management in order to achieve a‘CSMS Certification Criteria (IEC 62443-2-1:2010)’

fundamental security improvement. The IEC 62443(hereinafter ‘CSMS Certification Criteria’) have been

series of standards includes IEC 62443-2-1 on thedeveloped as the certification criteria for security

security management system for IACS, as one of themanagement systems in the field of IACS.

■ IEC 62443 series
IEC 62443-1：Defining terminology, concepts and models for this series of standards as a whole
IEC 62443-2：Security management system for organizations
IEC 62443-3：System security requirements and technical overview
IEC 62443-4：Security functions and development process requirements for components (equipment and devices)3em
7 Structure of the CSMS Certification Criteria
The CSMS Certification Criteria specify general

improving a documented CSMS within the context

requirements for establishing, implementing,of the organization’s overall business activities andoperating, monitoring, reviewing, maintaining andrisks it faces.

■ 4.2 Risk analysis

4.2.2 Business rationale: Identify and document the unique needs of an organization to address cyberrisk for IACS.
4.2.3 Risk identification, classification and assessment: Identify the set of IACS cyber risks that anorganization faces and assess the likelihood and severity of these risks.
■ 4.3 Addressing risk with the CSMS

The organization shall select controls as CSMS security measures from those listed in ‘5. Controls’. It shall thenproduce a ‘Statement of Applicability’ that contains selected controls and justifications for inclusions, and also
excluded controls and justifications for exclusions.
■ 4.4 Monitoring and improving the CSMS

4.4.2 Conformance: Ensure that the CSMS developed for an organization is followed.
4.4.3 Review, improve and maintain the CSMS: Ensure that the CSMS continues to meet its goal over time.

CSMS Certification criteria（IEC 62443-2-1：2010）

4.2 Risk analysis■4.2.2 Business rationale■4.2.3 Risk identification, classification and assessment

4.3 Addressing risk with the CSMS
■4.3.2 Security policy, organization and awareness4.3.2.2

CSMS scope

4.3.2.4

4.3.2.3

Organizing for security■4.3.3 Selected security countermeasures

Staff training andsecurity awareness4.3.2.6

Security policies andprocedures■4.3.4 Implementation(As part of CSMS process,the security controls shallbe selected from the detailed security control.)

4.3.4.2 Risk management and implementation
4.3.4.4 Information and document management

5 Detailed security contorolBusiness5.1 continuity
plan

Access control

5.6 - Authentication

Personnel

5.2 security

Access control

5.7 - Authorization

Physical and5.3 enviromental
security

System

5.8 development

and maintenanceNetwork

5.4 segmentation
Information5.9 and document
management

Access control

5.5 - Accountadministration
Incident

5.10 planning andresponse

4.4 Monitoring and improving the CSMS
■4.4.2 Conformance■4.4.3 Review, improve and maintain the CSMS

4

Cyber Security Management Syste
8 Relationship between CSMS and ISMS
IEC 62443-2-1 has been developed by reference toshould be protected, and in many cases, tend toISO/IEC 27001 with additions specific to control

emphasize Confidentiality, Integrity and Availability

systems. They therefore share a number of similar(CIA) in that order. In comparison, CSMS regards

requirements. For this reason, a company that has‘operation suspension’ as the event that should be

already acquired ISMS (Information Security

avoided most, and therefore emphasizes Availability,Management System) certification is considered toIntegrity and Confidentiality (AIC) in that order, whilesatisfy the most of the CSMS requirements.

also taking HSE into account.

ISMS focuses on the leakage of information which
Comparison between IEC 62443-2-1 and ISO/IEC 27001
Structure of

ISMS (ISO/IEC 27001)

Main text
ManagementSystem(MS)Annex A (normative)
SelectControls

Guide

Structure ofDifference

CSMS (IEC 62443-2-1)

Main text【126 requirements in total】

Commonrequirements
Specificrequirements

ISO/IEC 27002（code of practice for controls）

Management
System (MS)GuideControls
Annex A (informative)
Guide on thedevelopment ofCSMS elements

ISO62443-2-1 and ISO 27001 have different level ofrequirement description, mapping multiple requirements
to a single requirement.

