NIST Interagency Report
NIST IR 8473

Cybersecurity Framework Profile
for Electric Vehicle Extreme Fast
Charging Infrastructure
Jim McCarthy
Nakia Grayson
Joseph Brule
Tom Cottle
Alan Dinerman
John Dombrowski
Josie Long
Hillary Tran
Karen Quigg
Michael Thompson
Anne Townsend
Nik Urlaub
This publication is available free of charge from:https://doi.org/10.6028/NIST.IR.8473

NIST Interagency Report
NIST IR 8473

Cybersecurity Framework Profile
for Electric Vehicle Extreme Fast
Charging Infrastructure
Jim McCarthy*
Nakia Grayson

Applied Cybersecurity Division
Information Technology Laboratory

Joseph Brule
Tom Cottle
Alan Dinerman
John Dombrowski
Josie Long
Hillary Tran
Karen Quigg
Michael Thompson
Anne Townsend
Nik Urlaub

The MITRE Corporation
McLean, VA*Former NIST employee; all work for thispublication was done while at NIST.

This publication is available free of charge from:https://doi.org/10.6028/NIST.IR.8473
October 2023

U.S. Department of Commerce
Gina M. Raimondo, Secretary
National Institute of Standards and Technology
Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified inthis paper in order to specify the experimental procedure adequately. Such identification does not imply
recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or
equipment identified are necessarily the best available for the purpose.
There may be references in this publication to other publications currently under development by NIST in
accordance with its assigned statutory responsibilities. The information in this publication, including concepts andmethodologies, may be used by federal agencies even before the completion of such companion publications. Thus,
until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain
operative. For planning and transition purposes, federal agencies may wish to closely follow the development ofthese new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback
to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available athttps://csrc.nist.gov/publications.
NIST Technical Series Policies
Copyright, Use, and Licensing Statements
NIST Technical Series Publication Identifier Syntax
Publication History
Approved by the NIST Editorial Review Board on 2023-10-05
How to Cite this NIST Technical Series Publication:
McCarthy J, Grayson N, Brule J, Cottle T, Dinerman A, Dombrowski J, Long J, Tran H, Quigg K, Thompson M,
Townsend A, Urlaub N (2023) Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging
Infrastructure (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency Report (IR)NIST IR 8473. https://doi.org/10.6028/NIST.IR.8473
Author ORCID iDs
Jim McCarthy: 0000-0002-5559-733X
Nakia Grayson: 0000-0003-1062-4338
Michael Thompson: 0000-0002-0836-244X
John Dombrowski: 0000-0002-9408-1838
National Institute of Standards and Technology
Attn: Applied Cybersecurity Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 2002) Gaithersburg, MD 20899-2002
All comments are subject to release under the Freedom of Information Act (FOIA).

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Abstract
This document is the Cybersecurity Framework Profile (Profile) developed for the Electric
Vehicle Extreme Fast Charging (EV/XFC) ecosystem, including the four domains that relies on
the ecosystem (i) Electric Vehicles (EV); (ii) Extreme Fast Charging (XFC); (iii) XFC Cloud or
Third-Party Operations; and (iv) Utility and Building Networks. This Profile utilizes the NIST
Cybersecurity Framework Version 1.1 and provides voluntary guidance to help relevant parties
develop Profiles specific to their organization to understand, assess, and communicate theircybersecurity posture as a part of their risk management process. The Profile is intended tosupplement, not replace, an existing risk management program or cybersecurity standards,
regulations, and industry guidelines that are in current use by the EV/XFC industry.
Keywords
Cybersecurity Framework; electric vehicle, EV/XFC ecosystem; extreme fast charging;
Framework; mission objectives; profile; risk management; security controls.
Reports on Computer Systems Technology
The Information Technology Laboratory (ITL) at the National Institute of Standards andTechnology (NIST) promotes the U.S. economy and public welfare by providing technicalleadership for the nation’s measurement and standards infrastructure. ITL develops tests, test
methods, reference data, proof of concept implementations, and technical analyses to advancethe development and productive use of information technology. ITL’s responsibilities include thedevelopment of management, administrative, technical, and physical standards and guidelines forthe cost-effective security and privacy of other than national security-related information infederal information systems.
Department of Energy Points of Contact
The National Cybersecurity Center of Excellence (NCCoE) would like to thank the following
Department of Energy (DOE) colleagues for their collaboration on this profile.
Lee Slezak - DOE, Office of Energy Efficiency and Renewable Energy (EERE)
Jessica Yoo Perry – DOE, Office of Cybersecurity, Energy Security, and Emergency Response(CESER)
Acknowledgements
The National Cybersecurity Center of Excellence (NCCoE) would like to thank the following
individuals for their discussions and insights during the development of this profile.
Nicole K. Bell, NIST Guest Researcher
Dr. Sunil M. Chhaya, Electric Transportation Program (EPRI)iNIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Lovington Dela Cruz, Arcadis
Katya Delak, NIST Office of Weights and Measures
Alexis Diamond, NIST Guest Researcher
Gregory Brian Dindlebeck, Pacific Northwest National Laboratory
Xavier Francia, DER Cybersecurity Program (EPRI)
Dr.-Ing. Friedrich Emanuel Hust, Mercedes-Benz AG
Alexander Irrgang, Mercedes-Benz AG
Pamela K. Isom, IsAdvice & Consulting
Moe Kia, BC Hydro
Ramesh Krishnasagar, Bp
Alanna Quail, Via Motors
Lionel Richard Saposnik, Saiflow
Dor Shmaryahu, SaiFlow
Or Shwartz, SaiFlow
Werner Streich, P3 Group
Mauricio Tavares, Privacy Test Driver
Jennifer Tisdale, GRIMM

ii

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Patent Disclosure Notice
NOTICE: ITL has requested that holders of patent claims whose use may be required forcompliance with the guidance or requirements of this publication disclose such patent claims to
ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL
has not undertaken a patent search in order to identify which, if any, patents may apply to thispublication.
As of the date of publication and following call(s) for the identification of patent claims whose
use may be required for compliance with the guidance or requirements of this publication, nosuch patent claims have been identified to ITL.
No representation is made or implied by ITL that licenses are not required to avoid patent
infringement in the use of this publication.

iii

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Table of Contents
Introduction ......................................................................................................................... 1
Purpose ......................................................................................................................... 2
Scope ............................................................................................................................ 2
Audience ....................................................................................................................... 4
Intended Use ........................................................................................................................ 5
EV/XFC Cybersecurity Mission Objectives ....................................................................... 5
Mission Objective 1: Deliver Reliable Performance through Secure Communications . 6
Mission Objective 2: Maintain Resilience of the XFC Infrastructure .............................. 7
Mission Objective 3: Build and Maintain Trustworthy Relationships with Partners
and Customers .............................................................................................................. 7
Mission Objective 4: Maintain Continuity of Operations ................................................ 8
Overview of the Cybersecurity Framework ...................................................................... 8
The Framework Core .................................................................................................... 9
Sector-Level Profiles ................................................................................................... 12
XFC Baseline Profile ......................................................................................................... 12
Identify Function .......................................................................................................... 125.1.1.

Asset Management Category .................................................................................. 13

5.1.2.

Business Environment Category ............................................................................. 19

5.1.3.

Governance Category ............................................................................................. 23

5.1.4.

Risk Assessment Category ..................................................................................... 26

5.1.5.

Risk Management Category .................................................................................... 29

5.1.6.

Supply Chain Risk Management Category ............................................................. 31
Protect Function Considerations Across the EV/XFC Domains .................................. 35

5.2.1.

Identity Management, Authentication and Access Control Category ...................... 35

5.2.2.

Awareness and Training Category .......................................................................... 41

5.2.3.

Data Security Category ........................................................................................... 44

5.2.4.

Information Protection and Processes Category ..................................................... 51

5.2.5.

Maintenance Category ............................................................................................ 59

5.2.6.

Protective Technology Category ............................................................................. 61
Detect Function Considerations Across the EV/XFC Domains ................................... 66

5.3.1.

Anomalies and Events............................................................................................. 67

5.3.2.

Security Continuous Monitoring .............................................................................. 70

5.3.3.

Detection Processes ............................................................................................... 75
Respond Function Considerations Across the EV/XFC Domains ............................... 78

5.4.1.

Analysis ................................................................................................................... 78

iv

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

5.4.2.

Communications...................................................................................................... 82

5.4.3.

Improvements Category .......................................................................................... 85

5.4.4.

Mitigation ................................................................................................................. 87

5.4.5.

Response Planning ................................................................................................. 90
Recover Function Considerations Across the EV/XFC Domains ................................ 90

5.5.1.

Communications...................................................................................................... 91

5.5.2.

Improvements.......................................................................................................... 93

5.5.3.

Recovery Planning .................................................................................................. 94

References ................................................................................................................................. 96
Appendix A.

List of Symbols, Abbreviations, and Acronyms ....................................... 102

List of Tables
Table 1. Function and Category Unique Identifiers. ................................................................... 11
Table 2. Identify: Asset Management Category. ........................................................................ 14
Table 3. Identify: Business Environment Category. .................................................................... 19
Table 4. Identify: Governance Category. .................................................................................... 24
Table 5. Identify: Risk Assessment Category. ............................................................................ 26
Table 6. Identify: Risk Management Category. .......................................................................... 30
Table 7. Identify: Supply Chain Risk Management Category. .................................................... 32
Table 8. Protect: Identity Management, Authentication and Access Control. ............................. 35
Table 9. Protect: Awareness and Training Category. ................................................................. 42
Table 10. Protect: Data Security Category. ................................................................................ 45
Table 11. Protect: Information Protection Processes and Procedures Category. ...................... 52
Table 12. Protect: Maintenance Category. ................................................................................. 60
Table 13. Protect: Protective Technology Category. .................................................................. 61
Table 14. Detect: Anomalies and Events Category. ................................................................... 67
Table 15. Detect: Security Continuous Monitoring Category. ..................................................... 70
Table 16. Detect: Detection Processes Category. ...................................................................... 75
Table 17. Respond: Analysis Category. ..................................................................................... 78
Table 18. Respond: Communications Category. ........................................................................ 82
Table 19. Respond: Improvements Category. ............................................................................ 86
Table 20. Respond: Mitigation Category. ................................................................................... 87
Table 21. Respond: Response Planning Category. ................................................................... 90
Table 22. Recover: Communications Category. ......................................................................... 91
Table 23. Recover: Improvements Category. ............................................................................. 93
Table 24. Recover: Recovery Planning Category. ..................................................................... 95

List of Figures
Fig. 1. Charging an EV. ................................................................................................................ 2
Fig. 2. EV/XFC Ecosystem Domains and Profile Scope. ............................................................. 4v

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Introduction
To address risks to critical infrastructure, the Cybersecurity Enhancement Act of 2014 [S.1353]
assigned responsibility to the National Institute of Standards and Technology (NIST) to identify
and develop cybersecurity risk frameworks for voluntary use by critical infrastructure owners
and operators. This formalized NIST’s previous work developing Version 1.0 of the Framework
under Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity, andprovided guidance for future Framework evolution [EO.13636]. The NIST Cybersecurity
Framework [NIST-CSF] is a voluntary, risk-based assemblage of industry standards and bestpractices designed to help organizations manage cybersecurity risks. Standards listed in theinformative reference section are simply recognized best practices or provide relevant
information and are not meant to represent any type of regulatory or compliance mandate fromthis document. Informative references listed under “Ecosystem” can provide additional
information or best practices for any ecosystem member, references listed under specificdomains (EV, XFC/EVSE, Cloud/Third-Party, Utility/Building Management Systems) can
provide information or best practices for that domain.
The number of electric vehicles (EVs) is projected to be 24.6M by 2030 [EEI-2022]. The EV
infrastructure was prominently included in the Infrastructure Investment and Jobs Act and is also
expected to grow. As of 2023, there were over 48,000 public charging stations in the US, and acommitment by the Infrastructure Investment and Jobs Act is in place to increase this number to
500,000 by 2030. The U.S. EV charging infrastructure market size was valued at $3.15B in 2022
and is expected to grow to $24B by 2030. [Grandview]
Given the current value, expected growth, potential for cyber-related attacks, and the criticalityof the transportation and energy sectors, the Department of Energy (DOE) in collaboration with
the Electric Power Research Institute (EPRI) studied the Electric Vehicle/Extreme Fast Charging
ecosystem (EV/XFC ecosystem). Recognizing the need for relevant parties to assess theircybersecurity posture as a part of risk management, the DOE commissioned NIST to apply the
NIST Cybersecurity Framework (CSF) to the EV/XFC ecosystem.
This document is the result of that effort. The Cybersecurity Framework Profile for Extreme Fast
Charging (XFC) Infrastructure (referred to herein as the EV/XFC Cybersecurity Framework
Profile) is a sector-level profile. The EV/XFC Cybersecurity Framework Profile is an applicationof the Framework Categories and Subcategories in the context of the EV/XFC cybersecurity
ecosystem identified by the DOE and EPRI and NIST tailored the CSF to apply to ecosystem.
The EV/XFC Cybersecurity Framework Profile provides ecosystem-relevant parties a means toassess and communicate their cybersecurity posture, by addressing risks specific to theecosystem using the structure of the Cybersecurity Framework. The EV/XFC Cybersecurity
Framework Profile provides users with an industry-level risk-based approach for managing
cybersecurity activities and facilitates cross-collaboration between the various industry relevant
parties, vendors, and end users.

1

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Fig. 1. Charging an EV

PurposeThe EV/XFC Cybersecurity Framework Profile is designed to be part of an enterprise risk
management program to aid organizations in managing threats to systems, networks, and assets
within the EV/XFC ecosystem. The EV/XFC Cybersecurity Framework Profile is not intended toserve as the only solution or as a compliance checklist. Users of this profile will understand thatits application cannot eliminate the likelihood of disruption or guarantee some level of assurance.
Use of the Profile will help organizations:•

Identify key assets and interfaces in each of the ecosystem domains.

•

Address cybersecurity risk in the management and use of EV/XFC services.

•

Identify the threats, vulnerabilities, and associated risks to EV/XFC services, equipment,
and data.

•

Apply protection mechanisms to reduce risk to manageable levels.

•

Detect disruptions and manipulation of EV/XFC services.

•

Respond to and recover from EV/XFC service anomalies in a timely, effective, andresilient manner.
Scope

The EV/XFC ecosystem relies on multiple connected domains. This Profile addresses the four
major domains in the EV/XFC ecosystem:•

EV. EVs come in a variety of shapes and sizes—motorcycles, cars, Electric Vehicle
Take-Off and Landing (EVTOL) equipment, such as drones or aircraft, and commercial
vehicles (e.g., tractor-trailers, construction vehicles, buses). EVs rely on multiple
networking systems to communicate internally and with external entities. Internally, there
are control systems for batteries, motors, charging, and the vehicle itself that operates
through an internal Control Area Network (CAN). The charger and vehicle communicate

2

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

through a physical connector. The vehicle communicates with vendor cloud/third-party
organizations via Bluetooth, Wi-Fi, or cellular.
•

XFC/EVSE. Electric Vehicle Supply Equipment (EVSE) consists of systems thatprovide electric power to the vehicle to recharge the vehicle’s batteries. EVSE systems
include electrical conductors, related equipment such as Battery Energy Storage Systems(BESS), software, and communications protocols that deliver energy efficiently andsafely to the vehicle. Extreme Fast Charging (XFC) is a type of EVSE that is capable ofrecharging vehicles in a manner of minutes rather than hours. [Energies-2019] In addition
to connecting to the EV, the XFC/EVSE and related equipment must connect andcommunicate with cloud providers and third-party vendors for providing EVSE location
information, billing, and other services.

•

Cloud/Third-Party Organizations. The EV/XFC ecosystem consists of independently
owned and operated domains, and most charging stations are operated by a charging
network with business models that blend station, electricity, and vehicle charging sales
together. Third parties are individuals or entities that facilitate transactions but are notone of the primary parties within the exchange. The EV/XFC ecosystem typically uses
cloud service providers for these transactions because they are suitable for sensitive dataexchanges that involve financial information, personally identifiable information (PII),
and other potentially sensitive data.

•

Utilities/Building Systems. Utilities provide the power necessary to fuel the EV/XFC
ecosystem. Building and facility management systems may be present in installations
where energy management is required, such as EVSE installed at shopping centers, aswell as where distributed energy resources (DER) may be present or where physicalsecurity control is required. Both utilities and building/facility management systems
include equipment to monitor power utilization, communicate with networked devices
and supervisory systems, and help control on-site energy demands.

The scope of cybersecurity and enterprise risk management includes operational technology(OT) in addition to information technology (IT). While managing cybersecurity risks is equallyimportant to IT and OT processes, there are considerable operational differences between thetwo, which may impact the implementation of risk management techniques for IT vs OT. Despite
these differences, the interdependencies between IT and OT are increasing, which leads toincreasing reliance of OT on IT processes and possibly inherited vulnerabilities and risks
between the two technologies.
The EV/XFC ecosystem has always relied on a combination of IT and OT processes. Integrated
risk management includes a collaboration of IT and OT professionals to generate integrated
assessments, mitigations, and recovery plans.
The foundational concepts used to define the EV/XFC Cybersecurity Framework Profile’s scopewere derived from previous research and documentation developed by the Electric Power
Research Institute (EPRI) [EPRI-2023] as illustrated in Fig. 2 below. Power generation andcommunications within the utility are outside the scope of the EV/XFC Cybersecurity
Framework Profile.

3

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Fig. 2. EV/XFC Ecosystem Domains and Profile Scope

Audience
The EV/XFC Cybersecurity Framework Profile may be used by any number of relevant parties
within the EV/XFC ecosystem. The relevant parties within the ecosystem are diverse andgrowing. Members of the ecosystem include:•

EV owners (including individuals in the general public and fleet owners)•

EV manufacturers•

EVSE owners/operators•

EVSE manufacturers•

Cloud/Third-Party providers•

Utility owner/operators•

Building Network Owners/Providers•

Suppliers/Vendors

This document is intended for organizations and relevant parties involved in the EV/XFC
industry that use or produce EV/XFC services, systems, and related components such as:•

Public and private organizations that use or provide EV/XFC services•

Managers responsible for the use or provision of EV/XFC services•

Risk managers, cybersecurity professionals, and others with a role in risk management
for systems that use or provide EV/XFC services•

Procurement officials responsible for the acquisition of EV/XFC infrastructure orservices•

Mission and business process owners responsible for achieving operational outcomes
dependent on EV/XFC services

4

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

The EV/XFC Cybersecurity Framework Profile is intended for a general audience and is broadly
applicable. The Profile applies to organizations that:•Have already adopted the NIST Cybersecurity Framework to help identify, assess, andmanage cybersecurity risks.

•

Are familiar with the Framework and want to improve their risk postures.

•

Are unfamiliar with the Framework but need to implement risk management frameworks
for their organization.

Intended Use
The EV/XFC Cybersecurity Framework Profile provides a framework that organizations may
use to assess their cybersecurity posture (both the “as is” and “to be” states) as a part of their risk
management processes and procedures. This profile provides guidance, and its use is voluntary.
The Profile provides an assessment methodology for organizations to determine risks and thepotential impacts of cyber-based disruptions to the EV/XFC ecosystem. The Profile is intended
to help organizations within the EV/XFC community prioritize cybersecurity activities based on
their mission objectives.
Additionally, the Profile can be used to help organizations identify areas where standards,
practices, and other guidance can help manage risks to systems that use EV/XFC services. An
organization can use the Profile in conjunction with its processes for identifying, assessing, andmanaging risk. The Profile is intended to complement, not replace, the organization’s existingrisk management processes. This Profile is intended to be used as a foundational profile, andspecific organizations can customize the EV/XFC Cybersecurity Framework Profile byconsidering the following questions:•

What are the mission objectives for the organizations within the ecosystem?

•

What processes or assets support the mission objective?

•

What processes and assets are vulnerable to disruption or degradation?

•

What is the impact to the mission should a process or asset be lost or degraded?

•

What are the integrity and availability thresholds of EV/XFC to avoid mission impact?

•

What safeguards are available?

•

What techniques can be used to detect events of concern?

•

What techniques can be used to respond to events of concern?

•

What techniques can be used to recover pre-event capabilities?

EV/XFC Cybersecurity Mission Objectives
The Mission Objective is defined as a high-level goal that must be achieved for an organization
to succeed at its primary mission or purpose. Often the development of a Profile starts with theidentification of an organization’s mission objectives. The EV/XFC Cybersecurity Mission
Objectives provide the context for an organization to manage its cybersecurity risk as it relates to
5

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

its specific mission needs. To ensure that the Profile aligns cybersecurity outcomes with mission
requirements, input from stakeholders and experts in a particular field is critical. CSF Categories
and Subcategories especially relevant to each mission objective can then be identified andprioritized to fit the needs of the organization.
Mission objectives identified in this CSF Profile are those that may be common to organizationsin the Electric Vehicle Extreme Fast Charging industry but recognizes that individual mission
objectives may vary by organization. After identifying the Mission Objectives, an organization
can use this information for prioritizing areas of particular concern. Prioritization is meant to be
informative rather than prescriptive.
For this profile, between February 2023-May 2023, NCCoE hosted 12 virtual working groupsessions for EV/XFC ecosystem and the four major domains in the EV/XFC ecosystem
identified above in 1.2 Scope. The working group discussions resulted in four Mission
Objectives that characterize high-level critical operational needs to an organization to meet its
primary mission in the EV/XFC ecosystem including the four domains. Each organization should
consider its own goals and priorities when consulting this Profile and adjust how the organization
may apply guidance accordingly. The following Mission Objectives listed in the sections below
can serve as a starting point for a particular organization to define their own Mission Objectives
but should not be considered an exhaustive list as they do not directly address every technicalaspect of the EVSE ecosystem.
Mission Objective 1: Deliver Reliable Performance through Secure
Communications
Communicating across the XFC infrastructure is critical to the performance in the EV/XFC
ecosystem and the success of the EV industry. Because of this in tandem dependency, thecommunications should be reliable and secure to fulfill the ecosystem’s mission needs. The XFC
infrastructure faces many operational and cybersecurity threats and vulnerabilities, especially to
its communication infrastructure; therefore, greater attention is needed to securecommunications. Secure communications enable fundamental EV/XFC activities, such as
charging experience, billing processes, and availability of charging stations.
The rationale for this Mission Objective includes:•

EV. Communication between the EV (battery management system) and the charging
station is necessary to facilitate the EV battery charging process. The EV connects tocloud/third-party applications to manage the transactions and collect data. EV user
systems (e.g., infotainment) also may communicate with other vehicle systems, such as
the charge controller and battery management systems. The interface between theseapplications presents a potential attack surface for malicious actors to cause damage.

•

XFC/EVSE. The charging station requires secure communication to the cloud tofacilitate financial transactions, provide authorization to charge, collect maintenance logs,
and receive updates. Additionally, the charging station draws power from the meteredutility.

•

Cloud/Third-Party. Cloud service providers require reliable secure connections to theEV, charging station, and the utility to facilitate the charging process. Secure reliablecommunications allow for validation of financial transactions, protect personal
6

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

information, and allow for maintenance updates and logs to be transmitted quickly andeconomically.
•

Utility/Building Management Systems. Utilities and building management systems
provide power to the charging station. Coordination between the XFC chargers andutilities is required for various smart grid applications such as peak shaving/load shiftingor forecasting. Where this communication exists, it must be reliable and secure.
Mission Objective 2: Maintain Resilience of the XFC Infrastructure

All users in the EV/XFC ecosystem should have reliable access to services. A loss ofcybersecurity may impact physical security; therefore, organizations must implement safeguards
to ensure the cyber resilience of the EV/XFC ecosystem. All cybersecurity decisions should bebalanced with business needs to maintain usability of the system while keeping the ecosystemsecure and resilient.
The rationale for this mission objective includes:•

EV. EV owners want assurance that their vehicle is protected before they are willing toparticipate in the charging ecosystem. Batteries are a significant expense, and acompromised XFC ecosystem could potentially lead to physical damage to the battery,
EV components, and other nearby equipment. Thus, implemented safeguards will easethe minds of users and encourage them to use the charging stations.

•

XFC/EVSE. Due to the unique position of charging stations in the ecosystem,
geographical dispersion, and general lack of physical security, charging stations havebecome an appealing target for threat actors. EVSE infrastructures should be protected,
both cyber and physical, to prevent attacks like ransomware or damage to the charging
infrastructure itself.

•

Cloud/Third-Party. The cloud/third-party environment facilitates connectivity between
domains of the infrastructure. It should be protected to maintain operations.

