Session: IIOT Value Chain Security – the Application of Trustworthiness Profile

The RRI’s Industrial Supply Chain Security
Questionnaire for Trustworthiness Evaluation

15 th Oct. 2021
Robot Revolution & Industrial IoT Initiative (RRI)
Junya Fujita (R&D Group, Hitachi, ltd.)
2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

Agenda1. Introduction

2. RRI’s Questionnaire for Trustworthiness Profile
3. Conclusion and Next Step

2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

Agenda1. Introduction

2. RRI’s Questionnaire for Trustworthiness Profile
3. Conclusion and Next Step

2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

Background - Global Supply Chain and Security Risks
RRI and Plattform Industrie 4.0 (PI4.0) are discussing“Trustworthiness” architectures in global supply chains for next-generation industry⁃ Next-generation global supply chains are accelerated by information technologies⁃ Product suppliers can realize followings with the global supply chains:•Develop products that satisfy rapidly changing customer needs•

Collaborate with suppliers to develop their products securely•Find appropriate suppliers timely through the Internet⁃ The global supply chains require a comprehensive “Trustworthiness” architecture
covering all entities, regardless of their geographical location

The image of next-generation global supply chains
The image is from the whitepaper “IIoT supply chain Security –The role of Trustworthiness.

2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

1

Online Procurement and Digital Agreement
Online procurement & digital agreement are keys of global supply chains

Online Procurement

Digital Agreement- Authenticity of parties- Security capabilities of products- Security capabilities of production activities
Exchange Trustworthiness Profile (TWP)- Authenticity of the organization as a legal
entity represented by a legal entity ID- Authenticity of the signer as a responsible
natural person represented by a naturalperson ID

Today’s focus

2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

2

Exchange Trustworthiness Informationin Online Procurement
Organizations exchange machine-readable “TWP” with each other before contracting⁃ RRI and PI4.0 had discussed the TWP exchange architecture, which provides adigitalized trustworthy relationships between buyers and suppliers
Global Trusted
Security Infrastructure
Criteria to evaluate“Trustworthiness”
e.g. a status of security controls

Buyer(Product manufacturer)

Define items of“Ability to trust”

Suppliers

Questionnaire
Q1...?
Q2...?

*machine-readable format(e.g. HTTP/Web tech.)

Security questionnaire
Answers

Evidence

A1...
A2...

-CERT1-CERT2TWP

TWP

Supplier A

Supplier B

TWL:High

TWL:Low
TWL: Trustworthiness Level

Answered questionnaire✓ Evaluate “Trustworthiness”
based on answer & evidences

ContractSupplier A

Purchase Order

Select “the most trusted” supplier2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

3About Trustworthiness Profile (TWP)
PI4.0 & RRI discussed the TWP exchanging architecture in detail◆ Potential contents of TWP (with respect of security)➢ Standard based (The aspect of security: ISO 2700x, IEC 62443, VDA-ISA, METI CPSF, etc)
➢ Security controls practiced in the manufacturing field
RRI had developed a questionnaire to visualize TWP element(Security management and operation aspects)
Images of RRI’s questionnaire [1]◆ The exchange protocol of TWP➢ Trustworthiness Expectations and Capabilities Exchange Protocol (TECEP)➢ Technical solution of trustworthiness negotiation and exchange between peers➢ Automating of the supplier (and/or product) qualification and selection process

Images of TECEP [2][1] https://www.jmfrri.gr.jp/content/files/Open/2021/RRI%20Questionaiere/RRI%20Questionniare__EN_v1.0(J).pdf[2] https://www.jmfrri.gr.jp/content/files/Open/2020/20201014_iSec/IIoT_Value_Chain_Security.pdf

2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

4

A Brief Introduction of RRI’s Questionnaire

What is the RRI’s Questionnaire?
• Buyers can evaluate trustworthiness level (withrespect of security) of suppliers by
25 questions before signing a contract• Questions are based on standards (METI CPSFand IEC 62443) and practices in the Japaneseindustry (Companies of RRI members)• Buyers can visualize the maturity level of thecurrent security status of suppliers prior tocontracting
JP https://www.jmfrri.gr.jp/document/library/1890.html
EN https://www.jmfrri.gr.jp/english/document/library/1892.html

2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

5Agenda
1. Introduction

2. RRI’s Questionnaire for Trustworthiness Profile
3. Conclusion and Next Step

2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

How to Develop RRI Questionnaire

104 requirements in CPSF

Additional requirementsfrom industrial standards
development/development
environment/procurement/
Operation & maintenance(O&M)/
Production equipment
MarketNeeds

Order

Dev.

Manufact
uring

SupplyEnhancement of Product Value

ProductDev.
Env.

Logistics

Procurement

IACSOperation&maintenance

Organization

Manufacturer

The Manufacturer
Order
Supply& Supplier Model*CPSF:Cyber/Physical Security Framework (CPSF)
https://www.meti.go.jp/english/press/2019/0418_001.html

Requirements

Enhancement of Product Value

ProductRRI’s
Questionnaire(25 questions)

Pick up important
requirements based onpractices in industry

Manufacturing

Dev.
Dev.
Env.