Being
proposedas
IEC 62443-2-2

Source: “The development of security management system for control systems”, IPA, October 2012

9 Dissemination of the CSMS Scheme
From the perspective of management systems, theorganization’s control system will strategically utilize theirdevelopment and management of CSMS have the effect ofCSMS certification in expanding international business.

continually improving the effectiveness of security

If many of the control system owners, operation /measures on control systems. Disseminating CSMS ismaintenance services and system integrators acquire

therefore an important approach for industrial and social

CSMS certification, the security measures for control

infrastructures. It is expected that, by spreading CSMS

systems are expected to improve continually across ourcertification services by accredited certification bodies,society.

2014

2015

2016

Launchof the CSMS Scheme

Disseminationof the CSMS Scheme

Expanded disseminationof the CSMS Scheme

Analyzing industry-specific

Developing a guide based on
accumulated know-how

Developing the Strategic Guide

characteristics and accumulatingknow-how
Spreading the Users Guide

5

Clarifying and utilizing businessadvantages in acquiring thecertification

Expanding the dissemination ofindustry-specific certification

em
10 Standards associated with control system security
In the field of control systems, in addition to IEC 62443

aviation, and manufacturing industry sectors with highseries of standards for general use, there are individual

proportion of organizations involved in control systems.

control system standards for each relevant sector –Among those standards, CSMS can be widely applied to

critical infrastructure sectors such as electricity including

the sectors.

the smart grid, gas, water and sewerage, railway andOverview of CSMS-related standards
General-purpose
control systems

Source：Hitachi Review Vol. 63（2014）, No. 5

PetrochemicalplantsPower systems

Smart grids

ISO 22320 (emergency management)

Social security

ISO/IEC62278（RAMS）

Organizations

Security

Railway systems

IEC62443

Systems

ISASecurecertification(SSA)

WIB certification

Achilles certification

Devices(EDSA)

Specifictechnologies(encryption, etc.)

NERC
CIPIEEE
1686

IAEA
Nuclear
Security
Recommendations
Rev. 5NISTIR
7628

IEC 62280

IEEE 2030

ISO/IEC
29192

IEC 62351

SSA(System Security Assurance),EDSA（Embedded Device Security Assurance）,NERC（North American Electric Reliability Corporation）,CIP（Critical Infrastructure Protection）,IAEA（International Atomic Energy Agency）,NISTIR（National Institute of Standards and Technology
Interagency Report）,RAMS（Reliability,Availability,Maintainability and Safety）

・・・・International standard
・・・・Industry standard

11 Trends of the IEC 62443 series
CSMS certification is intended for control system

Security Compliance Institute ( ISCI ) provides aowners, organizations providing operation / maintenancecertification program for control system components

services and system integrators. In contrast, EDSA

(products). The standards used as the basis for thecertification is for products and equipment. The ISA

program have been reflected to the IEC 62443 series.

Category
CommonSecurity programs

Systems

Components*Main target
Overall

Control systemowners andadministrators

Control systemdevelopers

Components

The draft titles may be subject to change.

Standard code

Standard name

IEC/TS 62443-1-1：2009

Terminology, concepts and models

IEC/TR 62443-1-2

Master glossary of terms and abbreviations

IEC 62443-1-3

System security compliance metrics

IEC/TR 62443-1-4

IACS security life cycle and use case

IEC 62443-2-1：2010

Establishing an industrial automation and control system security program

IEC 62443-2-2

Operating an industrial automation and control system security program

IEC/TR 62443-2-3

Patch management in the IACS environment

IEC 62443-2-4

Requirements for IACS solution suppliers

IEC/TR 62443-3-1：2009

Security technologies for industrial automation and control systems

IEC 62443-3-2

Security levels for zones and conduits

IEC 62443-3-3：2013

System security requirements and security levels

IEC 62443-4-1

Product development requirements

IEC 62443-4-2

Technical security requirements for IACS components
Reference: Information-Technology Promotion Agency, Japan6

Registration No. 5662324● Contact Information ●Roppongi First Building, 9-9 Roppongi 1-chome, Minato-ku Tokyo, 106-0032
JIPDEC IMPCTEL ＋81-3-5860-7570
FAX ＋81-3-5573-0564
URL http://www.isms.jipdec.or.jp/Document No. JIP-CSMS120-1.0（E）

JIPDEC IMPC
Roppongi First Building, 9-9 Roppongi 1-chome, Minato-ku Tokyo, 106-0032
TEL ＋81-3-5860-7551 FAX ＋81-3-5573-0560
URL http://www.jipdec.or.jp/December 2014