•Utility/Building Management Systems. Utilities and building management systems
should have protection systems in place to prevent manipulation of utility components tomaintain safe operations.
Mission Objective 3: Build and Maintain Trustworthy Relationships with
Partners and Customers

EV/XFC cybersecurity requires collection and use of partner and customer data from manysources. Building and maintaining relationships with relevant parties demands organizations
consider and mitigate against risks throughout the information lifecycle. Protecting theconfidentiality of sensitive information (e.g., system status information) ensures confidence inthe organization and establishes trust among partners and with customers. Personal information
should also be protected (e.g., credit card information, individual XFC usage patterns) to ensurethat user information is not correlated for inappropriate use, resulting in a loss of trust fromusers. Cybersecurity disruptions to systems can impact product quality, leading partners, andcustomers to question the trustworthiness of the organization.

7

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

The rationale for this mission objective includes:•

EV. EV owners trust that charging stations will be available and operable, will not cause
damage to the EV while charging, and will protect their information during transactions.

•

XFC/EVSE. EVSEs are the most visible representation of the EV/XFC ecosystem, and acyber incident can have broad impact leaving the public uncertain of the safety, security
and reliability of EVs, potentially impacting future sales.

•

Cloud/Third-Party. Cloud and Third-Party providers capture and maintain sensitive
financial information for transactions across the EV/XFC ecosystem. Inadvertent releaseof this sensitive information can result in a loss of trust from all ecosystem relevant
parties as well as result in high costs to the cloud/third-party providers due to fines, civil
lawsuits, or compensation to customers.

•

Utility/Building Management Systems. Disruptions in the power supply may leave EV
owners stranded and others in the EV/XFC ecosystem unable to perform their business
functions. These types of disruptions erode trust in the EV/XFC ecosystem.
Mission Objective 4: Maintain Continuity of Operations

The EV/XFC ecosystem must sustain operations and ensure the organization’s mission continues
in the face of adversity. Organizations need to monitor for deviations to identify potential
cybersecurity events and detect and respond to anomalous behavior. Cyber supply chain risk
management processes should also be identified and agreed to by organizational relevant parties.
Moreover, organizations account for disruptions through business continuity/contingency
planning and implementation of response and recovery plans. Achieving this objective requires
each domain in the EV/XFC ecosystem to work together as expected.
The rationale for this mission objective includes:•

EV. Understanding when an EV is compromised or acting outside its normal baseline
operation is key to safe and reliable operations of the vehicle.

•

XCF/EVSE. To detect anomalous behavior, it is necessary to understand the stations’charging cycle profile and power consumption to identify deviations from normal
operations, which may indicate malicious behavior. Supply chain issues (e.g., quality,
integrity, availability) impact the reliability of EVSE.

•

Cloud/Third-Party. Cloud/Third-Party entities must be able to identify malicious
behaviors that deviate from cybersecurity baselines (e.g., unknown, or new connections
and/or transmissions from sources other than the service provider or authorized by theservice provider).

•Utility/Building Management Systems. Utilities typically have programs in place todetect anomalous activity from external systems that could impact operations.

Overview of the Cybersecurity Framework
This section was derived from Version 1.1 of the NIST Cybersecurity Framework (CSF), and thereader is advised to consult the CSF and its corresponding quick start guide for additional details
8

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure[NIST-CSF] [NIST-SP1271]. The CSF assists organizations in better managing and reducing
cybersecurity risk in a way that responds to the industry’s unique cybersecurity needs, risks,
threats, and/or cyber sophistication (regardless of its size). The Framework provides an approachto analyzing cybersecurity risk, enabling enterprises to understand their cybersecurity challenges,
and selecting appropriate mitigation strategies. The Framework emphasizes the risk management
process for cybersecurity by stating that “the Framework focuses on using business drivers to
guide cybersecurity activities and considering cybersecurity risks as part of the organization’srisk management process” [NIST-CSF].
The Framework presents industry standards, guidelines, and practices in a manner that allows
cybersecurity activities and outcomes to be clearly communicated at all levels of an organization,from executives to individuals with operational job roles. Building on those standards,
guidelines, and practices, the Framework provides a common taxonomy and mechanism fororganizations to:•

Describe their current cybersecurity posture.

•

Describe their target state for cybersecurity.

•

Identify and prioritize opportunities for improvement within the context of a continuous
and repeatable process.

•

Assess progress toward the target state.

•Communicate among internal and external relevant parties about cybersecurity risk.

The Framework consists of three main components: the Core, Profiles, and Implementation
Tiers. The Core is a catalog of cybersecurity outcomes written in a common language. A
Framework profile is an alignment of organizational requirements, objectives, risk appetite, andresources against the desired outcomes of the Framework Core. Implementation Tiers guideorganizations to consider the appropriate level of rigor for their cybersecurity program and canbe used as a communication tool to discuss risk appetite, mission priority, and budget; further
discussion on Implementation Tiers is not included in this profile.
The Framework CoreThe Framework Core consists of five Functions [NIST-CSF]:•

Identify. The activities in the Identify function are the foundation for effective use of the
Framework. Understanding the business context, the resources that support critical
functions, and the related cybersecurity risks enables an organization to focus on andprioritize its efforts, consistent with its risk management strategy and business needs.

•

Protect. The Protect function supports the ability to limit or contain the impact of apotential cybersecurity event.

•Detect. The Detect function enables timely discovery of cybersecurity events.

•

Respond. The Respond function supports the ability to contain the impact of a potential
cybersecurity event.

•

Recover. The Recover function supports timely recovery to normal operations to reducethe impact from a cybersecurity event.
9

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

When considered together, these functions provide a high-level, strategic view for managing
cybersecurity risk. The Framework further identifies underlying key Categories andSubcategories for each function and matches them with example informative references such as
existing standards, guidelines, and practices for each subcategory. As stated previously, theinformative references are meant to be used as examples of best practices and to provide relevant
information and are by no means any type of regulatory or compliance mandate from theperspective of this guidance Table 1 illustrates the alignment of Categories to Functions.

10

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure
Table 1. Function and Category Unique Identifiers of NIST CSF 1.1

Function

IDENTIFYPROTECTDETECTRESPONDRECOVER

Function
UniqueIdentifier
ID

PR

DE

RS

RC

Category

Category
UniqueIdentifier

Asset Management

ID.AM

Business Environment

ID.BE

Governance

ID.GV

Risk Assessment

ID.RA

Risk Management Strategy

ID.RM

Supply Chain Risk Management

ID.SC

Access Control

PR.AC

Awareness and Training

PR.AT

Data Security

PR.DS

Information Protection Processes and Procedures

PR.IP

Maintenance

PR.MA

Protective Technology

PR.PT

Anomalies and Events

DE.AE

Security Continuous Monitoring

DE.CM

Detection Processes

DE.DP

Response Planning

RS.RP

Communications

RS.CO

Analysis

RS.AN

Mitigation

RS.MI

Improvements

RS.IM

Recovery Planning

RC.RP

Improvements

RC.IM

Communications

RC.CO

The Framework Categories decompose into Subcategories that are more detailed cybersecurity
activities and specific outcomes of technical and/or management activities. The final componentsof the Framework Core are informative references. Informative references map the Subcategories
and provide the reader with existing standards, guidelines, and practices that can help anorganization achieve the desired outcome for each subcategory.
Profile development applies the Cybersecurity Framework in focusing on the cybersecurity areasof particular concern to an industry, organization, or functional area as identified through its risk
management processes. By evaluating the elements of the Cybersecurity Framework in thecontext of a particular mission, organization, or sector, a profile is created that shows theorganization’s cybersecurity posture based on evaluation of the mission against the
Cybersecurity Framework Functions, Categories, and Subcategories.
Profiles are used to identify opportunities for improving an organization’s cybersecurity postureby creating and comparing a “current” profile (the “as is” state) with a “target” profile (the “to11NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructurebe” state). A target profile offers a prioritization of Subcategories based on pressing mission andoperational considerations for a specific community, industry, or group of relevant parties.
Target profiles are a basis for identifying and engaging in discussions about cybersecurity
activities and outcomes that are important to the profile’s user community. Within an
organization, profiles offer a consistent way to discuss cybersecurity objectives acrossorganizational or agency roles—from senior leadership to technical implementors—using
common terminology. Individuals within the organization or agency may use the gaps between
the current and target profiles to discuss prioritization and allocation of resources to meetcybersecurity objectives.
Sector-Level Profiles
Sector-level profiles emerged as a concept after the development of the CSF. Sector-levelprofiles can act as a starting point for members of the sector to develop their organization’s“current” or “target” profile. Sector-level profiles provide a basis for sub‐sectors and individualorganizations to facilitate conversations and discuss security activities using consistentterminology. Sector-level profiles are intended to:•Provide a foundational profile for organizations to augment or tailor specific to theirorganizational needs.

•

Decrease the chance that organizations overlook a category or subcategory.

•

Encourage consistent analysis of cybersecurity‐risk in the sector ecosystem/environment.

•

Align sector and regulatory cybersecurity requirements or needs.

Developing sector-level profiles can be facilitated through a collaborative, community of interest(COI) driven process. To ensure that a profile aligns cybersecurity outcomes with mission andbusiness needs, input from relevant parties and experts in the targeted field is critical.
XFC Baseline Profile
The XFC Baseline Profile was created by using the Cybersecurity Framework as described inSec. 4. The baseline profile consists of tables for each Category that summarize how eachassociated subcategory applies generally to the EV/XFC ecosystem with informative references
for additional guidance. The tables provide domain-specific considerations as appropriate.
By design, the Cybersecurity Framework is flexible to accommodate the unique environments
and needs of different organizations. Users of this document will understand that deviations
between their enterprise and the assumptions made in this profile may impact the applicability of
the Subcategories. Therefore, relevant parties are advised to review all the Subcategories in thecontext of their organization.
Identify Function
Cybersecurity decisions are not made in a vacuum but within the context of each organization’s
business goals and objectives. Decision making evaluates alternatives based on their potential
impact on the business.

12

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

The Identify function is the foundation of the risk assessment process, so risk management
practitioners should start there first. Consideration of the organization’s mission and businessobjectives, threat environment, assets, and vulnerabilities will have significant influence on theoverall risk management decision and will also impact the other four Functions (i.e., Protect,
Detect, Respond, Recover).
The objectives of the Identify function include:•

Identifying the business or operational environment and organization’s purpose•

Identifying all assets, including hardware, software, personnel, roles, and responsibilities,
and assets’ criticality•

Identifying infrastructure that provides EV/XFC functionality•

Identifying the current and trending vulnerabilities, threats, and impacts should the threat
be realized to assess the risk.

The Identify function consists of six Categories:•

Asset Management•

Business Environment•

Governance•Risk Assessment•

Risk Management•

Supply Chain Risk Management

Each of these Categories and associated Subcategories is summarized in Sec. 5.1.1 through Sec.
5.1.6.
5.1.1. Asset Management Category
The data, personnel, devices, systems, and facilities that enable the organization to achievebusiness purposes are identified and managed consistently with their relative importance toorganizational objectives and the organization’s risk strategy.
In the context of the ecosystem, managing these resources provides the information needed to
inform ongoing decision making consistent with the organization’s business objectives and risk
strategy. The domains within the EV/XFC ecosystem operate independently to achieve common
goals. However, to best manage and use their resources, interdependencies and collaborations
should be considered among the domains.

13

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure
Table 2. Identify: Asset Management Category

Subcategory |DomainAM-1:
Physical devices andsystems within theorganization are
inventoried.

AM-1 | EV

Specific Considerations
Ecosystem: Hardware inventory is a basic function that
supports security and management. The inventory’s ability tosupport security and management is dependent on its accuracy
and granularity. Factors that contribute to accuracy include
how frequently inventories are performed, how thoroughly theinventory is performed (through means such as automation),and the use of physical inspections or other mechanisms forverification. Factors that contribute to granularity of theinventory include information such as the manufacturer,
model number, serial number, version, its function, or its
enabled (or disabled) capabilities. Consideration should begiven to including rented or leased equipment in the inventory
in addition to assets that are directly owned and managed by
the organization. A comprehensive inventory may definesubsystems, components, or subassemblies as distinct
physical assets.
No additional domain-specific considerations to EV
manufacturers once the vehicle is delivered to the customer;
however, manufacturers may catalogue the equipment
installed in their vehicles and consider providing that
information to EV owners as needed.

Informative References[NIST SP 800-53r5]
CM-8, PM-5
NERC CIP
002-5.1a-R1[NIST SP 800-53r5]
CM-8, PM-5

EV owners may consider being aware of the basic information
about their vehicle, such as voltage ratings, rated charging
current, charging method (alternating current (AC) or direct
current (DC)) and charging connector type.
AM-1 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST SP 800-53r5]
CM-8, PM-5
[NIST Handbook 44]
1.10 G-S.1(a)-(c),G-S.2, G-S.6
ISA/IEC 62443-21:D4E1
CM 1.1
ISA/IEC 62443-33:2013
SR 7.8OIML D31:2019
6.2.2.1.1
OIML G22:2022
4.1, 5.1

AM-1 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

14[NIST SP 800-53r5]
CM-8, PM-5

NIST IR 8473
October 2023
Subcategory |DomainAM-1 |
Utility/Building
Management
SystemCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Applicable, but no additional Utility Building/Management
System-specific considerations.

Informative References[NIST SP 800-53r5]
CM-8, PM-5
ISA/IEC 62443-21:D4E1
CM 1.1
ISA/IEC 62443-33:2013
SR 7.8

AM-2:
Software platforms
and applications
within theorganization are
inventoried.

AM-2 | EV

AM-2 | XFC/EVSE

Ecosystem: Accurate and current software inventory is
considered a basic security function. The software inventory
may include developer and version information, associatedhardware, update history, and known bugs. The inventory
should consider tracking how software is used and updated sothat extraneous, outdated, or vulnerable software can beproperly managed. Comprehensive software inventories may
use a software bill of materials (SBOM) to track any software
dependencies that may have an impact on the software’s
function.

[NIST SP 800-53r5]
CM-5, CM-8, CA-9, SA8

EV manufacturers should consider routinely pushing orproviding software updates and patches to EV owners andrelevant third parties.

[NIST SP 800-53r5]
SA-8

EVSE manufacturers should consider routinely pushing andpatching software updates and patches to EVSE owners andrelevant third parties.

[NIST Handbook 44]
1.10 G-S.1(d), G-S.2, GS.9

NERC CIP
002-5.1a-R1

ISO 24089:20231[NIST SP 800-53r5]
SA-8
OIML D31:2019
6.1.1, 6.2.2.2.2, 6.2.8.4
OIML G22:2022
4.4.2, 4.4.7, 5.1
ISA/IEC 62443-21:D4E1
CM 1.1
ISA/IEC 62443-33:2013
SR 7.8AM-2 |
Cloud/Third-Party

Cloud/Third-Party owners/operators may consider including
any external third-party software hosted on or connected tothe systems.

15[NIST SP 800-53r5]
SA-8

NIST IR 8473
October 2023
Subcategory |DomainAM-2 |
Utility/Building
Management
SystemCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Utility/Building management owners/may consider including
external third-party software hosted on their systems in thesoftware inventory.

Informative References[NIST SP 800-53r5]
CM-5, SA-8
ISA/IEC 62443-21:D4E1
CM 1.1
ISA/IEC 62443-33:2013
SR 7.8Ecosystem: Consider all data flows, internal data flows;
within systems, between systems within an organization, andany external or third-party flows. Mapped data flows should
consider showing how different types of data arecommunicated, requirements for transmission, andinformation on path redundancies. Catalogued information
may include any communication and encryption protocols
used, associated sensors and end points, and any associatedconnectors or possible connection points.

[NIST SP 800-53r5]
AC-4, CA-3, CA-6,
CA-9, PM-10, PL-8,
SA-17, AC-20

AM-3 | EV

This mapping may include communication and data relating
to vehicle identification, system information, battery statistics,
payment information, accounts, etc. Data path/flow diagrams
should consider including the EV wire harness and eachrelevant electric control unit (ECU). Diagrams may also show
how ECUs are connected to communication buses, sensors,
and actuators, the communication protocols they use, physicallocation of hardware in the EV, any available ports, and the
directionality of communications.

[NIST SP 800-53r5]
CA-3, CA-6, CA-9

AM-3 | XFC/EVSE

XFC/EVSE interfaces should consider ensuring that only
necessary data are sent or received to fulfill their task. It may
be necessary to consider measures to avoid an indirect
exchange of information between the EV and the utility
domain. Consider also including EVSE- and EV-specificinterfacing, as well as any communication to any cloud/thirdparty systems or utility/building management systems.

ISA/IEC 62443-21:D4E1
NET 1.01

Cloud/Third-Party members should consider including
business and operations-specific flows within the organization
as well as interactions with external partners and entities,
including EVSE, utilities, building/facility management
systems, and transaction management systems. Consider
paying particular attention to Payment Card Industry (PCI)
data flows and data flows to and from data leaks.

[NIST SP 800-53r5]
CA-3, CA-6, CA-9

AM-3:
Organizational
communication anddata flows are
mapped.

AM-3 |
Cloud/Third-Party

16

NERC CIP
002-5.1a-R1,011-2-R1

OIML D31:2019
7.1.2, 7.3.2.4
OIML G22:2022
5.1

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

AM-3 |
Utility/Building
Management
SystemConsider paying particular attention to data leaks. Data
path/flow diagrams should consider showing relevant
utility/substation Supervisory Control and Data Acquisition(SCADA) system layouts including Programmatic Logic
Controllers (PLCs), Human Machine Interfaces (HMIs), andthe equipment they control. Diagrams may show how thecloud network communicates information to the utility. The
diagrams can show how information flows and thecommunication protocols they use.

[NIST SP 800-53r5]
CA-3, CA-6, CA-9

AM-4:

Ecosystem: Catalogue external partner connections and levelof access to external information systems, establish processes
and agreements with all external partners to ensure anunderstanding of information system usage, and establish alevel of trust and security that is consistent with the policiesof the organization.

[NIST SP 800-53r5]
AC-20, PM-5, SA-9

AM-4 | EV

This may include cataloging EVSE connections to EV,
processes used to verify EV identity and accounts, and charge
profile information (current, capacity, battery health, etc.)
communication. EV connections to cloud-based systems,
including account, profile, and location information, should
consider also being included.

[NIST SP 800-53r5]
AC-20, PM-5, SA-9

AM-4 | XFC/EVSE

External information systems that EVSE interfaces with may
include EV-specific systems as well as any communication to
any cloud/third-party operators or utility/building
management systems. EVSE functionality may be dependent
upon external information systems to support EVSE
connections to EV, to the utility (data flow for power
metering, account billing, and demand forecasting) andconnections to cloud (to support data flow for charge station
search and reservation and billing information).

ISA/IEC 62443-21:D4E1
ORG 1.1

AM-4 |
Cloud/Third-Party

Cloud/Third-Party owners/operators may include interactions
with external partners, systems, and entities, such as EVSE,
utilities, building/facility management systems, andtransaction management systems.

[NIST SP 800-53r5]
AC-20, PM-5, SA-9

AM-4 |
Utility/Building
Management
SystemSome aspects of utility or building/facility management
require external information systems for proper operation andsupport EVSE connections to utility and cloud-based systems
for functions such as demand forecasting.

ISA/IEC 62443-21:D4E1
ORG 1.1

AM-5:

Ecosystem: Identification and prioritization of the criticality
and business value of assets are pre-requisites for allocation of
resources and enable risk management decisions to either
reduce or accept the residual risk. Prioritization of assets
allows an organization to focus on the most pending needs
first. Special consideration should be considered for user
safety, financial, and privacy/personally identifiable
information security during prioritization.

[NIST-SP800-37r2]

External
information systems
are catalogued.

Resources (e.g.,
hardware, devices,
data, time,
personnel, andsoftware) are
prioritized based on
their classification,
criticality, andbusiness value.

17

ISA/IEC 62443-21:D4E1
NET 1.01

NERC CIP
011-2-R1[NIST-SP800-53r5]
AC-20, CP-2, CP-8,
RA-2, RA-9, SA-20,
SC-6

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

AM-5 | EV

EV manufacturers have an additional concern in that they will
be supporting equipment and systems already in thecustomer’s possession and use. In addition to their current
assets, manufacturers may consider the importance ofresources necessary to support discontinued models.

[NIST-SP800-53r5]
AC-20, RA-2, RA-9,
SA-20, SC-6

AM-5 | XFC/EVSE

The prioritization of resources will be influenced by the
XFC/EVSE’s ability to support different makes and models of
EV. The resource prioritization may be updated as the number
and variety of EVs change.

ISA/IEC 62443-21:D4E1
DATA 1.1

XFC/EVSE stations are geographically diverse, and the local
owners/operators may have different risk tolerances. As such,the evaluations may be adjusted based on local threat
assessments, vulnerabilities of local equipment, local risk
assessments, and the individual owners’ tolerance. EVSE
manufacturers may consider supporting equipment andsystems already in the customer’s possession and use, which
would influence the prioritization process. EVSE
owners/operators can acknowledge that prioritization may be
adjusted based on geographical location in addition to theequipment/system type and model. This may mean defining
what types of EVs are eligible to charge during times ofdecreased availability. For example, emergency response EVs
may be prioritized during an emergency to ensure that their
missions are upheld.

OIM D31:2019
6.2.2.2.4

AM-5 |
Cloud/Third-Party

Criticality to customer and partners organizations may be partof the prioritization.

[NIST-SP800-53r5]
AC-20, RA-2, RA-9,
SA-20, SC-6

AM-5 |
Utility/Building
Management
SystemConsumers may be elements of the critical infrastructure(such as shipping or disaster recovery). This may meanprioritizing what loads receive power during a time ofdecreased availability and communicating that prioritization
with partners.

[NIST-SP800-53r5]
AC-20, RA-2, RA-9,
SA-20, SC-6

AM-6:

Ecosystem: Clear definition of roles and responsibilities
enables coordination of cybersecurity programs. The roles andresponsibilities for external organizations such as customers,
partners, third parties, and suppliers may be defined inadvance on a case-by-case basis. Consider putting
memorandums of understanding or other agreements in place
to facilitate tracking a participant’s performance and holdthem accountable for their responsibilities. Role andresponsibility definitions should consider including details
about authorities across domains, cover the entire
cybersecurity posture of an organization including accounting
for external relevant parties, and detail the level oftransparency required for accountable and acceptable use,
storage, and interaction with intellectual property.

[NIST-SP800-53r5]
CP-2, PM-2, PM-11
PM-29,PS-2, PS-7

Cybersecurity roles
and responsibilities
for the entire
workforce and thirdparty stakeholders(e.g., suppliers,
customers, partners)
are established.

18

ISA/IEC 62443-21:D4E1
DATA 1.1

NERC CIP
004-6-R4, 004-6-R2

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

AM-6 | EV

Additional relevant parties for EV manufacturers include
elements of the workforce involved in vehicle design, andpre/post-sales support. EV owners may be made aware of
methods and opportunities for good cyber hygiene as it relates
to their EV usage, as well as informed on the responsibilities
to the customer of their vehicle manufacturer.

ISO/SAE 21434
RQ-07-04, RQ-07-06

AM-6 | XFC/EVSE

Additional relevant parties for EVSE manufacturers should
consider including elements of the workforce involved inequipment design/usage, pre/post-sales support, and those
involved during EVSE installation design and construction.

ISA/IEC 62443-21:D4E1
ORG 1.3

AM-6 |
Cloud/Third-Party

Extra emphasis may be placed on external partner
relationships due to the requirement for externally sourced
operational data.

[NIST-SP800-53r5]
CP-2, PM-2, PM-29

AM-6 |
Utility/Building
Management
SystemUtilities and network building should consider defining theroles and responsibilities in context of rules and regulations
that apply to the energy sector. Extra emphasis may be placedon physical security personnel to protect the physicaloperating environment and infrastructure against
cybersecurity risks.

ISA/IEC 62443-21:D4E1
ORG 1.3

5.1.2. Business Environment Category
The organization’s mission, objectives, relevant parties, and activities are understood andprioritized by organizations; this information is used to inform cybersecurity roles,
responsibilities, and risk management decisions.
In the context of the EV/XFC ecosystem, organizations will understand the businessenvironment for relevant parties from across domains and how it impacts their specific domain.
Table 3. Identify: Business Environment Category
Subcategory |DomainBE-1:
The organization’srole in the supply
chain is identified
and communicated.

Specific Considerations
Ecosystem: Degree of applicability and role in the supply
chain is domain specific. In general, identification of the rolein the supply chain are pre-requisites for supply risk
management and communication of the role facilitates
definition of thresholds, service level agreements,
memorandums of understanding and other commitments.
Identifying and understanding relationships and interfaces
with suppliers influences the organization’s role in the supply
chain. The organization’s role in the supply chain is
influenced by system interdependencies that may impact
supply chain positions and agreements. Subcomponents (e.g.,
microcontrollers, sensors, electrical wiring, connectors.)
critical to the function of onboard controllers andmanagement systems may be considered when identifying
how supply chain roles impact goods/services.