Procurement

IACS

Logistics

Operation&maintenance

Organization

Supplier*IACS(Industrial Automation and Control System)*Dev.(Development)*Env.(Environment)
Selected category for questionnaire2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

6An example Item in Questionnaire
Category

Governance

Security requirement

Develop and announce security policies, define roles and responsibilities for security across theorganization and other relevant parties (Suppliers) .

History of security policy development and approval, and approval of revisions to thesecurity policy. Describe the security roles and responsibilities of the organization and otherrelevant organizations (e.g., contractors), and any arrangements for security withcontractors in the security policy.

Evidence

The security officer of the organization has developed (documented) a security policy.

１Example: Answer

Maturitylevel２□Implemented □Planned to be implemented □Not applicable

The organization's Chief information security officer has approved and implemented thesecurity policy. The organization manages and implements the approved documents.
□Implemented □Planned to be implemented □Not applicable３

The organization's security officer and chief information security officer regularly review,update, and maintain security policies.
□Implemented □Planned to be implemented □Not applicable2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

7

Metrics to Evaluate Items in Questionnaire
Evaluate “Maturity Level” of suppliers’ security management and operation◆ Check maturity level by two axes

➀ Management–layer process: Processes by high-level
management side (Senior managers)➁ Operation-layer process: Security processes by
manufacturing and production side (Personnel in fields)

Risk Informed

Level2
PartialLevel1➀Management・Partially implemented
by organization level➀Management・Implemented by organizationand got approval by a chief
security officer➁Operation・Documented and developed

RepeatableLevel3➀Management
・Implemented, reviewed andadapted by organization
・Got approval by a chief
security officer➁Operation
・Documented, developed
・Reviewed, updated➁Operation
・Documented

Fulfilling contents and evidence of the process
Improving the risk management process2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

8Use-case for TWP Evaluation
Useful for selecting the most “Trusted“ supplier in procurement process
Supplier
Answer from supplier = Supplier’s TWP

Buyer
Expected level for TWP = requirement

Supplier A

Selected supplier
Security
Requirements

Supplier B
level１ level２ level３
Maturity level

Supplier C

The highest TWL
Supplier C

2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

9Collaboration Activities between RRI and PI4.0
On German side, a R&D project that develops “TWP demonstrator”(Ref.) https://legaltestbed.org/en/trust-demonstrator/

The questionnaire is incorporated into the demonstrator
Trustworthiness Profile
To be filled by the Buyer

To be filled by the SupplierSupplier s Information

Buyer s Information
Contact Partner:*Contact Partner s Unique Identifier:Contact Partner:*Contact Partner s Unique Identifier:Contact Information:
Legal Entity Name:*Legal Entity Unique Identifier:*Unique Identifier Scheme: (e.g., link to LEI code repo, VATIN by DUNS, NTA by TSE, etc.)
Country:
Additional Information:

Contact Information:
Legal Entity Name:*Legal Entity Unique Identifier:*Unique Identifier Scheme: (e.g., link to LEI code repo, VATIN by DUNS, NTA by TSE, etc.)
Country:
Additional Information:

Trustworthiness Expectations
Additional Information

Supplier
Self
Conformance

Proof/Evidence
Proof/ Evidence

Proof Expiry Date

Self-Assessment

3rd-Party AssessementUpload/Attach

DD.MM.YYYY*Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY*Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach

Conform:

Self-Assessed

3rd-Party Assessement

Upload/Attach

DD.MM.YYYY

Upload/Attach*ISO 27001

Upload/Attach

Buyer’sRequired TWP
Upload/Attach

Common Criteria

PSS Supplier Questionnaire

Reference Request-for-work

Digital Signature

3rd party
Conform:

ISO/IEC 62443-4-2

NIST SP 800

RRI’s questionnaire
is incorporated

Trustworthiness Capabilities

Expected Validity*

Time Stamp

Digital Certificate (If required)

Reference TW Expectations

Supplier’sTWP

Quote/Bid Reference

Digital Signature

Additional Information

Time Stamp

Digital Certificate (If required)

The image of TWP demonstrator
The image is from the whitepaper “IIoT supply chain Security –The role of Trustworthiness.

2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

10

Agenda1. Introduction

2. The Germany-Japan Agreed Trustworthiness Communication Rule
3. Conclusion and Next Step

2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

Conclusion and Next Step

⁃ Japan(RRI) and Germany (PI4.0) are collaborating to establish a trustworthinessarchitecture for the next-generation industries⁃ RRI established a template of security questionnaires through the collaboration⁃ RRI expects the questionnaire and the answer for the questionnaire would bestandardized, would be used digitally for online contracts⁃ RRI and PI4.0 continue to discuss security issues in global supply chainsand continue to announce the result to the world continuously

2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.

11

Thank you!
junya.fujita.so@hitachi.com

2021 Copyright Robot Revolution & Industrial IoT Initiative, All Rights Reserved.