19

Informative References[NIST-SP800-53r5]
SR-1, SR-3

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative ReferencesBE-1 | EV

EV manufacturers’ role in the supply chain may include
relationships and interfaces with suppliers, customers, EVSE
manufacturers/operators, and cloud/third-party operators.

ISO/SAE 21434
RQ-07-04, WP-07-01

BE-1 | XFC/EVSE

EVSE manufacturers’ role in the supply chain may include
that of an equipment manufacturer, consumer/holder of datafrom EV owners, and a developer of tools used forcommunication within the EV/XFC ecosystem. EVSE
owners/operators may consider following a similar path,understanding their position in the supply chain as auser/maintainer of EVSE systems and service provider to
EVs.

ISA/IEC 62443-21:D4E1
ORG 1.6

BE-1 |
Cloud/Third-Party

Cloud/Third-Party owners/operators’ role in the supply chain
typically includes a service provider and consumer/holder ofdata from other EV/XFC entities. Additionally, identified
dependencies and requirements may be communicatedinternally and with impacted business partners.

[NIST-SP800-53r5]
SR-1, SR-3

BE-1 |
Utility/Building
Management
SystemUtility/building management systems’ role in the supply chain
may include a service provider, and consumer/holder of data.

[NIST-SP800-53r5]
SR-1, SR-3

BE-2:

Ecosystem: Transportation and energy are considered criticalinfrastructure sectors; however, the degree to which thesubcategory applies is domain specific.

[NIST-SP800-161]

EV manufacturers should consider educating/informing theircustomers about their vehicle’s capability to charge
from/communicate with various types of infrastructure safely.
This may include informing EV owners of which types ofcharge connectors are compatible with their vehicle, whenconnector adapters are applicable, what charge station
characteristics are required (voltage, current ratings, DC/AC),or more specifically, what EVSE brands/models or third-party
apps are compatible with their EV. The EV manufacturer may
consider communicating the risks and/or potential
consequences of failing to adhere to these recommendations.

[NIST-SP800-161]

The EVSE owners/manufacturers can communicate how
service/availability to EV owners could be limited and how
the EVSE may behave relative to the utility during a period oflost or degraded energy availability or communications.
EVSE manufacturers/owners may consider identifying therelationship of industry competitors as alternatives in theevent of emergency to ensure the sustainment of criticalinfrastructure operation.

[NIST-SP800-161]

The organization’splace in criticalinfrastructure and its
industry sector is
identified andcommunicated.
BE-2 | EV

BE-2 | XFC/EVSE

20[NIST-SP800-53r5]
PM-8[NIST-SP800-53r5]
PM-8
ISO/SAE 21434
RQ-10-03[NIST-SP800-53r5]
PM-8

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainSpecific Considerations

BE-2 |
Cloud/Third-Party

Identified dependencies and requirements may be
communicated internally and with impacted business partners.
EVSE reservation and alternative billing options tocloud/third-party use should consider being defined for use in
the event of degradation or an outage.

[NIST-SP800-161]

BE-2 |
Utility/Building
Management
SystemIdentified dependencies and requirements may be
communicated internally and with impacted business partners.

[NIST-SP800-161]

BE-3:

Ecosystem: Prioritization guides the organization’s strategic
activities as it operates and interfaces with customers andpartners within the EV/XFC ecosystem. Current and future
regulations and contractual obligations may influence theorganization’s priorities. Ecosystem members can consider
prioritizing operator safety and personal information security
in their organizational missions, objectives, and activities.

[NIST-SP800-53r5]
PM-11

BE-3 | EV

EV manufacturers may consider emphasizing the
cybersecurity and operational requirements of partners in the
EV/XFC ecosystem in the prioritization process.

[NIST-SP800-53r5]
PM-11

BE-3 | XFC/EVSE

EVSE manufacturers and owners/operators should consider
emphasizing the cybersecurity and operational requirementsof partners within the EV/XFC ecosystem in the prioritization
process.

[NIST-SP800-53r5]
PM-11

BE-3 |
Cloud/Third-Party

Cloud/Third-Party owners/operators may consider focusing
more on secure communications and operational
requirements/dependencies of partner organizations within the
EV/XFC ecosystem in the prioritization process.

[NIST-SP800-53r5]
PM-11

BE-3 |
Utility/Building
Management
SystemUtility/Building management owners/operators may consider
additional focus on stability and integrity of the grid and theoperational requirements/dependencies of partner/customer
organizations within the EV/XFC ecosystem in theprioritization process.

[NIST-SP800-53r5]
PM-11

BE-4:

Ecosystem: EV/XFC ecosystem members may consider
understanding their position within the EV/XFC ecosystem toproperly identify dependencies and critical functions, bothinternal and external, that may impact their delivery of goods
and services to customers and partners. For example,
communications between the EVSE and other systems could
be a critical function for the ecosystem. In the event ofprimary communication disruption, redundancies oralternative communication avenues could allow operation tocontinue at some level and insulate downstream functions
from failure propagation.

[NIST-SP800-53r5]
CP-2, CP-8, PE-9,
PE-11, PM-8, RA-9,
SA-20, SR-2

Priorities fororganizational
mission, objectives,and activities are
established andcommunicated.

Dependencies andcritical functions fordelivery of criticalservices are
established.

21

Informative References[NIST-SP800-53r5]
PM-8[NIST-SP800-53r5]
PM-8

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative ReferencesBE-4 | EV

Interdependencies may include finding available charging
stations, making reservations, billing the transaction, andconnecting to/communicating with the charging station. EVs
that do not communicate correctly with the EV charger and/or
cloud could incorrectly pay for services, leak personal
identifiable information (PII), or cause harm to the EV,
EVSE, utility/building infrastructure, or user/owner.

ISO/SAE 21434
RQ-15-01, RQ-15-02

BE-4 | XFC/EVSE

EVSE manufacturers may consider understanding theirposition in the EV/XFC ecosystem, both as an equipment
manufacturer/supplier and provider that others depend upon.
EVSE manufacturers may recognize that providing safe andreliable patches as well as support to operators are critical
functions. EVSE owners/operators may consider following asimilar path, understanding their position in the ecosystem asa service provider with multi-directional dependencies andcritical functions. Interdependencies may include receiving
utility power to transform for EV, receiving booking requests
from the EV via cloud apps, and effective collaboration withthird parties to charge EV owners for purchase.

ISA/IEC 62443-21:D4E1
AVAIL 1.2

BE-4 |
Cloud/Third-Party

Cloud/Third-Party owners/operators may have layered
dependencies due to being a service provider, as well as
partner of and consumer/holder of data from other EV/XFC
entities. Depending upon organizational and operational
designs, the cloud/third-party owners/operators may also
provide multiple critical functions within the EV/XFC
ecosystem. Interdependencies may include communications
with EVSE regarding current status and availability.

[NIST-SP800-53r5]
CP-2, CP-8, PE-9, PE11, PM-8

BE-4 |
Utility/Building
Management
SystemDepending upon organizational and operational designs, theutility/building management owners/operators may also
provide multiple critical functions within the EV/XFC
ecosystem. Interdependencies may include proper electricity
rate/tariff selection to temper demand and accurate billing forservices. Critical functions may include reliable distributionof power to critical loads.

ISA/IEC 62443-21:D4E1
AVAIL 1.2

BE-5:

Ecosystem: EV/XFC ecosystem members may consider
defining how they will remain in business during various
scenarios, including planning on how to work with partnerorganizations to address issues and concerns identified in the
scenarios. Graceful degradation of operations and operating at
reduced capacities are preferrable to complete failure duringattack and recovery. Resilience plans may include details for
how operating states are defined, operational adjustments ineach state, and necessary communications.

[NIST-SP800-53r5]
CP-2, CP-11, RA-9,
SA-8, SA-20

Resilience
requirements to
support delivery ofcritical services are
established for all
operating states(e.g., underduress/attack, during
recovery, normal
operations).

22

IEC 61850-90-4
12.2, 14.2.4
NERC CIP
009-6-R1

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainBE-5 | EV

BE-5 | XFC/EVSE

Specific Considerations
EV manufacturers may consider the potential severity
associated with impacts to EV owners. These requirements
could include the ability to respond to a malicious
EVSE/Third-Party or to protect the EV in the event of EV
manufacturers equipment compromise. The EV manufacturer
may consider how EV use may change during an ecosystem
disruption and how the EV may recommend behavioral
changes to the driver. For example, if a cyber-attack limits
EVSE operability, the EV may recommend planning tocharge at home.
EVSE manufacturers can consider providing designs andsupport to help EV/XFC partners achieve their resiliency
targets. These requirements, for example, could include theability to respond to malicious EV firmware. The EVSE canconsider communicating how operations will continue in theevent of decreased power availability. This may include
changes to reservations, charge time, and pricing.

Informative References[NIST-SP800-53r5]
CP-2, CP-11
IEC 61850-90-4
12.2, 14.2.4[NIST Handbook 44]
3.40 S.2.1, S.2.2, S.2.3
ISA/IEC 62443-21:D4E1
AVAIL 1.1
OIML D31:2019
6.2.5.3
OIML G22:2022
4.4.9.3.1, 4.49.3.2

BE-5 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CP-2, CP-11
IEC 61850-90-4
12.2, 14.2.4

BE-5 |
Utility/Building
Management
SystemDepending on organizational and operational designs, theutility/building management owners/operators may rely on, as
well as provide support to, EV/XFC partners. The utility may
consider defining priorities for distribution and planning for
decreased service capacity.

ISA/IEC 62443-21:D4E1
AVAIL 1.1

5.1.3. Governance Category
The policies, procedures, and processes that manage and monitor the organization’s regulatory,
legal, risk, environmental, and operational requirements are documented, reviewed, and informthe management of cybersecurity risk.
The EV/XFC ecosystem spans several sectors, and the domains will have unique operational
requirements. There is a wide range of legal and regulatory requirements across the ecosystem.
A domain may benefit from an awareness of the rest of the ecosystem’s constraints andrequirements.

23

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure
Table 4. Identify: Governance Category

Subcategory |Domain
GV-1:
Organizational
cybersecurity policy
is established andcommunicated.

Specific Considerations
Ecosystem: EV/XFC ecosystem may collaborate on policies
with external organizations within the domain to ensure
consistency and should also consider inputs from partnercompanies within the ecosystem to ensure interoperability.
Additionally, policies may be defined to account for activities,
roles, and responsibilities to manage operational systems,
regulatory requirements, update and maintenance strategies,
or applicable industry standards among other considerations.

Informative References[NIST-SP800-53r5]
AC-1, AT-1, AU-1,
CA-1, CM-1, CP-1,
IA-1, IR-1, MA-1,
MP-1, PE-1, PL-1,
PM-1, PS-1, PT-1,
RA-1, SA-1, SC-1,
SI-1, SR-1
ISO/SAE 21434
NERC CIP
004-6-R2

GV-1 | EV

Applicable, but no additional EV-specific considerations.

ISO/SAE 21434
RQ-05-01, RQ-05-02,
RQ-05-03, RQ-05-04,
RQ-05-05, RQ-05-09.
WP-05-01
ISO 24089:2023

GV-1 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.1

GV-1 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CP-1, IA-1, IR-1,
MA-1, MP-1, PE-1,
PL-1, PM-1

GV-1 |
Utility/Building
Management
SystemApplicable, but no additional Utilities/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.1

GV-2:

Ecosystem: Agreements with external organizations orpartners are typically made in advance and documented in a
service-level agreement (SLA), memorandum of
understanding (MOU), or other forms of agreement. These
agreements clearly define cybersecurity roles andresponsibilities to properly define how their cybersecurity
programs should function in a coordinated manner and allow
for accountability for participant responsibilities.

[NIST-SP800-53r5]
PM-1, PM-2, PM-29,
PS-7, PS-9

Roles and responsibilities may include those involved in
vehicle design, pre/post-sales support, software/firmware
lifecycle activities, and supporting nominal vehicle operations
such as charging, maintenance, and patching.

ISO/SAE 21434
RQ-07-04, RQ-07-06,
WP-07-01

Cybersecurity roles
and responsibilities
are coordinated andaligned with internalroles and external
partners.
GV-2 | EV

24

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainSpecific Considerations

GV-2 | XFC/EVSE

Roles and responsibilities may include those during EVSE
installation design, construction, maintenance, updating, andoperation. EVSE manufacturers can also consider definingroles to better support the needs of EV/XFC partners andcustomers, which may follow established OT or IT processes
and methods for equipment, remote services, and capabilities.

ISA/IEC 62443-21:D4E1
ORG 1.3

GV-2 |
Cloud/Third-Party

Applicable, no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
PM-1, PM-2, PM-29

GV-2 |
Utility/Building
Management
SystemApplicable, no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.3

GV-3:

Ecosystem: Understanding the cybersecurity legal andregulatory requirements published and planned for theirindustry sector allows the elements of the ecosystem tocomply with the requirements in a manner that is compatible
with the organizations other obligations and goals.
Requirements may include privacy, customer data
security/management, and regulatory obligations.

[NIST-SP800-53r5]
AC-1, AT-1, AU-1,
CA-1, CM-1, CP-1,
IA-1, IR-1, MA-1,
MP-1, PE-1, PL-1,
PM-1, PS-1, PT-1,
RA-1, SA-1, SC-1,
SI-1, SR-1

GV-3 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
SA-1, SC-1, SI-1, SR-1

GV-3 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.1

GV-3 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
SA-1, SC-1, SI-1, SR-1

GV-3 |
Utility/Building
Management
SystemApplicable, but no additional Utilities/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.1

GV-4:

Ecosystem: EV/XFC ecosystem members may consider
ensuring that cybersecurity risks are included in processes
conducted within organizational governance and risk groups.
Management processes may include policies, procedures,
lifecycle activities, and contractual or regulatory
requirements.

[NIST-SP800-53r5]
PM-3, PM-7, PM-9,
PM-10, PM-11, PM-28,
RA-1, RA-2, RA-3,
SA-2

Legal and regulatory
requirements
regardingcybersecurity,
including privacy
and civil liberties
obligations, areunderstood andmanaged.

Governance and risk
management
processes address
cybersecurity risks.

Informative References[NIST-SP800-160V1]
3.3.8
ISO/SAE 21434

GV-4 | EV

Applicable, but no additional EV-specific considerations.

25

ISO/SAE 21434
RQ-05-01, RQ-05-02,
RQ-05-03, RQ-05-04,
RQ-05-05, WP-05-01

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainSpecific Considerations

Informative References

GV-4 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 2.1

GV-4 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
PM-3, PM-7, PM-9,
PM-10, PM-11, PM-28[NIST-SP800-160V1]
3.3.8

GV-4 |
Utility/Building
Management
SystemApplicable, but no additional Utilities/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 2.1

5.1.4. Risk Assessment Category
The organization understands the cybersecurity risk to organizational operations (including
mission, functions, image, or reputation), organizational assets, and individuals.
There is a high level of interaction and interdependence of OT and IT within the EV/XFC
ecosystem, so consideration of a coordinated or hybrid approach of OT and IT risk assessment iswarranted.
Table 5. Identify: Risk Assessment Category
Subcategory |DomainSpecific Considerations

Informative References

Ecosystem: EV/XFC ecosystem may consider a robust andtimely process to identify, document, and reportvulnerabilities that exist in their assets. Perform periodic
scanning and testing at a frequency consistent with policy andwhenever there have been modifications to the system.

[NIST-SP800-53r5]
CA-2, CA-5, CA-7,
CA-8, PM-4, PM-15,
RA-3, RA-5, SA-5,
SA-11, SI-2, SI-4, SI-5

This ecosystem has custom assets with software performing
key functions. These assets can have vulnerabilities that are
not detected by typical scanning tools. Special considerations
for niche firmware and software are warranted.

Auto-ISAC

RA-1 | EV

Consider participation in forums such as Auto-ISAC to gain
information regarding vulnerabilities. Known asset
vulnerabilities may include accessible connector ports, etc.

ISO/SAE 21434
RQ-08-05, WP-09-01

RA-1 | XFC/EVSE

Known asset vulnerabilities may include accessible connector
ports, poor EVSE physical security, EVSE devices running
outdated kernels, unsigned firmware, remotely accessible
EVSE devices.

ISA/IEC 62443-21:D4E1
EVENT 1.9

RA-1:
Asset vulnerabilities
are identified anddocumented.

26

E-ISACNERC CIP
007-6-R2

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainSpecific Considerations

Informative References

RA-1 |
Cloud/Third-Party

Known asset vulnerabilities may include poor password
protection, lack of authentication (e.g., client-side validation,
unsanitized log-on fields)[NIST-SP800-53r5]
CA-2, CA-5, CA-7,
CA-8, PM-4, PM-15,
RA-3, RA-5, SA-5,
SA-11, SI-2, SI-4, SI-5

RA-1 |
Utility/Building
Management
SystemConsider participation in forums such as E-ISAC to gain
information regarding vulnerabilities. Known asset
vulnerabilities may include poor password protection,
outdated control infrastructure software, and poor substation
physical security.

ISA/IEC 62443-21:D4E1
EVENT 1.9

RA-2:

Ecosystem: EV/XFC ecosystem members should consider
maintaining an awareness of cyber threat intelligence sourcesalong with cyber threat reports that relate to organizational
assets. Ecosystem members may routinely review threat
reports to compare with equipment catalogues and check forapplicable vulnerabilities or actionable information.

[NIST-SP800-53r5]
PM-15, PM-16, RA-10,
SI-5

RA-2 | EV

EV manufactures may consider participation in AutomotiveInformation Sharing and Analysis (Auto-ISAC) for industryspecific intelligence.

ISO/SAE 21434
RQ-08-01, WP-08-01

RA-2 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.1

RA-2 |
Cloud/Third Party

Applicable, but no additional Cloud/Third Party-specificconsiderations.

[NIST-SP800-53r5]
PM-15, PM-16, RA-10,
SI-5

Cyber threat
intelligence isreceived frominformation sharing
forums and sources.

[NIST-SP800-150]
NERC CIP
007-6-R2[NIST-SP800-150]
RA-2 |
Utility/Building
Management
SystemUtility/Building Management Systems may consider
participation in Electricity Information Sharing and Analysis
Center (E-ISAC) for industry-specific intelligence.
Organizations within the Energy sector may have limitedaccess to intelligence gained by national means throughappropriate channels.

ISA/IEC 62443-21:D4E1
ORG 1.1

RA-3:

Ecosystem: Identification can occur from Cyber ThreatIntelligence (CTI) sources, cybersecurity assessment/testing
activities, or from other sources of information. Organizations
can incorporate threat modeling processes to identify andunderstand existing and future threats specific to their
domain. Consider threats such as insider threats, physicalthreats, cybersecurity threats, etc. Special considerations
should consider being made for threats that impact safety,
safety-critical systems/components, andfinancial/transactional systems/components. Threats to criticalpartners or suppliers may also be considered. Threats may beconsidered for the organization while in hardware/software
design and manufacturing as well as during normal operationand maintenance. Organizations may also consider the threatsthat can be introduced in legacy equipment or systems.

[NIST-IR8179]

Threats, bothinternal andexternal, areidentified anddocumented.

27[NIST-SP800-37r2][NIST-SP800-53r5]
PM-12, PM-16, RA-3,
RA-10, SI-5
[NIST-SP800-154][NIST-SP800-160V1]
2.3
NERC CIP
007-6-R4

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

RA-3 | EV

Applicable, but no additional EV-specific considerations.

ISO/SAE 21434
RQ-15-04, RQ-15-06,
WP-15-03

RA-3 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
PM-12, PM-16, RA-3,
RA-10, SI-5

RA-3 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
PM-12, PM-16, RA-3,
RA-10, SI-5

RA-3 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
PM-12, PM-16, RA-3,
RA-10, SI-5

RA-4:

Ecosystem: The potential for local attacks/breaches to spreadto other domains is a consideration for discussion internal andexternal to an organization, regarding impacted ecosystemmembers. This may include risks to interfacing with acompromised external organization within the domain.

[NIST-SP800-53r5]
CP-2, PM-9, PM-11,
RA-2, RA-3, RA-9

RA-4 | EV

Applicable, but no additional EV-specific considerations.

ISO/SAE 21434
Clause 15

RA-4 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 2.1

RA-4 |
Cloud/Third-Party

Possible impacts on charge station availability and PII should
consider being identified.

[NIST-SP800-53r5]
CP-2, PM-9, PM-11,
RA-2, RA-3, RA-9

RA-4 |
Utility/Building
Management
SystemPotential impacts to energy availability and PII should
consider being identified.

ISA/IEC 62443-21:D4E1
ORG 2.1

RA-5:

Ecosystem: Historically, the determination and managementof IT and OT risk have been treated as separate disciplines.
Given the level of IT/ OT interaction and interdependencies
within this ecosystem, consider a holistic risk determinationthat includes IT and OT.

[NIST-SP800-30r1]

Potential business
impacts andlikelihoods are
identified.

Threats,
vulnerabilities,
likelihoods, andimpacts are used todetermine risk.

NERC CIP
002-5.1a-R1[NIST-SP800-53r5]
CA-2, CA-7, PM-16,
PM-28, RA-2, RA-3
[NIST-SP800-160V1]
2.3, 2.4
NERC CIP
007-6-R2

RA-5 | EV

Applicable, but no additional EV-specific considerations.

ISO/SAE 21434
WP-15-04, WP-15-05,
WP-15-06, WP-15-07

RA-5 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 2.1

28

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

RA-5 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CA-2, CA-7, PM-16,
PM-28, RA-2, RA-3

RA-5 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 2.1

RA-6:

Ecosystem: This allows for better alignment of those
responses based on risk to the organization. Risk responses
may derive from discussing details of the response, such as
the associated response time, any limitations, and any
potential impacts to operations. Given the interdependences ofthe domains within the ecosystem, organizations may
consider coordinating the responses with externalorganizations. Consider prioritizing responses to ensure safety
and personal information security.

[NIST-SP800-53r5]
CA-5, PM-4, PM-9,
PM-28, RA-7

RA-6 | EV

Applicable, but no additional EV-specific considerations.

ISO/SAE 21434
WP-13-01

RA-6 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 2.1

RA-6 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CA-5, PM-4, PM-9,
PM-28, RA-7

RA-6 |
Utility/Building
Management
SystemApplicable, but no additional Utilities/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 2.1

Risk responses are
identified andprioritized.

NERC CIP
007-6-R2

5.1.5. Risk Management Category
The organization’s priorities, constraints, risk tolerances, and assumptions are established andused to support operational risk decisions.
In the context of the EV/XFC ecosystem, the risk tolerance for a particular domain may be
influenced by the impact of an incident on partner organizations or the other domains.

29

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure
Table 6. Identify: Risk Management Category

Subcategory |DomainSpecific Considerations

Informative References

Ecosystem: Risk management processes may include, but are
not limited to, supply chain, cybersecurity, assets, businessenvironment, and regulatory governance. The establishedframework should potentially include risk identification,assessment, monitoring, and mitigation strategies to protect
ecosystem assets. This may include data, hardware, software,
networks, and facilities. Members should consider ensuringrisk management strategies are aligned with the organization’srisk tolerance policies.

[NIST-SP800-53r5]
PM-9, PM-28

RM-1 | EV

Risk management processes are likely to include
considerations of obligations to and from EV/XFC partners
and suppliers

ISO/SAE 21434
WP-05-01

RM-1 | XFC/EVSE

Risk management processes should potentially include
accounting for EV/XFC partners, suppliers, and organizations
like North American Electric Reliability Corporation (NERC)
and Federal Energy Regulatory Commission (FERC).

ISA/IEC 62443-21:D4E1
ORG 2.1

RM-1 |
Cloud/Third-Party

Risk management processes should potentially include
accounting for EV/XFC partners, web vendors, suppliers, andcustomers.

[NIST-SP800-53r5]
PM-9, PM-28

RM-1 |
Utility/Building
Management
SystemRisk management processes should potentially include
accounting for EV/XFC partners, customers and organizations
like NERC and FERC.

ISA/IEC 62443-21:D4E1
ORG 2.1

RM-2:

Ecosystem: Ecosystem elements may determine the risk
tolerance associated with activities within the organization,such as product development, supply chain management,
cybersecurity, asset management, business environment, andregulatory governance. Risk tolerance may be communicatedthrough means such as policies, procedures, guidelines, andtraining programs. Risk tolerance should consider including
special considerations for any safety, safety-critical, financial,or regulatory aspects. Organizations may communicate theirrisk tolerance to the other domains within the ecosystem.

[NIST-SP800-53r5]
PM-9

RM-2 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
PM-9

RM-2 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
PM-9

RM-2 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party specificconsiderations.

ISA/IEC 62443-21:D4E1
ORG 2.1

RM-2 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations

ISA/IEC 62443-21:D4E1
ORG 2.1

RM-1:
Risk management
processes are
established,
managed, andagreed to byorganizational
stakeholders.

Organizational risk
tolerance isdetermined andclearly expressed.

30

ISA/IEC 62443-21:D4E1
ORG 2.1

NIST IR 8473
October 2023
Subcategory |DomainRM-3:Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

Ecosystem: Elements of the ecosystem include energy,transportation, communication, or shipping. Risk analysis forthe elements of the critical infrastructure is influenced by their(potentially) broad impact. Some sectors within the criticalinfrastructure have unique attack surfaces and there may be
determined adversaries with a nation state level ofcapabilities. The actual role in the critical infrastructure isorganization specific.

[NIST-SP800-53r5]
PM-8, PM-9, PM-11,
RA-9

RM-3 | EV

Applicable, but no additional EV specific considerations[NIST-SP800-53r5]
PM-8, PM-9, PM-11,
RA-9

RM-3 | XFC/EVSE

Applicable, but no additional EVSE specific considerations.

ISA/IEC 62443-21:D4E1
ORG 2.1

RM-3 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party specificconsiderations[NIST-SP800-53r5]
PM-8, PM-9, PM-11,
RA-9

RM-3 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System specific considerations

ISA/IEC 62443-21:D4E1
ORG 2.1

The organization’s
determination ofrisk tolerance isinformed by its rolein criticalinfrastructure andsector specific risk
analysis.

5.1.6. Supply Chain Risk Management Category
The organization’s priorities, constraints, risk tolerances, and assumptions are established andused to support risk decisions associated with managing supply chain risk. The organization has
established and implemented processes to identify, assess, and manage supply chain risks.
Supply chain risk management (SCRM) is typically an intra-organization function; but, in thecontext of the EV/XFC ecosystem, organizations will need to understand the partner’s SCRM sothat the impacts of any risk inherited by partners impacts are understood and kept within thelevel of the organization’s tolerance.

31

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure
Table 7. Identify: Supply Chain Risk Management Category

Subcategory |DomainSpecific Considerations

Informative References

Ecosystem: Roles within the supply chain may include
partners, suppliers, customers, and service providers. These
processes include activities such as cybersecurity analysis,
passive/active assessments, or cyber threat intelligencecollection, and ingestion. Organizations should consider
identifying critical components, systems, and processes
related to cyber supply chain risk management including a
document methodology for doing so. Roles andresponsibilities may be established and consistently
implemented across the organization. Consider assessing the
supply chain for potential cybersecurity risks, probability andimpact of cyber events, and processes in place to manage risk.
Management of the supply chain may include monitoring andimplemented security controls across the ecosystem.

[NIST-SP800-53r5]
PM-30, SA-9, SR-1,
SR-2, SR-3, SR-5

SC-1 | EV

Critical components may include the head unit system, onboard-diagnostic interface, telematic control units, central
gateway modules, battery management systems, electronic
control units, and communication controllers. Subcomponents(e.g., microcontrollers, sensors, electrical wiring, connectors.)
critical to the function of onboard controllers andmanagement systems should consider being included in theevaluation of cyber supply chain risk.

ISO/SAE 21434
RQ-07-04, WP-07-01

SC-1 | XFC/EVSE

Critical components may include the charging station
controller, power module controls, protection circuits, power
conversion system, supply equipment communication
controller, thermal management systems, human-machineinterface, and EVSE meter equipment. Subcomponents (e.g.,
microcontrollers, sensors, electrical wiring, connectors.)
critical to the function of onboard controllers andmanagement systems should consider being included in theevaluation of cyber supply chain risk.

[NIST-SP800-53r5]
SR-1, SR-2, SR-3, SR-5

Critical components may include physical data centers,
network equipment, servers, storage devices, operating
systems, and encryption mechanisms. Subcomponents (e.g.,
microcontrollers, sensors, electrical wiring, connectors.)
critical to the function of onboard controllers andmanagement systems should consider being included in theevaluation of cyber supply chain risk.

[NIST-SP800-53r5]
SR-1, SR-2, SR-3, SR-5

Critical components may include the power distribution units,
remote-controlled breakers, local circuit protection, andgeneration/storage grid systems. Subcomponents (e.g.,
microcontrollers, sensors, electrical wiring, connectors.)
critical to the function of onboard controllers andmanagement systems should consider being included in theevaluation of cyber supply chain risk.

[NIST-SP800-53r5]
SR-1, SR-2, SR-3, SR-5

SC-1:
Cyber supply chain
risk management
processes are
identified,established,assessed, managed,
and agreed to byorganizational
stakeholders.

SC-1 |
Cloud/Third-Party

SC-1 |
Utility/Building
Management
System32[NIST-SP800-161][NIST-SP800-161][NIST-SP800-161][NIST-SP800-161]

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

Ecosystem: Assessments may include ecosystem partners,
suppliers, customers, and service providers. Organizations
may consider suppliers and partners involved in thedevelopment, manufacturing, and distribution of assets.
Suppliers and partners should consider being prioritized basedon risk and potential impact to the ecosystem. Consider
assessing risks if suppliers and partners have proper policies,
procedures, and security controls in place to mitigate thecybersecurity risks.

[NIST-SP800-53r5]
PM-9, RA-3, SA-15,
SR-2, SR-3, SR-5, SR-6

SC-2 | EV

Applicable, but no additional EV-specific considerations.

ISO/SAE 21434
RQ-07-04, WP-07-01

SC-2 | XFC/EVSE

Some of the equipment used within the XFC/ EVSE is highly
specialized with a limited supply chain. Organizations canconsider this specialized nature when determining andmanaging supply chain risk.

[NIST-SP800-161]
2.2, 3SC-2 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-161]
2.2, 3SC-2 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-161]
2.2, 3SC-3:Ecosystem: Consider contractual measures such as customerand multi-level service-level agreements (SLAs), bilateralcontracts, cost-plus contracts, etc. These measures must be
negotiated and agreed upon in advance and include
performance language. Ecosystem members may consider
establishing contractual agreements with suppliers and thirdparty partners that enforce cybersecurity requirements toprotect confidentiality, integrity, and availability of
information. Contractual agreements may include security
control, monitoring, and incident response requirements.

[NIST-SP800-53r5]
SA-4, SA-9, SR-2, SR-3,
SR-5

SC-3 | EV

Applicable, but no additional EV-specific considerations.

[ISO/SAE 21434]
RQ-07-04, WP-07-01

SC-3 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
SA-4, SA-9

SC-3 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
SA-4, SA-9

SC-2:
Suppliers and thirdparty partners of
information
systems,components andservices are
identified,prioritized, andassessed using acyber supply chain
risk assessment
process.

Contracts with
suppliers and thirdparty partners areused to implement
appropriate
measures designed
to meet theobjectives of anorganization’s
cybersecurity
program and Cyber
Supply Chain Risk
Management Plan.

33[NIST-SP800-161]
2.2, 3

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative ReferencesSC-3 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
SA-4, SA-9

SC-4:

Ecosystem: Consider methods such as audits, vulnerabilityscans, penetration tests, and other evaluation forms toroutinely assess and confirm suppliers and thirdparty/EV/XFC partners are meeting contractual cybersecurity
obligations. Promptly address security concerns orcompliance issues with suppliers and third-party partners.
Consider establishing formal procedures and contingency
plans to manage and enforce contractual obligations within
the ecosystem.

[NIST-SP800-53r5]
AU-6, CA-2, CA-7,
PS-7, SA-9, SA-11

SC-4 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
AU-6

SC-4 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-33:2013
SR 6.1

SC-4 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
AU-6

SC-4 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-33:2013
SR 6.1

SC-5:

Ecosystem: Ecosystem members should consider regularly
evaluating compliance of supplier and third-party
providers/partners response and recovery activities to ensure
incident response plans are aligned with ecosystem cybersupply chain risk management strategy.

[NIST-SP800-53r5]
CP-2, CP-4, IR-3, IR-4,
IR-8, IR-9

SC-5 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
IR-3, IR-4, IR-8, IR-9

SC-5 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-33:2013
SR 2.8, SR 3.3, SR.6.1,
SR 7.3, SR 7.4

SC-5 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
IR-3, IR-4, IR-8, IR-9

SC-5 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-33:2013
SR 2.8, SR 3.3, SR.6.1,
SR 7.3, SR 7.4

Suppliers and thirdparty partners areroutinely assessedusing audits, test
results, or otherforms of evaluations
to confirm they aremeeting theircontractual
obligations.

Response andrecovery planningand testing areconducted with
suppliers and thirdparty providers.

34

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Protect Function Considerations Across the EV/XFC Domains
The Protect function defines activities that support the ability to limit or contain the impact of apotential cybersecurity event. Develop and implement the appropriate safeguards to ensure
delivery of critical infrastructure services.
The Protect function consists of six Categories:•

Identity Management, Authentication, and Access Control•

Awareness and Training•

Data Security•

Information Protection Processes and Procedures•

Maintenance•Protective Technology

5.2.1. Identity Management, Authentication and Access Control Category
Access to physical and logical assets and associated facilities is limited to authorized users,
processes, and devices, and is managed consistent with the assessed risk of unauthorized accessto authorized activities and transactions. Relative to other cyber-ecosystems, the EV/XFC willneed to provide greater access to external organizations to function. Consider more granularlevels of identity management, authentication, and access controls to strike a balance between
limiting exposure and allowing sufficient access.
Table 8. Protect: Identity Management, Authentication and Access Control
Subcategory |DomainAC-1:
Identities andcredentials areissued, managed,
verified, revoked,
and audited forauthorized devices,
users, and processes.

Specific Considerations

Informative References

Ecosystem: Consider implementing formal procedures andguidelines to issue, manage, and verify identities andcredentials. Credential management may be performed by anindependent entity. This may include the management ofauthentication mechanisms (e.g., single-factor, multi-factor)
and unique identifiers, such as usernames, passwords,
certificates, biometrics, smart cards, and hardware tokens.
Implement mechanisms to track, log, approve, and audit
access attempts and activities of devices within theecosystem. Identities/credentials stored within the ecosystem
may include manufacturer identities, employee identities,
supplier identities, provider identities, device identities, test
and validation certificates, software certificates, and systemadministration credentials. Consider that credentials should be
promptly accredited and decommissioned when issued andrevoked.

[NIST-SP800-53r5]
IA-1, IA-2, IA-3, IA-4,
IA-5, IA-6, IA-7, IA-8,
IA-9, IA-10, IA-11,
IA-12

35

NERC CIP
004-6-R4, 007-6-R5

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

AC-1 | EV

EV manufacturers can provide means to ensure the system isable to allow customers to authenticate interactions with andwithin their systems. Domain-specific identities/credentials
stored within the EV may include credentials forauthentication, software/firmware certificates, and diagnostics
and maintenance.

[NIST-SP800-53r5]
IA-1, IA-2, IA-3, IA-4,
IA-5, IA-6, IA-7, IA-8,
IA-9, IA-10, IA-11,
IA-12

AC-1 | XFC/EVSE

EVSE manufacturers can provide means or ensure the system
is able to allow customers to authenticate interactions withand within their systems. Domain-specificidentities/credentials stored within the EVSE may include
charging station identities, metering credentials, billing
credentials, software/firmware certificates, and systemadministration credentials.

ISA/IEC 62443-21:D4E1
USER 1.01, USER 1.02,
USER 1.04, USER 1.06,
USER 1.08, USER 1.09,
USER 1.11

AC-1 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
IA-1, IA-2, IA-3, IA-4,
IA-5, IA-6, IA-7, IA-8,
IA-9, IA-10, IA-11, IA12

AC-1 |
Utility/Building
Management
SystemUtility/building management devices/systems-specificidentities/credentials may include control system credentials,
energy management system credentials, and building accesscredentials.

ISA/IEC 62443-21:D4E1
USER 1.01, USER 1.02,
USER 1.04, USER 1.06,
USER 1.08, USER 1.09,
USER 1.11

ISA/IEC 62443-33:2013
SR 1.1, SR 1.2, SR 1.3,
SR 1.4, SR 1.5, SR 1.7,
SR 1.8, SR 1.9

ISA/IEC 62443-33:2013
SR 1.1, SR 1.2, SR 1.3,
SR 1.4, SR 1.5, SR 1.7,
SR 1.8, SR 1.9
AC-2:
Physical access toassets is managed
and protected.

Ecosystem: Physical connections to communication ports
must be protected, and if deemed unnecessary, removed, ordisabled.

[NIST-IR8320][NIST-SP800-53r5]
PE-1, PE-2, PE-3, PE-4,
PE-5, PE-6, PE-8, PE-9
NERC CIP
007-6-R5

AC-2 | EV

Physical access may include access to critical systems, suchas battery management and charging management, diagnostic,
or non-critical systems, such as the infotainment system.

36[NIST-SP800-53r5]
PE-1, PE-2, PE-3, PE-4,
PE-5, PE-6, PE-8, PE-9

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainSpecific Considerations

Informative ReferencesAC-2 | XFC/EVSE

Physical access may include (but is not limited to) batteryenergy storage systems (BESS), networking/communicationequipment, and account/financial transaction equipment.
EVSE-specific protections are warranted due to the unmanned
nature of many EVSE installations. This may take the form oftamper-resistant tools (locks, proprietary tools, etc.), accessand tamper logging switches/devices, or deactivating ports
allowing unauthenticated access or modification oflog/configuration data. This could also include physicallysecuring the charge cable connector to prevent tampering ormonitoring for tamper evident events and signals. EVSE
owners/operators may consider surveilling the EVSE
surroundings for unusual behavior.

[NIST Handbook 44]
1.10 G-S.8, 1.10 GS.8.2, 3.40 S.3.1, 3.40
S.3.3

AC-2 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
PE-1, PE-2, PE-3, PE-4,
PE-5, PE-6, PE-8, PE-9

AC-2 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System specific considerations.

ISA/IEC 62443-21:D4E1
ORG 3.1, AVAIL 1.1,
AVAIL 1.2

AC-3:

Ecosystem: Ecosystem members can consider establishingformal access control policies and guidelines that clearly
define remote access privileges. Management may take theform of authentication, training, verification prior to accessbeing granted, and automatic timeout threshold
implementation. Managing remote access may include
authentication and management and audit mechanisms to
track, log, and approve access attempts and activities ofdevices within the ecosystem.

[NIST-SP800-53r5]
AC-1, AC-2, AC-17,
AC-19, AC-20, SC-7
SC-15

This may include (but is not limited to) authorized over the air(OTA) updates, vehicle status/usage information, andcustomer remote access features.

[NIST-SP800-53r5]
AC-2, AC-17, AC-19,
AC-20

Remote access ismanaged.

AC-3 | EV

ISA/IEC 62443-21:D4E1
ORG 3.1, AVAIL 1.1,
AVAIL 1.2
OIML D31:2019
6.1.3.2.1, 6.1.3.2.4,
OIML G22:2022
4.4.3.2

NERC CIP
004-6-R4, 004-6-R5

ISO 24089:2023
AC-3 | XFC/EVSE

This may include (but is not limited to) authorized over the air(OTA) updates, EV chargers, BESS,
networking/communication equipment, utility/building
management systems, and account/financial transaction
equipment. EVSE owners/operators may consider supporting
different wireless protocols (such as Wi-Fi, Bluetooth, Near
Field Communication (NFC), etc.) that might be necessary toprovide remote access to the equipment.

ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.06,
NET 3.3. NET 3.4
ISA/IEC 62443-33:2013
SR 1.13, SR 2.6
OIML D31:2019
6.2.6.5, 6.2.6.5.3
OIML G22:2022
4.4, 4.4.3, 4.4.4, 4.4.8

37

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

AC-3 |
Cloud/Third-Party

This may include remote access from EVs, EVSE, web
vendor, and utility/building management systems.

[NIST-SP800-53r5]
AC-2, AC-17, AC-19,
AC-20

AC-3 |
Utility/Building
Management
SystemThis may include remote access from EVSE and Cloud/ThirdParty systems, as well as other utility/building management
systems and assets.

ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.06,
NET 3.3. NET 3.4
ISA/IEC 62443-33:2013
SR 1.13, SR 2.6

AC-4:

Ecosystem: Least privilege and separation of duties help
contain the cyber security attacks encountered by the asset,
component or system protected by the permissions. lists ofrequired authorizations should consider being periodicallyreviewed to remove outdated permissions and may include
Role Based Access Control (RBAC) or other access control
paradigms.

[NIST-SP800-53r5]
AC-1, AC-2, AC-3,
AC-5, AC-6, AC-14,
AC-16, AC-24

AC-4 | EV

EV reviews may include (but are not limited to) internal
vehicle systems, remote access, and EVSE interfacing. EV
manufacturers may consider defining and limiting what
settings EV owners can modify during normal operation andidentifying authorized drivers or users.

[NIST-SP800-53r5]
AC-1, AC-2, AC-3,
AC-5, AC-6, AC-14,
AC-16, AC-24

AC-4 | XFC/EVSE

XFC/EVSE reviews may include (but are not limited to) EV
charger, BESS, networking/communication equipment,utility/building management systems, and account/financialtransaction equipment. EVSE manufacturers/owners/operators
may consider how to implement the principles of leastprivilege and separation of duties for components at an EVSE
site as well.

PCI-DSS v4

Access permissions
and authorizations
are managed,
incorporating theprinciples of leastprivilege andseparation of duties.

[NIST-SP800-160V1]
Appendix F.1.14
NERC CIP
004-6-R4
004-6-R5
007-6-R5

ISA/IEC 62443-21:D4E1
USER 1.04, USER 1.05,
USER 1.07, USER 2.1,
USER 2.2
ISA/IEC 62443-33:2013
SR 2.1OIML D31:2019
6.2.5.2, 6.2.6.6

AC-4 |
Cloud/Third-Party

Cloud/Third-Party reviews may include access permissions
and authorizations from EVs, EVSE systems, web vendors,
and utility/building management systems.

38

PCI-DSS v4

NIST IR 8473
October 2023
Subcategory |DomainAC-4 |
Utility/Building
Management
SystemCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

The utility/building management system reviews may include
access permissions and authorizations from EVSE andcloud/third-party systems, as well as other utility/building
management systems and assets like SCADA, system
controls, sensors, HMIs, sensors, and servers.

ISA/IEC 62443-21:D4E1
USER 1.04, USER 1.05,
USER 1.07, USER 2.1,
USER 2.2
ISA/IEC 62443-33:2013
SR 2.1

Ecosystem: The EV/XFC ecosystem members should
consider including integrity protection measures for both IT
and OT networks. Network integrity enables secure andavailable communications as well helping protect any
network connected data and systems. Employing consistent
network integrity assessments, security training, and incident
response plans minimizes the frequency and impact of
network security incidents.

[NIST-SP800-53r5]
AC-4, AC-10, SC-7,
SC-10, SC-20

AC-5 | EV

Networks may include (but are not limited to) internal
Controller Area Network (CAN) links between systems, suchas battery management, infotainment and charge controller
systems, and external communications with EVSE andcloud/third-party systems.

[NIST-SP800-53r5]
AC-4, SC-7, SC-10,
SC-20

AC-5 | XFC/EVSE

EVSE owners/operators should consider protecting network
integrity, including segmentation and segregation of
networked devices at an EVSE installation such as EV
charger, BESS, networking/communication equipment,utility/building management systems, and account/financialtransaction equipment.

PCI-DSS v4

Cloud/Third-Party considerations may include networked
links to/from EVs, EVSE systems, web vendors, andutility/building management systems.

[NIST-SP800-53r5]
AC-4, SC-7, SC-10,
SC-20

AC-5:
Network integrity isprotected (e.g.,
network
segregation,
network
segmentation).

AC-5 |
Cloud/Third-Party

NERC CIP
007-6-R1

ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.06,
USER 1.16
ISA/IEC 62443-33:2013
SR 3.1, SR 3.8

PCI-DSS v4
AC-5 |
Utility/Building
Management
SystemThe utility/building management system considerations may
include network links to/from EVSE and Cloud/Third-Party
systems, as well as other utility/building management systems
and assets.

ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.06,
USER 1.16
ISA/IEC 62443-33:2013
SR 3.1, SR 3.8

39

NIST IR 8473
October 2023
Subcategory |DomainAC-6:
Identities are
proofed, bound tocredentials, andasserted ininteractions.

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Ecosystem: Ecosystem members should consider asserting
more tightly proofed and bound credentials for interactions
with greater associated risk and discuss acceptable levels ofcredential complexity, credential renewal and reissuancefrequency, as well as the use of multifactor authentication.
This activity may include utilization of security features
provided by industry standards, protocols, and tools, as well
as relevant standards, protocols, and tools from otherindustries that utilize similar system architectures andequipment.
Increased or additional credentials may be considered forinteractions of increased risk, such as when modifying systemsettings or protocols, performing routine maintenance andupdates, and when utilizing apps containing PII and payment
account access.

AC-6 | EV

EV-specific considerations include user accounts accessible
from the EV and driver identification.

Informative References[NIST-IR8014][NIST-SP800-53r5]
AC-16, IA-1, IA-2, IA-4,
IA-5, IA-8, IA-12, PE-2,
PS-3[NIST-SP800-207]
ATIS-I-0000070
2-7
NERC CIP
004-6-R3[NIST-SP800-53r5]
AC-16, IA-1, IA-2, IA-4,
IA-5, IA-8, IA-12
PCI-DSS v4

AC-6 | XFC/EVSE

Applicable, no additional EVSE-specific considerations.

PCI-DSS v4
ISA/IEC 62443-33:2013
SR 1.1, SR 1.2, SR 1.4,
SR 1.5, SR 1.9, SR 2.1

AC-6 |
Cloud/Third-Party

Applicable, no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
AC-16, IA-1, IA-2, IA-4,
IA-5, IA-8, IA-12
PCI-DSS v4

AC-6 |
Utility/Building
Management
SystemApplicable, no additional Utility/Building Management
System-specific considerations.

40

PCI-DSS v4
ISA/IEC 62443-33:2013
SR 1.1, SR 1.2, SR 1.4,
SR 1.5, SR 1.9, SR 2.1

NIST IR 8473
October 2023
Subcategory |DomainAC-7:
Users, devices, andother assets areauthenticated (e.g.,single-factor, multifactor)
commensurate withthe risk of thetransaction (e.g.,
individuals’ security
and privacy risks
and other
organizationalrisks).

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

Ecosystem: EV/XFC ecosystem may consider the
implementation of multi-factor authentication (MFA) where
possible. Assets may include data, hardware, software,
networks, and facilities.

[NIST-SP800-53r5]
AC-14, IA-1, IA-2, IA-3,
IA-5, IA-8, IA-9, IA-10[NIST-SP800-207]
IETF-RFC4082
2-5
NERC CIP
007-6-R5

AC-7 | EV

Transactions and interactions may include remote vehicle
access by both user and manufacturer as well as interfaces
with EVSE networks.

[NIST-SP800-53r5]
AC-14, IA-2, IA-3, IA-5,
IA-8, IA-9, IA-10

AC-7 | XFC/EVSE

Transactions and interactions may include remote access todevices, interfaces with physical devices such as EVs,
cloud/third-party systems, and utility/building management
systems.

ISA/IEC 62443-33:2013
SR 1.1, SR 1.2, SR 1.5,
SR 1.7, SR 1.8, SR 1.9,
SR 1.10AC-7 |
Cloud/Third-Party

Transactions and interactions may include network links
to/from EVs, EVSE systems, web vendors, andutility/building management systems.

[NIST-SP800-53r5]
AC-14, IA-2, IA-3, IA-5,
IA-8, IA-9, IA-10

AC-7 |
Utility/Building
Management
SystemTransactions and interactions may include network links
to/from EVSE and cloud/third-party systems, as well as otherutility/building management systems and assets.

ISA/IEC 62443-33:2013
SR 1.1, SR 1.2, SR 1.5,
SR 1.7, SR 1.8, SR 1.9,
SR 1.105.2.2. Awareness and Training Category
The organization’s personnel and partners are provided cybersecurity awareness education andare trained to perform their cybersecurity-related duties and responsibilities consistent withrelated policies, procedures, and agreements.
The Awareness and Training category is not unique to the EV/XFC ecosystem, and like othercyber-ecosystems, focuses on privileged users who operate, monitor, and maintain systems andinterfaces.

41

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure
Table 9. Protect: Awareness and Training Category

Subcategory |DomainSpecific Considerations

Informative References

Ecosystem: User training may be recurring and include
information about how to interact correctly with the system aswell as education about common cybersecurity methods andwarning signs before, during, and after an attack or incident.

[NIST-SP800-53r5]
AT-2, PM-13, PM-14

AT-1 | EV

This may include staff at multiple levels, from administrative
staff to design and manufacturing staff. EV manufacturers
may consider including EV owner cybersecurity information
and recommend best practices in the vehicle manual.
Information provided in the manual may include therecommended use of multifactor authentication, PIN, andrecommended settings.

[NIST-SP800-53r5]
AT-2, PM-14

AT-1 | XFC/EVSE

This may include staff at multiple levels, from administrative
staff to design, manufacturing, maintenance, and operations
staff.

ISA/IEC 62443-21:D4E1
ORG 1.4

AT-1 |
Cloud/Third-Party

This may include staff at multiple levels, from administrativeand operations staff to EV/XFC partners and vendors. App
developers can consider encouraging positive cyber practices
among users of the app, like multifactor identification andstrong passwords, as well as incorporating good cyber coding
practices and assessments.

[NIST-SP800-53r5]
AT-2, PM-14

AT-1 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Managementspecific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.4

AT-2:

Ecosystem: Privileged users include (but are not limited to)admin/root users/accounts, system administrators, anddevelopers. Ecosystem members can consider clearly defining
and routinely updating roles and responsibilities, and thenimplement training programs to help privileged users
understand and abide by their roles and responsibilities.
Consider continually testing awareness levels, and reevaluate
and retrain as needed to help maintain system security.
Privileged user-specific training should consider emphasizing
elevated attacker desire to compromise privileged accounts
and the consequences of breaches.

[NIST-SP800-53r5]
AT-3, PM-13

AT-2 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
AT-3, PM-13

AT-2 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
AT-3, PM-13

AT-2 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
AT-3, PM-13

AT-2 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
AT-3, PM-13

AT-1:
All users are
informed andtrained.

Privileged users
understand theirroles and
responsibilities.

42[NIST-SP800-161]
Appendix E

NIST IR 8473
October 2023
Subcategory |DomainAT-3:Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

Ecosystem: Members can consider clearly defining androutinely updating roles and responsibilities and thenimplementing training programs to help third-party-relevant
parties understand and abide by their roles andresponsibilities. Awareness levels may be continually tested,reevaluated, and retrained to maintain system security.
Understanding roles and responsibilities may include
identifying ways in which cybersecurity may be compromisedand common preventative measures.

[NIST-SP800-53r5]
AT-3, PS-7, SA-9

AT-3 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
AT-3, PS-7

AT-3 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.3, ORG 1.4

AT-3 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
AT-3, PS-7

AT-3 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.3, ORG 1.4

AT-4:

Ecosystem: The level of resources applied to cybersecurity iscorrelated with the level of buy-in from senior executives.
Senior executives that understand their roles andresponsibilities should consider providing leadership
throughout the organization. Ecosystem members may
consider clearly defining and routinely updating roles andresponsibilities of senior executives, and then developing
routine training programs to help understand and abide by
those roles and responsibilities. Awareness levels may becontinually tested, reevaluated, and retrained to maintainsystem security. Senior executive-specific training should
consider emphasizing elevated attacker desire to compromise
executive accounts and the consequences of breaches.

[NIST-SP800-53r5]
AT-3, PM-2, PM-13,
PM-29

AT-4 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
PM-2, PM-13, PM-29

AT-4 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.3, ORG 1.4

AT-4 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
PM-2, PM-13, PM-29

AT-4 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.3, ORG 1.4

Third-party
stakeholders (e.g.,
suppliers,
customers, partners)
understand theirroles and
responsibilities.

Senior executives
understand theirroles and
responsibilities.

43

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainAT-5:
Physical andcybersecurity
personnel
understand theirroles and
responsibilities.

Specific Considerations
Ecosystem: Understanding roles and responsibilities includes
clearly defining and routinely updating roles andresponsibilities, and then implementing training programs tohelp physical and cybersecurity personnel understand andabide by their roles and responsibilities. Awareness levels
may be continually tested, reevaluated, and retrained tomaintain system security. Physical/cybersecurity personnelspecific training should consider emphasizing the bestpractices to adopt and how to identify and reportcybersecurity risks.

Informative References[NIST-SP800-53r5]
AT-3, CP-3, IR-2,
PM-13

This should consider including personnel involved in design,
manufacturing, maintenance, and administration/operation
roles.
AT-5 | EV

Applicable, but no additional EV specific considerations.

[NIST-SP800-53r5]
AT-3, IR-2, PM-13

AT-5 | XFC/EVSE

Applicable, but no additional EVSE specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.3, ORG 1.4

AT-5 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party specificconsiderations.

[NIST-SP800-53r5]
AT-3, IR-2, PM-13

AT-5 |
Utility/Building
Management
SystemUtility/Building Management Systems may consider existing
physical security requirements and/or regulations.

ISA/IEC 62443-21:D4E1
ORG 1.3, ORG 1.4

5.2.3. Data Security Category
Information and records (data) are managed consistent with the organization’s risk strategy toprotect the confidentiality, integrity, and availability of information.
The domains within the EV/XFC ecosystem may be subject to laws and regulations with specificdata security requirements, and the domains may have an obligation to provide data security forpartner organizations. The tools, techniques, processes, and procedures will require a level ofinter-organization cooperation that other organizations do not typically encounter.

44

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure
Table 10. Protect: Data Security Category

Subcategory |DomainDS-1:
Data-at-rest is
protected.

Specific Considerations
Ecosystem: Ecosystem members can consider having increased
protections for sensitive, PII, or transactional data. Data-at-rest(DAR) protections may be provided through measures such as:•

Securing and tamper-resistant data storage.

•

Encrypting all data.

•

Restricting access to all data around a strict need andfor a specified time period.

•

Monitoring and conducting regular security audits ofprotection mechanisms.

•

Regularly updating the software and firmware of all
onboard electronic management and control systems.

Informative References[NIST-SP800-37r2][NIST-SP800-53r5]
MP-2, MP-3, MP-4,
MP-5, MP-6, MP-7,
MP-8, SC-28[NIST-SP800-175Br1][NIST-SP800-209]
NERC CIP
004-6-R4, 004-6-R5,
011-2-R1

Which DAR protection measure(s) to implement is determinedon a case-by-case basis in a manner that is consistent with theorganization’s risk management.
DS-1 | EV

DS-1 | XFC/EVSE

DAR includes any information that is stored onboard electronic
management and control systems within the EV. This data may
include any information cached or stored on the vehicle,
information on vehicle performance, battery performance,
charging history, location history, associated accounts, andcharging profiles from EV/XFC partners, and suppliers/vendors.

[NIST-SP800-53r5]
MP-3, MP-4, SC-28

DAR includes any information that is in equipment, firmware, orsoftware within the EVSE. This data may include informationfrom EV owners, EV/XFC partners, and suppliers/vendors aswell as reservations and credentials used to access accounts anddatabases.

[NIST Handbook 44]
3.40 S.3.4(a)[NIST-SP800-175Br1][NIST-SP800-209]

ISA/IEC 62443-21:D4E1
CM 1.3, DATA 1.2
ISA/IEC 62443-33:2013
SR 3.4, SR 4.1
OIML D31:2019
6.2.3.4

DS-1 |
Cloud/Third-Party

DS-1 |
Utility/Building
Management
SystemDAR includes any information that is stored in databases owned
and managed by third parties. This data may include informationfrom EV owners, EV/XFC partners, customers, and cloud andpayment processing vendors. Consider protecting information
database access from unauthorized access and security breaches.

[NIST-SP800-53r5]
MP-3, MP-4, SC-28

DAR includes any information that is stored on utility servers.
This data may include load forecasting and account informationfrom EV/XFC partners, utility/building management partners,
and suppliers/vendors.

ISA/IEC 62443-21:D4E1
CM 1.3, DATA 1.2

45[NIST-SP800-175Br1][NIST-SP800-209]

ISA/IEC 62443-33:2013
SR 3.4, SR 4.1

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainDS-2:Data-in-transit(DIT) is protected.

Specific Considerations
Ecosystem: Ecosystem members may consider having increased
protections for sensitive, PII, or transactional data. Data-intransit (DIT) protections may be provided through measures suchas:•

Securing and tamper-resistant communication systems
and protocols for all transmitted data.

•

Encrypting and authenticating data transmitted overwired or wireless communication channels.

•

Monitoring and conducting regular security audits ofprotection mechanisms.

•

Error detecting/correcting protocols.

Informative References[NIST-SP800-53r5]
SC-8, SC-11, SC-12
NERC CIP
004-6-R4, 004-6-R5

Which DIT protection measure(s) to implement is determined ona case-by-case basis in a manner that is consistent with theorganization’s risk management.
DS-2 | EV

DS-2 | XFC/EVSE

DIT may include any information that is transmitted over wired
or wireless communication channels onboard electronic
management and control systems within the EV or data leaving
the EV. This data may include information on vehicle
performance, battery performance, charging history, location andfinancial history, and vehicle owners from EV/XFC partners, andsuppliers/vendors. Consider additional DIT protections for overthe-air (OTA) updates.

[NIST-SP800-53r5]
SC-8, SC-11, SC-12

EVSE owners/operators should consider encrypting all traffic
leaving the EVSE.

PCI-DSS v4

ISO 24089:2023
5.3.4.1, 7.3.1.3, 7.3.4.7,
and 9.3.2.7

ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.06,
NET 1.08, DATA 1.2,
DATA 1.6, USER 1.16
ISA/IEC 62443-33:2013
SR 3.1, SR 3.8, SR 4.1,
SR 4.2OIML D31:2019
6.2.5.2
OIML D22:2022
4.4.9

DS-2 |
Cloud/Third-Party

DIT may include information from EV owners, EV/XFC
partners, customers, and cloud and payment processing vendors.
Cloud/third-party owners/operators might consider encrypting all
traffic.

46[NIST-SP800-53r5]
SC-8, SC-11, SC-12
PCI-DSS v4

NIST IR 8473
October 2023
Subcategory |DomainDS-2 |
Utility/Building
Management
SystemCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
DIT may include information from EV/XFC partners,
utility/building management partners, and suppliers/vendors.
Utility/building management owners/operators may consider
encrypting all operational data.

Informative References
ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.06,
NET 1.08, DATA 1.2,
DATA 1.6, USER 1.16
ISA/IEC 62443-33:2013
SR 3.1, SR 3.8, SR 4.1,
SR 4.2

DS-3:
Assets are formallymanaged throughout
removal, transfer,and disposition.
DS-3 | EV

DS-3 | XFC/EVSE

Ecosystem: Manage assets, which may include hardware,
software, information databases, and developmental/operational
tools or systems and the data itself. In addition to the day-to-day
management activities, formal asset management includes
creating, using, and updating asset management activities or
strategies.

[NIST-SP800-53r5]
CM-8, MP-6, PE-16,
PE-20

Managed data may include information on vehicle performance,
battery performance, charging history, location history, andvehicle owners from EV/XFC partners, and suppliers/vendors.
Transfer of EV assets should consider including encryption andauthentication protocols and should consider only being
managed by authorized parties. Consider going through a formal
provision process when updating firmware and verifying that
updates can only be made by a certified party. Consider
including guidelines for data retention, backup, and secure
disposal in any procedures.

[NIST-SP800-53r5]
CM-8, MP-6, PE-16,
PE-20

Associated data may include information from EV owners,
EV/XFC partners, and suppliers/vendors.

ISA/IEC 62443-21:D4E1
COMP 1.1, USER 1.04,
USER 1.05

NERC CIP
011-2-R2

ISO 24089:2023

5.3.4.1, 7.3.1.3,
7.3.4.7, 9.3.2.7

ISA/IEC 62443-33:2013
SR 4.2
DS-3 |
Cloud/Third-Party

Data may include information from EV owners, EV/XFC
partners, customers, and cloud and payment processing vendors.
EVSE owners/operators should consider implementing or
integrating asset management systems for all EVSE assets in the
network.

[NIST-SP800-53r5]
CM-8, MP-6, PE-16,
PE-20

DS-3 |
Utility/Building
Management
SystemData may include information from EV/XFC partners,
utility/building management partners, and suppliers/vendors.

ISA/IEC 62443-21:D4E1
COMP 1.1, USER 1.04,
USER 1.05
ISA/IEC 62443-33:2013
SR 4.2

47

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainDS-4:Adequate capacity
to ensureavailability is
maintained.

Specific Considerations
Ecosystem: Measures to augment capacity may include:•

Formal procedures and activities to monitor system
performance•

Redundant transmission systems•

Alternate transmission systems (such as radio frequency(RF), wired or optical systems)

Methods such as load balancing address abnormal server loads
due to elevated traffic from user activity, incorrect server
configurations, or cybersecurity events.
DS-4 | EV

This may include availability of the EV infrastructure thatmanages networks, processing, and storage capacities.

Informative References[NIST-SP800-53r5]
AU-4, CP-2, CP-6,
CP-7, PE-11, SC-5
[NIST-SP800-160V1]
Appendix F.4
IEC62439-3
4, 5, Appendix P.2.3,
4.6, 4.8, 4.9, 4.12, 4.13
NERC CIP
009-6-R1[NIST-SP800-53r5]
CP-2, CP-6, CP-7
[NIST-SP800-160V1]
Appendix F.4

DS-4 | XFC/EVSE

This may include availability of the XFC/EVSE charging
network, supporting processes for charging, and informationfrom EV owners, EV/XFC partners, and suppliers/vendors.

[NIST Handbook 44]
3.40 S.3.4 (c)ISA/IEC 62443-33:2013
SR 7.1, SR 7.2
OIML G22:2022
4.4.9.2.2
OIML D31:2019
6.2.4.4.1

DS-4 |
Cloud/Third-Party

This may include information from EV owners, EV/XFC
partners, customers, and cloud and payment processing vendors.
Cloud and third-party system providers may consider
implementing high-availability networks with the required
redundancy of gateways, servers, etc.

[NIST-SP800-53r5]
CP-2, CP-6, CP-7

DS-4 |
Utility/Building
Management
SystemThis may include information from EV/XFC partners,
utility/building management partners, and suppliers/vendors.

ISA/IEC 62443-33:2013
SR 7.1, SR 7.2

DS-5:

Ecosystem: Ecosystem members may consider initially
identifying what is classified as sensitive data, where they are
stored, and where there is data transfer between systems, thenapply appropriate protective measures, such as cryptography,
access control, proper sanitization or disposal of information
systems, destruction of data, and other confidentiality
protections.

[NIST-SP800-53r5]
AC-4, AC-5, AC-6,
PE-19, PS-3, PS-6,
SC-7, SC-8, SC-13,
SC-31, SI-4

Protections against
data leaks are
implemented.

48[NIST-SP800-160V1]
Appendix F.4

NERC CIP
004-6-R4, 004-6-R5,
007-6-R3, 007-6-R4,
007-6-R5, 011-2-R2

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

DS-5 | EV

Data leak protections may apply to information on vehicle
performance, battery performance, charging information andhistory, location and location history, and vehicle owners from
EV/XFC partners, and suppliers/vendors. Special consideration
may be paid to any communication interfaces internal or external
to the EV. This may take the form of a gateway protecting accessto any internal vehicle data buses or encrypting informationleaving the EV. EV manufacturers may consider establishingformal procedures to manage access to sensitive information.

[NIST-SP800-53r5]
AC-4, AC-5, AC-6,
PS-6, SC-7, SC-8, SC-13

DS-5 | XFC/EVSE

Data leak protections may apply to information from EV owners,
payment information, EV/XFC partners, and suppliers/vendors.
EVSE owners/operators may want to consider how meta data of
the EVSE is exposed and limit access to it.

ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.06,
NET 1.08, DATA 1.1,
DATA 1.2
ISA/IEC 62443-33:2013
SR 5.2

DS-5 |
Cloud/Third-Party

Data leak protections may apply to information from EV owners,
EV/XFC partners, customers, and cloud and payment processing
vendors. Special consideration may be paid by cloud/third-party
owners/operators on what information may be exposed throughapplication program interfaces (APIs).

[NIST-SP800-53r5]
AC-4, AC-5, AC-6,
PS-6, SC-7, SC-8, SC-13

DS-5 |
Utility/Building
Management
SystemData leak protections may apply to information from EV/XFC
partners, utility/building management partners, andsuppliers/vendors.

ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.06,
NET 1.08, DATA 1.1,
DATA 1.2
ISA/IEC 62443-33:2013
SR 5.2

DS-6:
Integrity checking
mechanisms areused to verify
software, firmware,and information
integrity.

Ecosystem: Integrity checking mechanisms to verify software,
firmware, and information integrity may be considered for use.
This may take the form of a secure communication channel
standard (e.g., open charge point protocol (OCPP), or otherstandards), or a more advanced cryptographic mechanisms, suchas digital signatures to validate the integrity of the firmware orsoftware.

[NIST-SP800-53r5]
SI-7, SI-10[NIST-SP800-160V1]
2.3, 3.3.6, 3.4.9-3.4.11,
Appendix F[NIST-SP800-161][NIST-SP800-193][NIST-SP800-218]
PO.3.3, PS.1

49

NIST IR 8473
October 2023
Subcategory |DomainDS-6 | EV

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

This may include secure communication channels, cryptographic
mechanisms, and digital signatures to validate the integrity of thefirmware or software. EV systems that may utilize these methods
include the onboard control units, communication networks, andcharging infrastructure.

[NIST-SP800-160V1]
2.3, 3.3.6, 3.4.9-3.4.11,
Appendix F[NIST-SP800-193][NIST-SP800-218]
PO.3.3, PS.1
ISO 24089:2023

5.3.4.1, 7.3.1.3,
7.3.4.7, 9.3.2.7
DS-6 | XFC/EVSE

EVSE manufacturers may provide means to use integrity
checking mechanisms to verify software, firmware, andinformation integrity, such as including alerting capabilities oncompromised software/firmware updates. This may include
secure software updates and verification of EV connection
integrity and identity.

[NIST Handbook 44]
1.10 G-S.1 (c), (d)ISA/IEC 62443-21:D4E1
ORG 2.2, DATA 1.2,
USER 1.16
ISA/IEC 62443-33:2013
SR 3.1, SR 3.3, SR 3.4,
SR 3.8OIML D31:2019
6.1.1, 6.2.2.1.1, 6.2.2.1.2
OIML G22:2022
4.4.2, 4.4.5.1

DS-6 |
Cloud/Third-Party

This may include measures to verify user identities and protect
against unauthorized access. Cloud and third-party systems may
consider implementing allow-lists for software sources.

[NIST-SP800-160V1]
2.3, 3.3.6, 3.4.9-3.4.11,
Appendix F[NIST-SP800-193][NIST-SP800-218]
PO.3.3, PS.1

DS-6 |
Utility/Building
Management
SystemThis may include metering data collected about energy
consumed, information used to manage loads and balance power,
and local breaker/switchgear control commands.

ISA/IEC 62443-21:D4E1
ORG 2.2, DATA 1.2,
USER 1.16
ISA/IEC 62443-33:2013
SR 3.1, SR 3.3, SR 3.4,
SR 3.8DS-7:
The development
and testing
environment(s) are
separate from theproduction
environment.

Ecosystem: Separating development and testing environmentsfrom production environments is considered a best practice.
Exceptions, such as early release (e.g., beta versions), can be
managed closely while trying to keep as much separation as
possible between development and production.

50[NIST-SP800-53r5]
CM-2, SA-3
[NIST-SP800-160V1]
2.3, 3.3.6, 3.4.9-3.4.11,
Appendix F

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

DS-7 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CM-2, SA-3

DS-7 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
NET 1.01

DS-7 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CM-2, SA-3

DS-7 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
NET 1.01

DS-8:

Ecosystem: Examples of hardware integrity checking
mechanisms include trusted platform modules, acceptancetesting, component and subassembly verification, tamper
detection, etc.

[NIST-IR800-8320]

Integrity checking
mechanisms areused to verify
hardware integrity.

[NIST-SP800-53r5]
AC-25, SA-10, SI-7,
SR-9, SR-10[NIST-SP1800-19][NIST-SP1800-34]
FIPS 140-3

DS-8 | EV

EV-specific hardware under evaluation may include the battery
system, charge controller, propulsion and control systems,
electrical wiring, and connectors.

[NIST-SP800-53r5]
AC-25, SA-10, SI-7,
SR-9, SR-10
FIPS 140-3

DS-8 | XFC/EVSE

DS-8 |
Cloud/Third-Party

EVSE-specific measures may include verifying the integrity ofthe safety systems (connector ground, overcurrent protection,and cooling system), verification of connected EV identity, orverifying EVSE on-board hardware has not been tampered with.

[NIST-SP800-53r5]
AC-25, SA-10, SI-7,
SR-9, SR-10

Applicable, but no additional Cloud-Third-Party specificconsiderations.

[NIST-SP800-53r5]
AC-25, SA-10, SI-7,
SR-9, SR-10

FIPS 140-3

FIPS 140-3
DS-8 |
Utility/Building
Management
SystemThis may include periodic testing of breaker functionality andregular maintenance and monitoring or energy infrastructure.

[NIST-SP800-53r5]
AC-25, SA-10, SI-7,
SR-9, SR-10
FIPS 140-3

5.2.4. Information Protection and Processes Category
Security policies (that address purpose, scope, roles, responsibilities, management commitment,
and coordination among organizational entities), processes, and procedures are maintained andused to manage protection of information systems and assets.

51

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Due to the interdependencies within the EV/XFC ecosystem, the domains will require a greaterlevel of inter-organization cooperation.
Table 11. Protect: Information Protection Processes and Procedures Category
Subcategory |DomainIP-1:
A baseline
configuration of
information
technology/industrial
control systems iscreated andmaintained,
incorporating
security principles(e.g., concept ofleast functionality).
IP-1 | EV

Specific Considerations
Ecosystem: Consider configuring the components within the
IT and ICS systems within the context of what is required of
the component rather than what the component is capable ofdoing. Disabling unnecessary capabilities and limiting thefunctionality of devices reduces the attack surface, limits the
spread of an attack in the event of a compromise, andfacilitates the detection of anomalies by reducing complexity.
Consider third-party systems and devices in addition to intraorganization interfaces.

Informative References[NIST-SP800-53r5]
CM-1, CM-2, CM-3,
CM-4, CM-5, CM-6,
CM-7, CM-9, SA-10[NIST-SP800-137]
Section D[NIST-SP800-160V1]
3.4.9, 3.4.10, 3.4.11,
Appendix F, Appendix
G
NERC CIP
012-1-R1

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CM-3, CM-5, CM-6,
CM-7, CM-9
[NIST-SP800-160V1]
3.4.9, 3.4.10, 3.4.11,
Appendix F, Appendix
G

IP-1 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
CM 1.3, CM 1.4
ISA/IEC 62443-33:2013
SR 7.6OIML D 31
6.1.4.1

IP-1 | Cloud/ThirdParty

Applicable, but no additional Cloud/Thirty-Party-specificconsiderations.

[NIST-SP800-53r5]
CM-3, CM-5, CM-6,
CM-7, CM-9
[NIST-SP800-160V1]
3.4.9, 3.4.10, 3.4.11,
Appendix F, Appendix
G

IP-1 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
CM 1.3, CM 1.4
ISA/IEC 62443-33:2013
SR 7.652

NIST IR 8473
October 2023
Subcategory |DomainIP-2:
A System
Development Life
Cycle to manage
systems is
implemented.
IP-2 | EV

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Ecosystem: Consider including security requirements, failure
analyses, and preventative measures in software development
lifecycle (SDLC) planning.

Informative References[NIST-SP800-53r5]
SA-3, SA-4, SA-8,
SA-10, SA-11[NIST-SP800-160V1]
3.2.1, Appendix F.3

This may include development systems and assets, original
equipment manufacturer (OEM)/owner information assets
and recommended/required replacement schedules.

[NIST-SP800-53r5]
SA-3, SA-4, SA-8,
SA-10, SA-11[NIST-SP800-160V1]
3.2.1, Appendix F.3

IP-2 | XFC/EVSE

This may include development systems and assets, EV owner
information, manufacturing systems and assets, and EV/XFC
partner information systems.

ISA/IEC 62443-21:D4E1
ORG 1.1, ORG 2.3

IP-2 | Cloud/ThirdParty

This may include development systems and assets, EV owner
information, and EV/XFC partner information systems.

[NIST-SP800-53r5]
SA-3, SA-4, SA-8,
SA-10, SA-11[NIST-SP800-160V1]
3.2.1, Appendix F.3

IP-2 |
Utility/Building
Management
SystemThis may include development systems and assets and
EV/XFC partner information systems.

ISA/IEC 62443-21:D4E1
ORG 1.1, ORG 2.3

IP-3:

Ecosystem: The ecosystem should consider employing
configuration change control for the domain and elementsthat is consistent with the software development life cycle tomaintain a functioning baseline. Domains must monitor allchanges to validate impacts and integrity and conduct impact
analyses prior to deploying a change.

[NIST-SP800-53r5]
CM-3, CM-4, SA-10

Configuration
change control
processes are inplace.

Organizations should consider providing a mechanism sochanges to the firmware and software can be returned to aproper working state.
IP-3 | EV

This may include development systems, OTA updates tocustomer vehicles, and operational systems.

[NIST-SP800-137]
Section D[NIST-SP800-160V1]
3.3.5, 3.8.3, 3.8.4
NERC CIP
007-6-R2[NIST-SP800-53r5]
CM-3, CM-4, SA-10
ISO 24089:2023

4.3.4.4, 4.3.4.6,
6.3.4.7, 7.3.2.1,
7.3.4.10, 9.3.2.14
IP-3 | XFC/EVSE

This may include development systems, operational systems,
and IT/ICS systems. EVSE manufacturers may consider
implementing configuration management mechanisms toprevent unwanted changes that might occur by maintenanceerrors.

53

ISA/IEC 62443-21:D4E1
CM 1.3, CM 1.4
ISA/IEC 62443-33:2013
SR 7.6NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainSpecific Considerations

IP-3 | Cloud/ThirdParty

This may include development systems, operational systems,
and IT/ICS systems.

[NIST-SP800-53r5]
CM-3, CM-4, SA-10

IP-3 |
Utility/Building
Management
SystemThis may include development systems, operational systems,
and IT/ICS systems.

ISA/IEC 62443-21:D4E1
CM 1.3, CM 1.4

IP-4:

Ecosystem: Backups may include software versions,licenses, system information, certificates, key material, and/or
user information. The length of time these backups aremaintained should be considered based on their businessneeds or compliance requirements.

[NIST-SP800-53r5]
CP-4, CP-6, CP-9

IP-4 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CP-4, CP-6, CP-9

IP-4 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
AVAIL 2.1

Backups ofinformation are
conducted,
maintained, andtested.

Informative References

ISA/IEC 62443-33:2013
SR 7.6

NERC CIP
009-6-R1, 009-6-R2

ISA/IEC 62443-33:2013
SR 7.3, SR 7.4
IP-4 | Cloud/ThirdParty

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CP-4, CP-6, CP-9

IP-4 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
AVAIL 2.1

IP-5:

Ecosystem: The physical operating environment may impact
safety and the function of IT and OT components. This could
include reviewing emergency lighting, fire protection, andclimate controls. Meeting these policies may include
activities such as creating and consistently updating policies
regarding access controls, awareness and training,
maintenance, or safety criteria. Consider regulations andpolicies at all levels.

[NIST-SP800-53r5]
PE-1, PE-12, PE-13,
PE-14

This may include assets connected to, or accessible from,EVSE or Utility/Building assets (e.g., BESS, charging ports,
system temperature/safety thresholds).

[NIST-SP800-53r5]
PE-1, PE-12, PE-13,
PE-14

Policy andregulations
regarding thephysical operating
environment fororganizational assets
are met.
IP-5 | EV

ISA/IEC 62443-33:2013
SR 7.3, SR 7.4

ISO/SAE 21434

ISO/SAE 21434

54

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainSpecific Considerations

Informative References

IP-5 | XFC/EVSE

This may include automatic failsafe states for EVSE assets
connected to EV, Cloud/Third-Party, or Utility/Building
assets. This may include physical status indications (e.g.,tamper alarms, sensor readings) for deployed equipment andpanels.

[NIST Handbook 44]
3.40 S.3.3

IP-5 | Cloud/ThirdParty

This may include Cloud/Third-Party assets connected toutility/building assets.

[NIST-SP800-53r5]
PE-1, PE-12, PE-13,
PE-14

IP-5 |
Utility/Building
Management
SystemThis may include physical status indications (e.g., tamper
alarms) for deployed equipment and panels.

ISA/IEC 62443-21:D4E1
ORG 3.1, AVAIL 1.2

IP-6:

Ecosystem: Consider any organization data that is locatedwithin third-party or partner organizations and provide
mechanisms and procedures to verify that data destruction
has been done in accordance with the ecosystem’s policy.
The ecosystem may conduct audits and reviews to ensure thatdata is destroyed according to policy. Consider reviewing
data sanitization procedures and component disposal.

[NIST-SP800-53r5]
MP-6, SR-12

IP-6 | EV

Policies related to account, payment systems and information,transactional, PII, or other sensitive data may be treated as
higher priority, including additional policies or mechanisms
regarding data destruction, data sanitization, or auditing.

[NIST-SP800-53r5]
MP-6, SR-12

IP-6 | XFC/EVSE

Policies related to account, payment systems and information,transactional, PII, or other sensitive data may be treated as
higher priority, including additional policies or mechanisms
regarding data destruction, data sanitization, or auditing.

ISA/IEC 62443-21:D4E1
DATA 1.6

IP-6 | Cloud/ThirdParty

This may include account, financial, or connection data, as
well as the creation of a data destruction policy. Cloud
providers handling financial payment card data may likely be
implementing data storage, data retention, and data disposal
policy consistent with existing standards (i.e., Payment Card
Industry Data Security Standard (DSS)).

[NIST-SP800-53r5]
MP-6, SR-12

IP-6 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
DATA 1.6

Data is destroyed
according to policy.

ISA/IEC 62443-21:D4E1
ORG 3.1, AVAIL 1.2

NERC CIP
011-2-R2

ISA/IEC 62443-33:2013
SR 4.2

ISA/IEC 62443-33:2013
SR 4.255

NIST IR 8473
October 2023
Subcategory |DomainIP-7:
Protection processes
are improved.

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

Ecosystem: The motivation for such improvements may
come from lessons learned, improved attacker capabilities (asdocumented by threat and vulnerability reports), a change inthe criticality of an asset as well as improved or increased
security tools or practices. Organizations can consider
implementing processes to validate the improvements were
implemented effectively (e.g., establishing after action report
process, documenting lessons learned, and updating response
and recovery plans).

[NIST-SP800-53r5]
CA-2, CA-7, CA-8,
CP-2, CP-4, IR-3, IR-8,
PL-2, PM-6
NERC CIP
009-6-R3

Protection processes related to sensitive user data may beconsidered as a higher priority.
IP-7 | EV

Protection processes related to safety critical systems may beconsidered as higher priority. Manufacturers may consider
implementing a database of past events to better track andmanage events and corresponding improvement processes.

[NIST-SP800-53r5]
CA-2, CA-7, CA-8

IP-7 | XFC/EVSE

Protection processes related to safety critical systems may beconsidered as a higher priority.
Owners/operators/manufacturers may consider implementing
a database of past events to better track and manage eventsand corresponding improvement processes.

ISA/IEC 62443-21:D4E1
ORG 1.1

IP-7 | Cloud/ThirdParty

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CA-2, CA-7, CA-8

IP-7 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.1

IP-8:

Ecosystem: Consider participation in collaborative forums
such as the E-ISAC or Auto-ISAC. Sharing the effectivenessof protection technologies benefits the community, anddistributing within the domain is especially beneficial.

[NIST-SP800-53r5]
AC-21, CA-7, CP-2,
IR-6, SI-4

Effectiveness ofprotection
technologies isshared.
IP-8 | EV[NIST-SP800-150]
NERC CIP
009-6-R3

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
IR-6[NIST-SP800-150]

IP-8 | XFC/EVSE

Manufacturers may consider including standards
development and interoperability of systems and components
as part of the information sharing process.

ISA/IEC 62443-21:D4E1
ORG 1.1

IP-8 | Cloud/ThirdParty

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
IR-6[NIST-SP800-150]

56

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

IP-8 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.1

IP-9:

Ecosystem: Response and recovery plans identify essentialfunctions and associated contingency requirements, as well as
provide a roadmap for implementation. These plans may
include incident response, business continuity, incident
recovery, and disaster recovery plans. Plans may consider
incorporating recovery objectives, restoration priorities, tests,
metrics, contingency roles, personnel assignments, andcontact information. Consider prioritizing maintaining
essential functions despite system disruption or manipulation
when developing plans, as well as the eventual restoration tonormal operations. Members can consider updating response
and recovery plans based on improvements identified in
PR.IP-7, including testing (e.g., pen testing) to ensure
efficacy of plans. Implementing RS.RP-1 and RC.RP-1 isdependent on and consistent with this Subcategory.

[NIST-SP800-53r5]
CM-3, CM-4, SA-10

Manufacturers should consider defining clear responsibilities
for the vehicle components during response and recovery
plans. The components may include hardware, software,
networks, operators, and cloud/third-party systems providers.

[NIST-SP800-53r5]
CM-3, CM-4, SA-10

Response plans(Incident Response
and BusinessContinuity) andrecovery plans(Incident Recovery
and Disaster
Recovery) are inplace and managed.

IP-9 | EV[NIST-SP800-61r2]
Section D[NIST-SP800-160V1]
6.5, 6.6, Appendix F.2
IEC61850-90-12
5.8, 4.12-4.14
NERC CIP
009-6-R1, 009-6-R3[NIST-SP800-61r2]
Section D[NIST-SP800-160V1]
6.5, 6.6, Appendix F.2
IEC61850-90-12
5.8, 4.12-4.14

IP-9 | XFC/EVSE

IP-9 | Cloud/ThirdParty

Manufacturers/owners should consider defining clear
responsibilities for the charging site components during
response and recovery plans. The components may include
hardware, software, networks, operators, and cloud/thirdparty systems providers.

[NIST Handbook 44]
3.40 S.2.3

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CM-3, CM-4, SA-10

ISA/IEC 62443-21:D4E1
EVENT 1.8, AVAIL 1.1[NIST-SP800-61r2]
Section D[NIST-SP800-160V1]
6.5, 6.6, Appendix F.2
IP-9 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

57

ISA/IEC 62443-21:D4E1
EVENT 1.8, AVAIL 1.1

NIST IR 8473
October 2023
Subcategory |DomainIP-10:
Response andrecovery plans aretested.

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Ecosystem: Testing may be conducted stand alone or in
conjunction with other members. Ecosystem members canconsider additional steps to verify that the appropriate parties
are included in recovery and response plan tests, which may
include contingency plan testing, business continuity testing,or incident response testing. When scenarios cannot be
feasibly tested, a tabletop exercise (TTX) format may be
used. After action reports (AARs) may be subsequently
written and used to improve response.

Informative References[NIST-SP800-53r5]
CP-4, IR-3, PM-14[NIST-SP800-115][NIST-IR8270]
IEC 61850-90-4
14.2.4, 5.4.2.5
NERCGridEx
NERC CIP
009-6-R2

IP-10 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CP-4, IR-3, PM-14[NIST-SP800-115]

IP-10 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
EVENT 1.8, AVAIL 1.1
ISA/IEC 62443-33:2013
SR 3.3IP-10 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CP-4, IR-3, PM-14[NIST-SP800-115]

IP-10 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

IP-11:

Ecosystem: This may include practices such as
deprovisioning, personnel screening, new hire training, policy
development and communication, and ensuring data use
adheres to company mission and goals.

Cybersecurity is
included in humanresources practices(e.g.,
deprovisioning,
personnel
screening).

ISA/IEC 62443-21:D4E1
EVENT 1.8, AVAIL 1.1
ISA/IEC 62443-33:2013
SR 3.3[NIST-SP800-53r5]
PS-1, PS-2, PS-3, PS-4,
PS-5, PS-6, PS-7, PS-8,
PS-9, SA-21
NERC CIP
004-6-R2, 004-6-R3,
004-6-R4, 004-6-R5

IP-11 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
PS-1, PS-2, PS-3, PS-4,
PS-5, PS-6, PS-7, PS-8,
PS-9

IP-11 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.1, ORG 1.2

58

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainSpecific Considerations

Informative References

IP-11 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
PS-1, PS-2, PS-3, PS-4,
PS-5, PS-6, PS-7, PS-8,
PS-9

IP-11 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.1, ORG 1.2

IP-12:

Ecosystem: Vulnerability management plans may include
vulnerability identification, scoring, mitigation, response,
information sharing, and coordinated efforts. Ecosystemmembers may consider using a measurement framework andCyber Threat Intelligence (CTI) to determine risk posturesfrom vulnerabilities and prioritize management activities or
strategies. (e.g., The Common Vulnerability Scoring System(CVSS), National Vulnerability Database (NVD), Common
Vulnerabilities and Exposures (CVE), and Common
Weakness Enumeration (CWE)).

[NIST-SP800-53r5]
RA-1, RA-3, RA-5, SI-2

This may include development systems, OTA updates tocustomer vehicles, and operational systems.

[NIST-SP800-53r5]
RA-1, RA-3, RA-5

A vulnerability
management plan isdeveloped andimplemented.

IP-12 | EV

CISA-CIVR-PB
Appendix A
NERC CIP
007-6-R2, 007-6-R3

ISO/SAE 21434
RQ-05-09, RQ-05-10,
RQ-08-05, RQ-08-07,
RQ-08-08
ISO 24089:2023

4.3.3.1, 7.3.1.3

IP-12 | XFC/EVSE

This may include development systems, operational systems,
and IT/ICS systems.

ISA/IEC 62443-21:D4E1
EVENT 1.9

IP-12 |
Cloud/Third-Party

This may include development systems, operational systems,
and IT/ICS systems.

[NIST-SP800-53r5]
RA-1, RA-3, RA-5

IP-12 |
Utility/Building
Management
SystemThis may include development systems, operational systems,
and IT/ICS systems.

ISA/IEC 62443-21:D4E1
EVENT 1.9

5.2.5. Maintenance Category
Maintenance and repairs of industrial control and information system components are performed,
consistent with policies and procedures.
Though maintenance and repairs of OT and IT system components are not unique to the
EV/XFC ecosystem, organizations need to understand the level of interdependencies between IT
and OT and the corresponding influence on maintenance policy and procedures.

59

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure
Table 12. Protect: Maintenance Category

Subcategory |DomainSpecific Considerations

Informative References

Ecosystem: An approved suite of tools may be put in place tocontrol the configuration, planning and maintenance of assets,
including consideration for automated discovery and policy
compliance checks. This may include tools utilized for both
local, physical maintenance, and repair as well as remote
servicing of equipment. Ensure that any maintenance or repair
done by a partner or subcontractor on behalf of theorganization is done in a manner that is approved by theorganization.

[NIST-SP800-53r5]
MA-1, MA-2, MA-3,
MA-5, MA-6

MA-1 | EV

This may involve providing a maintenance institution
validation process so EV owners can identify accredited
mechanics. Accreditation may include verifying that thetooling used is qualified, and that maintenance technicians ormechanics are appropriately trained or certified.

[NIST-SP800-53r5]
MA-1, MA-2, MA-3,
MA-5, MA-6

MA-1 | XFC/EVSE

This may involve verifying physical anti-tamper mechanisms,
such as door sensors or tamper-evident seals, to ensure thatprocesses are being followed. EVSE
owners/operators/manufacturers may consider logging andauditing remote maintenance sessions.

ISA/IEC 62443-21:D4E1
AVAIL 1.2

MA-1 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party specificconsiderations.

[NIST-SP800-53r5]
MA-1, MA-2, MA-3,
MA-5, MA-6

MA-1 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
specific considerations.

ISA/IEC 62443-21:D4E1
AVAIL 1.2

MA-2:

Ecosystem: Manual approval of remote maintenance accessand Multi-Factor Authentication (MFA) may help prevent
unauthorized access. This maintenance may entail safety
aspects of all systems that depend on or interact with the asset
being worked on.

[NIST-SP800-53r5]
MA-4

MA-2 | EV

Applicable, but no additional EV specific considerations.

[NIST-SP800-53r5]
MA-4

MA-2 | XFC/EVSE

This may involve verifying that sensors or tamper-evident
seals are installed to ensure that processes are being followed.
Both physical access and wireless access methods may beconsidered.

ISA/IEC 62443-21:D4E1
ORG 3.1

Applicable, but no additional Cloud/Third-Party specificconsiderations.

[NIST-SP800-53r5]
MA-4

MA-1:
Maintenance andrepair oforganizational assets
are performed andlogged withapproved andcontrolled tools.

Remotemaintenance oforganizational assets
is approved, logged,
and performed in amanner thatprevents
unauthorized access.

MA-2 |
Cloud/Third-Party

60

NERC CIP
006-6-R3[NIST-SP800-161]
V1 Appendix F1.14
NERC CIP
006-6-R3

OIML D31:2019
6.2.8.3

NIST IR 8473
October 2023
Subcategory |DomainMA-2 |
Utility/Building
Management
SystemCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Applicable, but no additional Utility/Building Management
specific considerations.

Informative References
ISA/IEC 62443-21:D4E1
ORG 3.1

5.2.6. Protective Technology Category
Technical security solutions are managed to ensure the security and resilience of systems andassets, consistent with related policies, procedures, and agreements.
Much of the technology within the EV/XFC ecosystem is single purpose or unique to thedomains within the ecosystem. Commercial off-the-shelf (COTS) security solutions may needmodification or tuning to function properly and avoid unintended consequences.
Table 13. Protect: Protective Technology Category
Subcategory |DomainPT-1:
Audit/log records
are determined,
documented,
implemented, andreviewed inaccordance with
policy.

Specific Considerations
Ecosystem: These logs may include information regarding
asset access, modification, communications, data, or use.
Logging all events is not practical; therefore, audit logging
should consider being informed by risk, organizational needs,
risk tolerance and industry best practices. Logs may be used
for activities such as establishing system baselines, tracking
changes, identifying trends between units, diagnosing
problems, detecting anomalies, etc.
Wherever practical, logging and audit mechanisms should
consider producing data elements in accordance with standard
data formats to facilitate parsing and consumption by analytic
teams.

Informative References[NIST-SP800-53r5]
AU-1, AU-2, AU-3,
AU-6, AU-7, AU-12,
AU-13, AU-14, AU-16[NIST-SP800-92][NIST-SP800-161]
3.3.2, 3.3.5
NERC CIP
006-6-R1

Consider maintaining audit logs for extended periods tosupport forensic analysis. Audit logging should consider
being determined by risk tolerance and tailored by industry
best practices.
PT-1 | EV

EV manufacturers can consider logging system status andhealth over time, including indicators such as battery health.

[NIST-SP800-53r5]
AU-1, AU-2, AU-3,
AU-6, AU-7, AU-12,
AU-13, AU-14, AU-16[NIST-SP800-92]

61

NIST IR 8473
October 2023
Subcategory |DomainPT-1 | XFC/EVSE

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Logging calibration parameters, access, maintenance, andupdates may be considered.

Informative References[NIST Handbook 44]
3.40 S.3.3
ISA/IEC 62443-21:D4E1
NET 1.10, DATA 1.1,
EVENT 1.4, EVENT 1.7
ISA/IEC 62443-33:2013
SR 2.8, SR 2.9, SR 2.10,
SR 2.11, SR 2.12
OIML D31:2019
6.2.8.4.6

PT-1 |
Cloud/Third-Party

In addition to sending metering values from EVSE to thecloud, cloud/third-party owners/operators may also consider
logging smart meters for the utility/building management
systems.

[NIST-SP800-53r5]
AU-1, AU-2, AU-3,
AU-6, AU-7, AU-12,
AU-13, AU-14, AU-16[NIST-SP800-92]

PT-1 |
Utility/Building
Management
System

Logging historical system demand as a function of time andlocation may be considered.

ISA/IEC 62443-21:D4E1
NET 1.10, DATA 1.1,
EVENT 1.4, EVENT 1.7
ISA/IEC 62443-33:2013
SR 2.8, SR 2.9, SR 2.10,
SR 2.11, SR 2.12

PT-2:
Removable media is
protected, and its
use restrictedaccording to policy.

Ecosystem: Removable media may include hard drives, flash
drives, Compact Discs (CDs), Digital Versatile Discs(DVDs), and Secure Digital (SD) cards. Authorized use
practices may include encryption, access management,
sanitization, and malware scanning when utilizing removable
media to limit cybersecurity risks.
Both physical and wireless access methods can be considered
for removable media.

PT-2 | EV

Removable media may include connections made throughEV-specific ports or hardware (e.g., On-Board Diagnostic II(OBD-II), Controller Area Network (CAN), Infotainment).

62[NIST-SP800-53r5]
MP-1, MP-2, MP-3,
MP-4, MP-5, MP-7,
MP-8
NERC CIP
006-6-R2, 007-6-R1[NIST-SP800-53r5]
MP-1, MP-2, MP-3,
MP-4, MP-5, MP-7,
MP-8

NIST IR 8473
October 2023
Subcategory |DomainPT-2 | XFC/EVSE

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Removable media may include EVSE-specific ports or
hardware (e.g., maintenance ports, maintenance service
equipment, diagnostic equipment, etc).

Informative References[NIST Handbook 44]
1.10 G-S.8.2
ISA/IEC 62443-21:D4E1
DATA 1.1, DATA 1.2
ISA/IEC 62443-33:2013
SR 2.3OIML G22:2022
4.4.3.2.1, 4.4.3.2.3
OIML D31:2019
6.1.3.2.1, 6.1.3.2.4

PT-2 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
MP-1, MP-2, MP-3,
MP-4, MP-5, MP-7,
MP-8

PT-2 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Managementspecific considerations.

ISA/IEC 62443-21:D4E1
DATA 1.1, DATA 1.2

PT-3:

Ecosystem: The principle of least functionality reduces theattack surface, facilitates anomaly detection, and may help
contain an incident in the event of a compromise.
Consideration may be given to whether non-essentialfunctionalities including connection ports, communication
protocols, and active modes should consider being
deactivated.

[NIST-SP800-53r5]
AC-2, AC-3, CM-7

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
AC-2, AC-3, CM-7

The principle of
least functionality isincorporated byconfiguring systems
to provide only
essential
capabilities.
PT-3 | EV

ISA/IEC 62443-33:2013
SR 2.363

NERC CIP
007-6-R1

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainSpecific Considerations

Informative ReferencesPT-3 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.06,
NET 1.07, NET 2.2,
COMP 1.1, DATA 1.1,
DATA 1.2, DATA 1.8,
DATA 1.9, USER 1.04,
USER 1.05, USER 1.06,
USER 1.08, USER 1.09,
USER 1.11, USER 1.15,
USER 1.17, USER 1.18,
USER 2.1, USER 2.2,
USER 2.3, USER 2.4
ISA/IEC 62443-33:2013
SR 1.1, SR 1.2, SR 1.3,
SR 1.4, SR 1.5, SR 1.6,
SR 1.7, SR 1.8, SR 1.9,
SR 1.10, SR 1.11, SR
1.12, SR 1.13, SR 2.1,
SR 2.2, SR 2.3, SR 2.4,
SR 2.5, SR 2.6, SR 2.7

PT-3 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
AC-2, AC-3, CM-7

PT-3 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Managementspecific considerations.

ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.06,
NET 1.07, NET 2.2,
COMP 1.1, DATA 1.1,
DATA 1.2, DATA 1.8,
DATA 1.9, USER 1.04,
USER 1.05, USER 1.06,
USER 1.08, USER 1.09,
USER 1.11, USER 1.15,
USER 1.17, USER 1.18,
USER 2.1, USER 2.2,
USER 2.3, USER 2.4
ISA/IEC 62443-33:2013
SR 1.1, SR 1.2, SR 1.3,
SR 1.4, SR 1.5, SR 1.6,
SR 1.7, SR 1.8, SR 1.9,
SR 1.10, SR 1.11, SR
1.12, SR 1.13, SR 2.1,
SR 2.2, SR 2.3, SR 2.4,
SR 2.5, SR 2.6, SR 2.7

64

NIST IR 8473
October 2023
Subcategory |DomainPT-4:Communications
and control
networks areprotected.

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

Ecosystem: The ecosystem may consider enacting protectionof communications and control networks throughout the
lifecycle. Some controls can only be applied during thearchitectural phase, while others can be added in theoperations or deployment phases.

[NIST-SP800-53r5]
AC-12, AC-17, AC-18,
CP-8, SC-5, SC-7, SC10, SC-11, SC-20, SC21, SC-22, SC-23, SC31, SC-37, SC-38, SC47

Implementing some security measures can lead toperformance degradation. Organizations may verify that
protective measures will not adversely affect overall system
performance requirements.

[NIST-SP800-160V1]
Appendix F

These network protections may consider following common
IT or OT network protections, including firewalls, encryption,
antivirus, etc.

NERC CIP
006-6-R1

PT-4 | EV

Communication and control networks may include
information systems for internally communicated traffic,
onboard electronic management and control systems, andinterfaces with external networks or information systems.
Networks may include a vehicle’s central gateway module,
sensors, control units, communication modules, telematics
units, and battery management systems. External systems may
include network traffic with charging stations, grid systems,
and external servers. The use of hardware/software gateways
should be considered. EV manufacturers may consider the useof mechanisms to segment a vehicle’s internal networks, andauthenticate devices on the internal network, as well as
communication between internal networks.

[NIST-SP800-53r5]
AC-12, AC-17, AC-18,
SC-5, SC-7, SC-10,
SC-11, SC-20, SC-21,
SC-22, SC-23

PT-4 | XFC/EVSE

Communication and control networks may include
information systems for internally communicated traffic,
onboard electronic management and control systems, andinterfaces with external networks or information systems.
EVSE manufacturers can consider incorporating protections
for non-standard networks including Internet of Things (IoT),
Industrial Internet of Things (IIoT), and Mesh networks.

ISA/IEC 62443-21:D4E1
CM 1.3, NET 1.01, NET
1.02, NET 1.04, NET
1.05, NET 1.06, NET
1.09, USER 1.16
ISA/IEC 62443-33:2013
SR 3.1, SR 3.5, SR 3.8,
SR 4.1, SR 4.3, SR 5.1,
SR 5.2, SR 5.3, SR 7.1,
SR 7.6OIML D31:2019
6.2.2.1.1, 6.2.5.2.d

PT-4 |
Cloud/Third-Party

Cloud/Third-Party owners/operators may consider
implementing protection mechanisms for and with
communications and network traffic in EVs, EVSEs, smart
grid systems, and both normal and abnormal scenarios.

65[NIST-SP800-53r5]
AC-12, AC-17, AC-18,
SC-5, SC-7, SC-10,
SC-11, SC-20, SC-21,
SC-22, SC-23

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainPT-4 |
Utility/Building
Management
SystemSpecific Considerations

Informative References

Utility/Building management owners/operators may consider
implementing protection mechanisms to communications andnetwork traffic in EVSEs, smart grid systems, and otherutility and building management systems.

ISA/IEC 62443-21:D4E1
CM 1.3, NET 1.01, NET
1.02, NET 1.04, NET
1.05, NET 1.06, NET
1.09, USER 1.16
ISA/IEC 62443-33:2013
SR 3.1, SR 3.5, SR 3.8,
SR 4.1, SR 4.3, SR 5.1,
SR 5.2, SR 5.3, SR 7.1,
SR 7.6

PT-5:

Ecosystem: These mechanisms may be implemented toautomatically activate upon detecting adverse conditions.
Resilience mechanisms may include fault tolerantarchitectures, resource management strategies and activities,
backup/recovery plans, and cyber security protection
frameworks.

[NIST-SP800-53r5]
CP-7, CP-8, CP-11,
CP-12, CP-13, PE-11,
PL-8, SC-6, SC-24

PT-5 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CP-7, CP-8, CP-11,
CP-12, CP-13

PT-5 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-33:2013
SR 7.1, SR 7.2

PT-5 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]

PT-5 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-33:2013
SR 7.1, SR 7.2

Mechanisms (e.g.,failsafe, loadbalancing, hot swap)
are implemented toachieve resilience
requirements innormal and adverse
situations.

CP-7, CP-8, CP-11,
CP-12, CP-13

Detect Function Considerations Across the EV/XFC Domains
Develop and implement the appropriate activities to identify the occurrence of a cybersecurity
event. The activities in the Detect function enable timely discovery of cybersecurity events.
•

Anomalies and Events•

Security Continuous Monitoring•

Detection Processes

66

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

5.3.1. Anomalies and Events
Anomalous activity is detected, and the potential impact of events is understood.
In the context EV/XFC, anomalies that occur within domains may also impact other domains or
the entire ecosystem. Agreements made in advance regarding data and event sharing between thevarious ecosystem members and domains warrant consideration.
Table 14. Detect: Anomalies and Events Category
Subcategory|
DomainSpecific Considerations

Informative References

Ecosystem: EV/XFC ecosystem members can consider using
operational data in these baselining efforts. This baseline may
be used to help behavioral anomaly detections and determine
anomalous cybersecurity activities or events. Baseline
information cataloged may include normal traffic levels,
message formats, safe operating ranges, network/system
activity, etc. Higher baseline levels of information may be
kept for more critical systems.

[NIST-SP800-53r5]
AC-4, CA-3, CM-2,
SC-16, SI-4

AE-1 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
AC-4, CA-3, CM-2,
SC-16, SI-4

AE-1 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
NET 1.01

AE-1 |
Cloud/Third-Party

Cloud/Third-Party considerations may include maintaining abaseline of users’ behaviors such as, charging sessions
telemetry, and devices’ configurations, in order to detect any
suspicious or malicious deviations.

[NIST-SP800-53r5]
AC-4, CA-3, CM-2,
SC-16, SI-4

AE-1 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
NET 1.01

AE-2:

Ecosystem: Event analysis may utilize Cyber ThreatIntelligence (CTI) sources, such as Information Sharing andAnalysis Centers (ISACs) or vulnerability databases, to better
understand and determine the impacts and attack vectors orvulnerabilities used during the event.

[NIST-SP800-53r5]
AU-6, CA-7, IR-4,
RA-5, SI-4

Applicable, but no additional EV specific considerations.

[NIST-SP800-53r5]
AU-6, CA-7, IR-4,
RA-5, SI-4

AE-1:
A baseline of
network operations
and expected dataflows for users andsystems isestablished andmanaged.

Detected events areanalyzed tounderstand attack
targets and methods.
AE-2 | EV

67[NIST-SP800-92][NIST-SP800-161]
3.3.2, 3.3.5[NIST-SP800-128]
NERC CIP
007-6-R4

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory|
DomainSpecific Considerations

AE-2 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

Informative References
ISA/IEC 62443-21:D4E1
EVENT 1.7
ISA/IEC 62443-33:2013
SR 2.8, SR 2.9, SR 2.10,
SR 2.11, SR 2.12, SR
3.9, SR 6.1, SR 6.2

AE-2 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
AU-6, CA-7, IR-4,
RA-5, SI-4
[NIST-SP800-128]

AE-2 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

AE-3:

Ecosystem: A diverse set of sources may provide a more
complete understanding. Ecosystem members may consider
using correlated data from multiple systems or partners tobetter analyze events. Consider collecting event data from all
networks, systems, and communication affected or involvedin the cyber event. EV/XFC ecosystem members may
consider correlating data across domains. Cyber events may
be analyzed to predict consequences and develop better
indicators of ongoing cyber-attacks.

[NIST-SP800-53r5]
AU-6, CA-7, CP-2, IR-4,
IR-5, IR-8, SI-4

AE-3 | EV

Important EV-specific data collected may include Battery
Management System (BMS) sensor data readings,
communications with the external systems, information
generated by or related to safety-critical systems, etc.

[NIST-SP800-53r5]
IR-4, IR-5, IR-8

AE-3 | XFC/EVSE

Important EVSE-specific data collected may include output
current and voltage sensor readings, communications withexternal systems including the EV, etc.

ISA/IEC 62443-21:D4E1
EVENT 1.7

Event data arecollected andcorrelated frommultiple sources andsensors.

ISA/IEC 62443-21:D4E1
EVENT 1.7
ISA/IEC 62443-33:2013
SR 2.8, SR 2.9, SR 2.10,
SR 2.11, SR 2.12, SR
3.9, SR 6.1, SR 6.2[NIST-SP800-160V1]
3.3.7, Appendix G.2,
Appendix G.3
NERC CIP
007-6-R4

ISA/IEC 62443-33:2013
SR 6.1
AE-3 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

68[NIST-SP800-53r5]
IR-4, IR-5, IR-8

NIST IR 8473
October 2023
Subcategory|
DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative ReferencesAE-3 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

AE-4:

Ecosystem: Impact analysis may be used to prioritize event
handling actions and activities. Event impact may be
determined with regard to the systems, networks, andcommunications involved or effected in the attacks, theirstated functions, how functions have been compromised, androad to recovery or restoration of normal functionality.

[NIST-SP800-53r5]
CP-2, IR-3, IR-4, IR-5,
IR-8, SI-4

AE-4 | EV

Applicable, but no additional EV-specific considerations.

ISO/SAE 21434
15-01, RQ-08-04, RQ08-05

AE-4 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
EVENT 1.8

AE-4 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CP-2, IR-3, IR-4, IR-5,
IR-8, SI-4

AE-4 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
EVENT 1.8

AE-5:

Ecosystem: Thresholds are established to distinguish between
anomalies and cyber events, which may initiate a responsewhen the system leaves the normal operating range or isconsidered under attack/duress. When considering thresholds,
consider including the creation and updating of relevant
threshold criteria. EV/XFC ecosystem members can consider
integrating operational limits into alert thresholds.

[NIST-SP800-53r5]
IR-4, IR-5, IR-8

AE-5 | EV

Applicable, but no additional EV-specific considerations.

ISO/SAE 21434
Clause 8 and clause 13.3

AE-5 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
EVENT 1.1, EVENT 1.7

AE-5 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
IR-4, IR-5, IR-8

AE-5 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
EVENT 1.1, EVENT 1.7

Impact of events isdetermined.

Incident alertthresholds are
established.

ISA/IEC 62443-21:D4E1
EVENT 1.7
ISA/IEC 62443-33:2013
SR 6.1

69[NIST-SP800-61r2]

NERC CIP
007-6-R4, 007-6-R5

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

5.3.2. Security Continuous Monitoring
The information system and assets are monitored to identify cybersecurity events and verify theeffectiveness of protective measures.
Due to the interdependence of IT and OT in the EV/XFC ecosystem, fusion of data from IT andOT events will add significant value to the subsequent analysis.
Table 15. Detect: Security Continuous Monitoring Category
Subcategory |DomainSpecific Considerations

Informative References

Ecosystem: This may include implementing network
monitoring tools and methods to analyze network traffic forunauthorized or abnormal access attempts, irregular network
traffic volume or contents, or flow of information including
increased monitoring to information leaving the network.
Ecosystem members may consider establishing formal
procedures and contingency plans for reporting andresponding to detected cybersecurity risks.

[NIST-IR7800]

CM-1 | EV

Network monitoring may include internally communicatedtraffic within the EV and traffic with external systems,
including EVSE and Cloud/Third-Party systems. The network
may include the vehicle’s central gateway module, sensors,
control units, communication modules, telematics units, andbattery management systems. Data exchange between external
systems may include information on vehicle performance,
battery performance, charging history, vehicle owners,
communications with charging stations, grid systems, andexternal servers.

[NIST-SP800-53r5]
AU-1, AU-2, AU-3,
AU-6, AU-7, AU-12,
AU-13, AU-14, AU-16

CM-1 | XFC/EVSE

Network monitoring may include internally communicatedtraffic within the EVSE and traffic with external systems,
including EV and Cloud/Third-Party systems. The network
may include information on transactions, charging andbattery-related information/metrics, and sensor readings.
EVSE owners/operators may consider including non-standard
networks including IoT, IIoT and Mesh networks. EVSE
owners/operators may consider collecting data and monitor
the telemetry from multiple sources and sensors, which may
provide a more complete network status.

ISA/IEC 62443-21:D4E1
EVENT 1.1

CM-1 |
Cloud/Third-Party

Monitoring may include network traffic with EVs, EVSEs,
smart grid systems, and both normal and abnormal activity.

[NIST-SP800-53r5]
AU-1, AU-2, AU-3,
AU-6, AU-7, AU-12,
AU-13, AU-14, AU-16

CM-1 |
Utility/Building
Management
SystemMonitoring may include network traffic with EVSEs, smart
grid systems, and other utility and building management
systems. Utility/Building Management owners/operators canconsider including non-standard networks, including IoT,
IIoT and Mesh networks.

ISA/IEC 62443-21:D4E1
EVENT 1.1

CM-1:
The network ismonitored to detect
potential
cybersecurity
events.

70[NIST-SP800-53r5]
AU-1, AU-2, AU-3,
AU-6, AU-7, AU-12,
AU-13, AU-14, AU-16
NERC CIP
006-6-R1, 006-6-R2

ISA/IEC 62443-33:2013
SR 6.2

ISA/IEC 62443-33:2013
SR 6.2NIST IR 8473
October 2023
Subcategory |DomainCM-2:

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

Ecosystem: Monitoring may include continuously monitoring
critical components, systems, and processes that have been
identified as potential cybersecurity risks, are safety-critical,
or have safety considerations. Subcomponents (e.g.,
microcontrollers, sensors, electrical wiring, connectors.)
critical to the function of onboard controllers andmanagement systems may be included in the continuous
monitoring of the physical environment.

[NIST-SP800-53r5]
CA-7, PE-6, PE-20

CM-2 | EV

Critical hardware components may include the head unit
system, on-board-diagnostic interfaces, telematic control
units, central gateway modules, battery management systems,
electronic control units, and communication controllers. This
may include logging, alarming or monitoring CAN accessports, physical access ports, and connections.

[NIST-SP800-53r5]
PE-6, PE-20

CM-2 | XFC/EVSE

Critical hardware components may include the charging
station controllers, power module controls, protection circuits,
power conversion systems, supply equipment communication
controllers, thermal management systems, human-machineinterfaces, and EVSE meter equipment. This may include
means to monitor status such as tamper switches or alarms,
and sensors for safety-critical systems/components.

ISA/IEC 62443-21:D4E1
EVENT 1.1

CM-2 |
Cloud/Third-Party

Critical hardware components may include physical data
centers, network equipment, servers, or storage devices.

[NIST-SP800-53r5]
PE-6, PE-20

CM-2 |
Utility/Building
Management
SystemThis may include monitoring the status of equipment withtools such as area access monitoring and device tamperswitches or alarms. Critical hardware components may
include the power distribution units, remote-controlled
breakers, local circuit protection, and generation/storage grid
systems.

ISA/IEC 62443-21:D4E1
EVENT 1.1

CM-3:
Personnel activity ismonitored to detect
potential
cybersecurity
events.

Ecosystem: Personnel monitoring may include activities
during pre-deployment (e.g., manufacturing, assembly, anddistribution), deployment (e.g., installation andcommissioning), and post-deployment (e.g., operation,
maintenance, and upgrade). This may include limiting ease ofaccess to internal systems or components after development,
monitoring new connections or connection attempts, andmonitoring changes in system settings.

[NIST-SP800-53r5]
AC-2, AU-12, AU-13,
CA-7, CM-10, CM-11

CM-3 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
AC-2, AU-12, AU-13

CM-3 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
EVENT 1.1

The physicalenvironment ismonitored to detect
potential
cybersecurity
events.

NERC CIP
006-6-R1, 007-6-R4,
007-6-R5

ISA/IEC 62443-33:2013
SR 6.2CM-3 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

71[NIST-SP800-53r5]
AC-2, AU-12, AU-13

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

CM-3 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

CM-4:

Ecosystem: Detection activities may incorporate commonlyused Tactics, Techniques, and Procedures (TTPs),
unauthorized code execution, and/or unusual system activity.

Malicious code is
detected.

Informative References
ISA/IEC 62443-21:D4E1
EVENT 1.1
ISA/IEC 62443-33:2013
SR 6.2[NIST-SP800-53r5]
SC-44, SI-3, SI-4, SI-8
[NIST-SP800-218]
NERC CIP
007-6-R3

EV manufacturers can consider providing means to ensure theability to analyze and detect malicious code affecting softwareand firmware on EV computer systems that may include
vehicle control units, communication modules, charging
systems, and battery management systems.

[NIST-SP800-53r5]
SI-3, SI-4, SI-8

EVSE manufacturers may consider providing means of
ensuring the ability to analyze and detect malicious code
affecting software and firmware on EVSE computer systems
that may include the communication modules, charge control
systems, power distribution modules, and energy management
systems.

ISA/IEC 62443-21:D4E1
COMP 2.2

CM-4 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
SI-3, SI-4, SI-8

CM-4 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
COMP 2.2

CM-5:

Ecosystem: Mobile code includes software being sent
between devices, software or code that is remotely executableon another device, and/or scripted code formats. Members
may consider only providing access to controlled andmonitored mobile code.

[NIST-SP800-53r5]
SC-18, SC-44, SI-4

Applicable, but no additional EV specific considerations.

[NIST-SP800-53r5]
SC-18, SC-44

CM-4 | EV

CM-4 | XFC/EVSE

Unauthorized
mobile code is
detected.
CM-5 | EV

ISO/SAE 21434
RQ-08-01, RQ-08-03

ISA/IEC 62443-33:2013
SR 3.2

ISA/IEC 62443-33:2013
SR 3.2NERC CIP
007-6-R3

ISO/SAE 21434
RQ-08-01, RQ-08-03

72

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainSpecific Considerations

Informative References

CM-5 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
USER 1.06, EVENT 1.1
ISA/IEC 62443-33:2013
SR 2.4CM-5 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
SC-18, SC-44

CM-5 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
USER 1.06, EVENT 1.1

CM-6:

Ecosystem: Directly applicable to the EV/XFC ecosystem.
The ecosystem comprises four distinct domains that require alevel of service from each other to function.

External service
provider activity ismonitored to detect
potential
cybersecurity
events.
CM-6 | EV

ISA/IEC 62443-33:2013
SR 2.4[NIST-SP800-53r5]
CA-7, PS-7, SA-4, SA-9,
SI-4
NERC CIP
006-6-R1, 007-6-R4,
007-6-R5
Service provider activity may include remote access attempts
and software updates to onboard electronic management andcontrol systems. EV manufacturers may consider monitoring
external service interactions with hardware components that
may include the telematics units, infotainment and navigation
systems, remote keyless entry systems, diagnostic ports, andcharging systems.

[NIST-SP800-53r5]
CA-7, PS-7, SA-4, SA-9

CM-6 | XFC/EVSE

Service provider activity may include remote access attempts,
configuration changes, software updates, and diagnostic tests
to onboard electronic management and control systems.
EVSE manufacturers can consider monitoring external service
interactions with hardware components that may include
metering equipment, payment processing units,
communication modules, and charge control systems. EVSE
owner/operators may consider implementing remote access
controls for remote EVSE manufacturers.

ISA/IEC 62443-21:D4E1
ORG 1.1, ORG 1.3

CM-6 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party specificconsiderations.

[NIST-SP800-53r5]
CA-7, PS-7, SA-4, SA-9

CM-6 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.1, ORG 1.3

73

ISO/SAE 21434
RQ-08-01, RQ-08-03

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

Ecosystem: The effectiveness of this subcategory depends on
the implementation of other CSF Subcategories, such as
putting processes in place to monitor organizational systems,
controlling physical access to equipment, track and monitor
assets, or maintaining change management controls.

[NIST-SP800-53r5]
AU-12, CA-7, CM-3,
CM-8, PE-6, PE-20, SI-4

This may include steps of the equipment lifecycle, frommanufacture and assembly to operation and maintenance.
Factors for monitoring may include new connections tocommunication buses, new mobile devices connections,electronics hardware access, and changes in settings.

[NIST-SP800-53r5]
CM-3, CM-8, PE-6,
PE-20

CM-7 | XFC/EVSE

This may include steps of the equipment lifecycle, frommanufacture, assembly, deployment, operation, andmaintenance. Factors to monitor may include newconnections to communication buses, EV identification at
charging port, and opening of the EVSE enclosure.

ISA/IEC 62443-21:D4E1
ORG 2.2, EVENT 1.1

CM-7 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CM-3, CM-8, PE-6,
PE-20

CM-7 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 2.2, EVENT 1.1

CM-8:

Ecosystem: Scans may be performed by the organization
itself or contracted out to external parties such as red/purple
team and penetration testing activities.

[NIST-SP800-53r5]
RA-5

Vulnerability scans may include the telematics units,
infotainment and navigation systems, remote keyless entry
systems, diagnostic ports, and charging systems.

[NIST-SP800-53r5]
RA-5

CM-7:
Monitoring forunauthorized
personnel,
connections,devices, andsoftware is
performed.
CM-7 | EV

Vulnerability scans
are performed.
CM-8 | EV

NERC CIP
006-6-R1, 007-6-R3,
005-6-R4, 007-6-R5

ISO/SAE 21434
RQ-08-01, RQ-08-03[NIST-SP800-115][NIST-SP800-115]
ISO/SAE 21434
RC-10-12, RQ-08-01,
RQ-08-03, RQ-11-01

CM-8 | XFC/EVSE

Vulnerability scans may include metering equipment,
payment processing units, communication modules, andcharge control systems. EVSE owners/operators may consider
implementing a vulnerabilities management solution forcontinuous vulnerability assessment for all EVSE equipment
on site’s network.

ISA/IEC 62443-21:D4E1
ORG 2.2, EVENT 1.1

CM-8 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
RA-5[NIST-SP800-115]

74

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainCM-8 |
Utility/Building
Management
SystemSpecific Considerations
Applicable, but no additional Utility/Building Management
System-specific considerations.

Informative References
ISA/IEC 62443-21:D4E1
ORG 2.2, EVENT 1.1

5.3.3. Detection Processes
Detection processes and procedures are maintained, tested, and updated to ensure awareness ofanomalous events.
This category is common to all cyber ecosystems; however, the EV/XFC ecosystem is relatively
new, and, therefore, additional consideration is warranted so that the most current best practices
and processes may be embraced.
Table 16. Detect: Detection Processes Category
Subcategory |DomainSpecific Considerations

Informative References

Roles and
responsibilities for
detection are welldefined to ensureaccountability.

Ecosystem: EV/XFC ecosystem members may consider
having well-defined ecosystem-wide detection roles andresponsibilities in addition to the domains’ internal activities.
This may include creating or updating roles andresponsibilities to include or improve detection activities.
Roles and responsibilities may include event detection,
diagnosis, status communications, and response plan
decisions or actions.

[NIST-SP800-53r5]
CA-2, CA-7, PM-14

DP-1 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CA-2, CA-7

DP-1 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.3

DP-1 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CA-2, CA-7

DP-1 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.3

DP-1:

75

NIST IR 8473
October 2023
Subcategory |DomainDP-2:Detection activities
comply with allapplicablerequirements.

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

Ecosystem: Activities and requirements include (but are notlimited to) policy, contractual, regulation, and legal
requirements.

[NIST-SP800-53r5]
AC-1, AT-1, AU-1,
CA-1, CA-2, CA-7,
CM-1, CP-1, IA-1, IR-1,
MA-1, MP-1 PE-1,
PL-1, PM-1, PM-14,
PS-1, PT-1, RA-1, SA-1,
SC-1, SI-1, SI-4, SR-1,
SR-9, SR-10[NIST-SP800-61r2]
NERC CIP
007-6-R4

DP-2 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
SI-1, SI-4, SR-1, SR-9,
SR-10

DP-2 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
EVENT 1.1

DP-2 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
SI-1, SI-4, SR-1, SR-9,
SR-10

DP-2 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
EVENT 1.1

DP-3:

Ecosystem: Consider regular testing detection processes for
accuracy, coverage, and completeness, or against known
threats or vulnerabilities. Detection processes may be tested
using audits and adversarial emulation activities.

[NIST-SP800-53r5]
CA-2, CA-7. PM-14,
SI-3, SI-4

DP-3 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CA-2, CA-7. PM-14,
SI-3, SI-4

DP-3 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
EVENT 1.1

Detection processes
are tested.

NERC CIP
006-6-R3

ISA/IEC 62443-33:2013
SR 3.3DP-3 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

76[NIST-SP800-53r5]
CA-2, CA-7. PM-14,
SI-3, SI-4

NIST IR 8473
October 2023
Subcategory |DomainCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

DP-3 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

DP-4:

Ecosystem: Event information may include event origin,
type, scale, effected systems, or consequences to delivered
product and communicated to affected relevant parties.

Event detection
information iscommunicated.

Informative References
ISA/IEC 62443-21:D4E1
EVENT 1.1
ISA/IEC 62443-33:2013
SR 3.3[NIST-SP800-53r5]
AU-6, CA-2, CA-7,
RA-5, SI-4
NERC CIP
008-6-R4

DP-4 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
AU-6, CA-2, CA-7

DP-4 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
EVENT 1.2
ISA/IEC 62443-33:2013
SR 6.1

DP-4 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
AU-6, CA-2, CA-7

DP-4 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System specific considerations.

ISA/IEC 62443-21:D4E1
EVENT 1.2

DP-5:

Ecosystem: These improvements may take the form of
additional or increased tool use, activities, or Cyber ThreatIntelligence use.

[NIST-SP800-53r5]
CA-2, CA-7, PL-2,
PM-14, RA-5, SI-4

DP-5 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CA-2, CA-7, PL-2,
PM-14, RA-5

DP-5 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.1

DP-5 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CA-2, CA-7, PL-2,
PM-14, RA-5

DP-5 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

ISA/IEC 62443-21:D4E1
ORG 1.1

Detection processes
are continuously
improved.

ISA/IEC 62443-33:2013
SR 6.1

77

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Respond Function Considerations Across the EV/XFC Domains
The activities in the Respond function support the ability to contain the impact of an incident by
developing and implementing the appropriate responses to a detected cybersecurity attack oranomalous incident.
The Respond function actions are triggered by the outputs generated by the Detect function and
the Protect function provides the ability to execute the proper response to an incident according
to a pre-defined plan.
The objectives of the Response function are to:•Contain events using a verified response procedure.

•

Communicate the occurrence and impact of the incident to operations and relevant
parties.

•Develop processes to respond to and mitigate new known or anticipated threats orvulnerabilities.

•

Evolve response strategies and plans based on lessons learned.

5.4.1. Analysis
Analysis is conducted to verify the efficacy of the response and support recovery activities.
In the context of the EV/XFC ecosystem, the analysis should include the efficacy of IT and OT
responses.
Table 17. Respond: Analysis Category
Subcategory |DomainSpecific Considerations

Informative References

Ecosystem: Investigations may include combining relevant
notifications together, adding an initial detection system, or
updating the notifications to investigate. Investigation should
consider being used as a tool in system diagnosis,
event/incident response and mitigations.

[NIST-SP800-53r5]
AU-6, CA-7, IR-4, IR-5,
PE-6, RA-5, SI-4

AN-1 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CA-7, IR-5, SI-4

AN-1 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
CA-7, IR-5, SI-4

AN-1:
Notifications fromdetection systems
are investigated.

ISA/IEC 62443-21:D4E1
ORG 1.1, EVENT 1.7,
EVENT 1.8
ISA/IEC 62443-33:2013
SR 6.1
AN-1 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

78[NIST-SP800-53r5]
CA-7, IR-5, SI-4

NIST IR 8473
October 2023
Subcategory |DomainAN-1 |
Utility/Building
Management
SystemCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Applicable, but no additional Utility/Building Management
System-specific considerations.

Informative References[NIST-SP800-53r5]
CA-7, IR-5, SI-4
ISA/IEC 62443-21:D4E1
ORG 1.1, EVENT 1.7,
EVENT 1.8
ISA/IEC 62443-33:2013
SR 6.1

AN-2:
The impact of theincident isunderstood.
AN-2 | EV

AN-2 | XFC/EVSE

Ecosystem: In addition to the impacts to system availability,
data protection and integrity, consider broader impacts such as
loss of productivity, impact to external users/customers,
damage to reputation, etc.

[NIST-SP800-53r5]
CP-2, IR-4, RA-3

Impacts to safety critical systems and components should
consider being treated as high priority or understood ingreater detail.

[NIST-SP800-53r5]
CP-2, IR-4, RA-3

Impacts to safety critical systems and components should
consider being treated as high priority or understood ingreater detail.

[NIST-SP800-53r5]
CP-2, IR-4, RA-3

[NIST-SP800-61r2]
3[NIST-SP800-61r2]
3.2.4[NIST-SP800-61r2]
3.2.4
ISA/IEC 62443-21:D4E1
ORG 1.1, EVENT 1.7

AN-2 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CP-2, IR-4, RA-3

AN-2 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4, RA-3

AN-3:

Ecosystem: Forensics provide information that aids inselecting response actions and informs improvements for
future response plans.

Forensics are
performed.

ISA/IEC 62443-21:D4E1
ORG 1.1, EVENT 1.7[NIST-SP800-53r5]
AU-7, IR-4
[NIST-SP800-61r2]
2.4.2, 2.4.3, 3.1.1
NERC CIP
009-6-R1

AN-3 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
2.4.2, 2.4.3, 3.1.1

79

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainSpecific Considerations

AN-3 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

Informative References[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
2.4.2, 2.4.3, 3.1.1
ISA/IEC 62443-21:D4E1
EVENT 1.7
ISA/IEC 62443-33:2013
SR 2.8, SR 2.9, SR 2.10,
SR 2.11, SR 2.12, SR
3.9, SR 6.1

AN-3 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-61r2]
2.4.2, 2.4.3, 3.1.1

AN-3 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-61r2]
2.4.2, 2.4.3, 3.1.1
ISA/IEC 62443-21:D4E1
EVENT 1.7
ISA/IEC 62443-33:2013
SR 2.8, SR 2.9, SR 2.10,
SR 2.11, SR 2.12, SR
3.9, SR 6.1

AN-4:
Incidents are
categorized
consistent withresponse plans.
AN-4 | EV

Ecosystem: Categorizing incidents enables a more prompt
initiation of response actions and may influence future risk
management decisions.

[NIST-SP800-53r5]
CP-2, IR-4, IR-5, IR-8,
RA-3[NIST-SP800-61r2]
2, 3.2

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
IR-4, IR-5, IR-8, RA-3
[NIST-SP800-61r2]
2

AN-4 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
IR-4, IR-5, IR-8, RA-3
[NIST-SP800-61r2]
2
ISA/IEC 62443-21:D4E1
EVENT 1.7

AN-4 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
IR-4, IR-5, IR-8, RA-3
[NIST-SP800-61r2]
2

80

NIST IR 8473
October 2023
Subcategory |DomainAN-4 |
Utility/Building
Management
SystemCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations

Informative References

Applicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
IR-4, IR-5, IR-8, RA-3
[NIST-SP800-61r2]
2
ISA/IEC 62443-21:D4E1
EVENT 1.7

AN-5:
Processes are
established toreceive, analyze,
and respond tovulnerabilities
disclosed to theorganization frominternal and externalsources (e.g.,internal testing,security bulletins, or
security
researchers).
AN-5 | EV

Ecosystem: EV/XFC ecosystem members can consider
establishing processes to receive, analyze and respond to
disclosed vulnerabilities from internal or external sources.
Responses may include ensuring they are properly protectedagainst the vulnerability and updating policy, practices, or
guidance correspondingly.

[NIST-SP800-53r5]
CA-1, CA-2, PM-4,
PM-15, RA-1, RA-7,
SI-5, SR-6
[NIST-SP800-61r2]
3, 3.2[NIST-SP800-160V1]
3.4.9, 3.4.11
DHS-NCCIC
NERC CIP
007-6-R2

Vulnerabilities impacting safety critical systems may be given
higher priority or cause increased responses. Responses may
include, but are not limited to, testing mitigation
effectiveness, component recalls, and priority updates.

[NIST-SP800-53r5]
CA-1, CA-2, RA-1,
RA-7, SI-5, SR-6
[NIST-SP800-61r2]
3
DHS-NCCIC
ISO/SAE 21434
RQ-08-01, RQ-08-03,
RQ-08-05, RQ-08-07,
RQ-08-08
ISO 24089:20233

AN-5 | XFC/EVSE

AN-5 |
Cloud/Third-Party

Vulnerabilities impacting safety critical systems may be given
higher priority or cause increased responses. Responses may
include, but are not limited to, testing mitigation
effectiveness, component recalls, and priority updates.

[NIST-SP800-53r5]
CA-1, CA-2, RA-1,
RA-7, SI-5, SR-6

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CA-1, CA-2, RA-1,
RA-7, SI-5, SR-6

[NIST-SP800-61r2]
3[NIST-SP800-61r2]
3
DHS-NCCIC

81

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainAN-5 |
Utility/Building
Management
SystemSpecific Considerations
Applicable, but no additional Utility/Building Management
System-specific considerations.

Informative References[NIST-SP800-53r5]
CA-1, CA-2, RA-1,
RA-7, SI-5, SR-6
[NIST-SP800-61r2]
3
DHS-NCCIC

5.4.2. Communications
Response activities are coordinated with internal and external stakeholders (e.g., external support
from law enforcement agencies).
Relative to other ecosystems, the EV/XFC ecosystem’s response is likely to need more interorganization communications to enable a coordinated response to incidents.
Table 18. Respond: Communications Category
Subcategory |DomainCO-1:
Personnel know
their roles and orderof operations whena response isneeded.

CO-1 | EV

Specific Considerations
Ecosystem: The efficacy and timeliness of the response
depends on how well responders understand the recovery time
objectives and recovery point objectives, restoration priorities,
task sequences, and other tasks in a manner that is consistent
with the continuity plans.

Informative References[NIST-SP800-34r1][NIST-SP800-53r5]
CP-2, CP-3, IR-3, IR-8
[NIST-SP800-61r2]
Appendix A, 2.4
NERC CIP
009-6-R2

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CP-3, IR-8
[NIST-SP800-61r2]
Appendix A, 2.4

CO-1 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
CP-3, IR-8
[NIST-SP800-61r2]
Appendix A, 2.4
ISA/IEC 62443-21:D4E1
ORG 1.3, EVENT 1.8

CO-1 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

82[NIST-SP800-53r5]
CP-3, IR-8

NIST IR 8473
October 2023
Subcategory |DomainCO-1 |
Utility/Building
Management
SystemCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Applicable, but no additional Utility/Building Management
System-specific considerations.

Informative References[NIST-SP800-34r1][NIST-SP800-53r5]
CP-3, IR-8
[NIST-SP800-61r2]
Appendix A
ISA/IEC 62443-21:D4E1
ORG 1.3, EVENT 1.8

CO-2:
Incidents arereported, consistent
with establishedcriteria.
CO-2 | EV

Ecosystem: The reporting typically includes internal and theappropriate external relevant parties. Reporting can be done ina manner that is consistent with pre-defined thresholds andshould consider initiating the response in a timely manner.

[NIST-SP800-53r5]
AU-6, IR-6, IR-8
[NIST-SP800-61r2]
4
NERC-CIP-008-6

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
IR-6, IR-8
NERC-CIP-008-6

CO-2 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
IR-6, IR-8
NERC-CIP-008-6
ISA/IEC 62443-21:D4E1
ORG 1.1, EVENT 1.2

CO-2 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
IR-6, IR-8
[NIST-SP800-61r2]
Appendix A

CO-2 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System specific considerations.

[NIST-SP800-53r5]
IR-6, IR-8
[NIST-SP800-61r2]
Appendix A
ISA/IEC 62443-21:D4E1
ORG 1.1, EVENT 1.2

83

NIST IR 8473
October 2023
Subcategory |DomainCO-3:Consistent
information isshared withresponse plans.

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Ecosystem: The information shared may include the creation
or updating of information sharing response plan actions andactivities. Information may be shared with all effected
entities, both internal and external, and may include
information related to incident analysis, mitigation/recovery
efforts and plans, or paths forward.

Informative References[NIST-SP800-53r5]
CP-2, IR-4, IR-8
[NIST-SP800-61r2]
2.4

Organizations may coordinate with law enforcement andregulatory officials where applicable.
Consider sharing with industry groups, ISAC, or otherconsortia to increase cyber situational awareness.
CO-3 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4
[NIST-SP800-61r2]
2.4

CO-3 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4
[NIST-SP800-61r2]
2.4
ISA/IEC 62443-21:D4E1
EVENT 1.2

CO-3 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CP-2, IR-4

CO-3 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4

CO-4:

Ecosystem: Consider defining the terms and conditions
associated with the coordination in advance. Coordination
may take the form of communications, plans, activities, or
responsibilities.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-8

Coordination withstakeholders occurs
consistent withresponse plans.
CO-4 | EV

ISA/IEC 62443-21:D4E1
EVENT 1.2

[NIST-SP800-61r2]
2.3.4[NIST-SP800-61r2]
2.3.4

84

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainSpecific Considerations

CO-4 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

Informative References[NIST-SP800-53r5]
CP-2, IR-8
[NIST-SP800-61r2]
2.3.4
ISA/IEC 62443-21:D4E1
EVENT 1.2

CO-4 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CP-2, IR-8
[NIST-SP800-61r2]
2.3.4

CO-4 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-8
[NIST-SP800-61r2]
2.3.4
ISA/IEC 62443-21:D4E1
EVENT 1.2

Ecosystem: The domains are independent organizations that
may impact other domains. Information sharing assists thedomains by enabling proactive response actions, which
benefits the whole ecosystem. This information may include
cybersecurity risk positions or response actions.

[NIST-SP800-53r5]
PM-15, PM-16, SI-5

CO-5 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
PM-15, PM-16, SI-5

CO-5 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
PM-15, PM-16, SI-5

CO-5 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
PM-15, PM-16, SI-5

CO-5 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
PM-15, PM-16, SI-5

CO-5:
Voluntary
information sharing
occurs with external
stakeholders toachieve broader
cybersecurity
situationalawareness.

5.4.3. Improvements Category
Organizational response activities are improved by incorporating lessons learned from current
and previous detection/response activities.

85

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

In the context of the EV/XFC ecosystem, the sharing of lessons learned between domains canresult in ecosystem wide improvements.
Table 19. Respond: Improvements Category
Subcategory |DomainIM-1:
Response plansincorporate lessons
learned.
IM-1 | EV

Specific Considerations

Informative References

Ecosystem: Lessons learned may include past incidents, otherindustries responding to a similar incident, or from external
information sources.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8

[NIST-SP800-61r2]
3.4.1[NIST-SP800-61r2]
3.4.1
IM-1 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8
[NIST-SP800-61r2]
3.4.1
ISA/IEC 62443-21:D4E1
EVENT 1.8

IM-1 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8
[NIST-SP800-61r2]
3.4.1

IM-1 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8
[NIST-SP800-61r2]
3.4.1
ISA/IEC 62443-21:D4E1
EVENT 1.8

IM-2:
Response strategies
are updated.
IM-2 | EV

Ecosystem: Response strategies may include updating
response plans periodically either around major events or an
initial update.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8
ISO/SAE 21434
RQ-08-07, RQ-08-08,
RQ-13-01

86

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainSpecific Considerations

IM-2 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

Informative References[NIST-SP800-53r5]
CP-2, IR-4, IR-8
ISA/IEC 62443-21:D4E1
EVENT 1.8

IM-2 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8

IM-2 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8
ISA/IEC 62443-21:D4E1
EVENT 1.8

5.4.4. Mitigation
Activities are performed to contain an event, mitigate its effects, and resolve the incident.
Mitigation is not unique to the EV/XFC ecosystem, and, like other ecosystems, timely mitigation
will minimize the overall impact of the incident.
Table 20. Respond: Mitigation Category
Subcategory |DomainMI-1:
Incidents arecontained.
MI-1 | EV

Specific Considerations
Ecosystem: Timely containment can minimize the impact of
the incident and hastens the response and recovery.

Informative References[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
3.4.1

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
3.3, 3.3.1

MI-1 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
3.3, 3.4.1
ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.04,
NET 1.06, EVENT 1.8
ISA/IEC 62443-33:2013
SR 5.1, SR 5.2, SR 5.4

87

NIST IR 8473
October 2023
Subcategory |DomainMI-1 |
Cloud/Third-Party

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Applicable, but no additional Cloud/Third-Party-specificconsiderations.

Informative References[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
3.3, 3.4.1

MI-1 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
3.3, 3.4.1
ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.04,
NET 1.06, EVENT 1.8
ISA/IEC 62443-33:2013
SR 5.1, SR 5.2, SR 5.4

MI-2:
Incidents are
mitigated.

Ecosystem: Mitigation efforts may occur in response to
newly learned cyber threat intelligence, in response to an
incident, or as vulnerabilities become known, as part of an
automated security tool/program, or in accordance with
policies and contractual agreements.

[NIST-SP800-53r5]
IR-4

MI-2 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
3.3.1[NIST-SP800-61r2]
3.3.1
MI-2 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
3.3.1
ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.05,
NET 1.06, COMP 2.2

MI-2 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
3.3.1

88

NIST IR 8473
October 2023
Subcategory |DomainMI-2 |
Utility/Building
Management
SystemCybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Applicable, but no additional Utility/Building Management
System-specific considerations.

Informative References[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
3.3.1
ISA/IEC 62443-21:D4E1
NET 1.01, NET 1.05,
NET 1.06, COMP 2.2

MI-3:
Newly identified
vulnerabilities are
mitigated or
documented as
accepted risks.
MI-3 | EV

Ecosystem: Vulnerabilities may be considered as generalclasses or types instead of treating each specific vulnerability
separately.

[NIST-SP800-53r5]
CA-2, CA-7, RA-3,
RA-5, RA-7
[NIST-SP800-61r2]
3.4

Vulnerabilities impacting safety-critical systems may be given
higher priority or cause increased responses. Responses may
include, but are not limited to, testing mitigation
effectiveness, component recalls, priority updates.

[NIST-SP800-53r5]
CA-2, RA-3, RA-5,
RA-7[NIST-SP800-61r2]
3.4
ISO/SAE 21434
RQ-08-07, RQ-08-08,
RQ-13-01
ISO 24089:2021

MI-3 | XFC/EVSE

Vulnerabilities impacting critical systems may be given
higher priority or cause increased responses. Responses may
include, but are not limited to, testing mitigation
effectiveness, component recalls, priority updates.

[NIST-SP800-53r5]
CA-2, RA-3, RA-5,
RA-7[NIST-SP800-61r2]
3.4
ISA/IEC 62443-21:D4E1
EVENT 1.9

MI-3 |
Cloud/Third-Party

Applicable, but no Cloud/Third-Party-specific considerations.

[NIST-SP800-53r5]
CA-2, RA-3, RA-5,
RA-7[NIST-SP800-61r2]
3.4

89

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainMI-3 |
Utility/Building
Management
SystemSpecific Considerations
Applicable, but no additional Utility/Building Management
System-specific considerations.

Informative References[NIST-SP800-53r5]
CA-2, RA-3, RA-5,
RA-7[NIST-SP800-61r2]
3.4
ISA/IEC 62443-21:D4E1
EVENT 1.9

5.4.5. Response Planning
Response processes and procedures are executed and maintained after detected cybersecurity
incidents.
Response processes and procedures are not unique to the EV/XFC ecosystem, and like othercyber-ecosystems, need to be pre-defined for a timely response to an incident and avoid
ambiguities.
Table 21. Respond: Response Planning Category
Subcategory |DomainRP-1:
Response plan is
executed during or
after an incident.
RP-1 | EV

Specific Considerations

Informative References

Ecosystem: The domains may consider executing responseplans during or after an incident in accordance with the predefined threshold and document the steps and results of the
response plan as it is being executed.

[NIST-SP800-53r5]
CP-2, CP-10, IR-4, IR-8

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CP-10, IR-4
ISO 24089:2023

RP-1 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
CP-2, CP-10, IR-4

RP-1 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CP-10, IR-4

RP-1 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-34r1][NIST-SP800-53r5]
CP-2, CP-10, IR-4

Recover Function Considerations Across the EV/XFC Domains
Develop and implement the appropriate activities to maintain plans for resilience and to restore
any capabilities or services that were impaired due to a cybersecurity event. The activities in the
Recover function support timely recovery to normal operations to reduce the impact from acybersecurity event. Examples of outcome Categories within this function include:
90

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure•

Recovery Planning•

Improvements•

Communications

5.5.1. Communications
Restoration activities are coordinated with internal and external parties (e.g., coordinating
centers, internet service providers, owners of attacking systems, victims, other computer security
incident response teams, and vendors).
The communications category is not unique to the EV/XFC ecosystem, and like otherecosystems, timely communications and coordinated restoration will lead to more timely
recovery.
Table 22. Recover: Communications Category
Subcategory |DomainCO-1:
Public relations aremanaged.

CO-1 | EV

Specific Considerations

Informative References

Ecosystem: Management of public relations may include
different recipients such as shareholders, partners, users, andthe public. The message and communications may need to be
tailored in accordance with the recipients’ interests.
Communication in this regard may include disclosure of theevent/incident, recovery plans or activities, coordination withexternal partners or entities.

[NIST-SP800-53r5]
IR-4

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
4.1[NIST-SP800-61r2]
4.1
CO-1 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
4.1

CO-1 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
4.1

CO-1 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
IR-4[NIST-SP800-61r2]
4.1

91

NIST IR 8473
October 2023
Subcategory |DomainCO-2:
Reputation isrepaired after anincident.

Cybersecurity Framework Profile
EV/XFC Infrastructure
Specific Considerations
Ecosystem: This repair may take the form of public outreach,policy or activity reform, or coordination with external
partners or entities.

Informative References[NIST-SP800-53r5]
AU-6, IR-6, IR-8
[NIST-SP800-61r2]
4
NERC-CIP-008-6

CO-2 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
AU-6, IR-6, IR-8
[NIST-SP800-61r2]
4
NERC-CIP-008-6

CO-2 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
AU-6, IR-6, IR-8
[NIST-SP800-61r2]
4
NERC-CIP-008-6

CO-2 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
AU-6, IR-6, IR-8
[NIST-SP800-61r2]
4
NERC-CIP-008-6

CO-2 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
AU-6, IR-6, IR-8
[NIST-SP800-61r2]
4
NERC-CIP-008-6

CO-3:
Recovery activities
are communicatedto internal andexternal
stakeholders as well
as executive andmanagement teams.
CO-3 | EV

Ecosystem: Communications may consist of recovery
timelines, future mitigation/prevention strategies, and incident
or root-cause analysis.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8
[NIST-SP800-61r2]
3.4
NERC CIP
009-6-R3

Applicable, but no EV-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8
[NIST-SP800-61r2]
3.4

CO-3 | XFC/EVSE

Applicable, but no EVSE-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8
[NIST-SP800-61r2]
3.4

92

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainCO-3 |
Cloud/Third-Party

Specific Considerations
Applicable, but no additional Cloud/Third-Party-specificconsiderations.

Informative References[NIST-SP800-53r5]
CP-2, IR-4, IR-8
[NIST-SP800-61r2]
3.4

CO-3 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8
[NIST-SP800-61r2]
3.4

5.5.2. Improvements
Recovery planning and processes are improved by incorporating lessons learned into future
activities.
In the context of the EV/XFC ecosystem, sharing lessons learned between domains can result inecosystem wide improvements.
Table 23. Recover: Improvements Category.
Subcategory |DomainIM-1:
Recovery plansincorporate lessons
learned.

Specific Considerations
Ecosystem: Updated recovery plans may include updated,
new, or increased activities to reduce the likelihood of theevent occurring.

Informative References[NIST-SP800-53r5]
CP-2, IR-4, IR-8
[NIST-SP800-61r2]
3.4.1
NERC CIP
009-6-R3

IM-1 | EV

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4
[NIST-SP800-61r2]
3.4.1
ISO/SAE 21434
RG-05-08

IM-1 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4
[NIST-SP800-61r2]
3.4.1
ISA/IEC 62443-21:D4E1
EVENT 1.8, AVAIL 1.1

93

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Subcategory |DomainIM-1 |
Cloud/Third-Party

Specific Considerations
Applicable, but no additional Cloud/Third-Party-specificconsiderations.

Informative References[NIST-SP800-53r5]
CP-2, IR-4
[NIST-SP800-61r2]
3.4.1

IM-1 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4
[NIST-SP800-61r2]
3.4.1
ISA/IEC 62443-21:D4E1
EVENT 1.8, AVAIL 1.1

IM-2:
Recovery strategies
are updated.
IM-2 | EV

Ecosystem: Updates to the strategy may include updating
response plans periodically, around major events, or an initial
update.

[NIST-SP800-53r5]
CP-2, IR-4, IR-8

Applicable, but no additional EV-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4

[NIST-SP800-61r2]
3.4, 3.4.1[NIST-SP800-61r2]
3.4.1
IM-2 | XFC/EVSE

Applicable, but no additional EVSE-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4
[NIST-SP800-61r2]
3.4.1
ISA/IEC 62443-21:D4E1
EVENT 1.8, AVAIL 1.1

IM-2 |
Cloud/Third-Party

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
CP-2, IR-4
[NIST-SP800-61r2]
3.4.1

IM-2 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-53r5]
CP-2, IR-4
[NIST-SP800-61r2]
3.4.1
ISA/IEC 62443-21:D4E1
EVENT 1.8, AVAIL 1.1

5.5.3. Recovery Planning
Recovery processes and procedures are executed and maintained to ensure restoration of systems
or assets affected by cybersecurity incidents.

94

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Recovery processes and procedures are not unique to the EV/XFC ecosystem, but theprioritization of recovery operations may be informed by the impact of the assets to otherdomains.
Table 24. Recover: Recovery Planning Category
Subcategory |DomainRP-1:
Recovery plan is
executed during or
after an incident.

Specific Considerations
Ecosystem: A recovery plan may include an evaluation andupdating processes to the recovery plan.

Informative References[NIST-SP800-34r1][NIST-SP800-53r5]
CP-10, IR-4, IR-8
[NIST-SP800-160V1]
3.4.11, Appendix F.2.6[NIST-SP800-184]
NERC CIP
009-6-R1, 009-6-R2

RP-1 | EV

RP-1 | XFC/EVSE

RP-1 |
Cloud/Third-Party

Recovery plans may potentially include proliferation of any
software, hardware and policy updates, mitigation
implementations, or recalls to all affected EV production
centers and individual EVs.

[NIST-SP800-53r5]
IR-4, IR-8

Consider having recovery plans include proliferation of any
software, hardware and policy updates, mitigation
implementations, or recalls to all affected EVSE production
centers and individual EVSE devices.

[NIST-SP800-53r5]
IR-4, IR-8

Applicable, but no additional Cloud/Third-Party-specificconsiderations.

[NIST-SP800-53r5]
IR-4, IR-8

[NIST-SP800-184]
ISO/SAE 21434
RQ-13-01, RQ-13-02[NIST-SP800-184]
ISA/IEC 62443-21:D4E1
EVENT 1.8

[NIST-SP800-184]
RP-1 |
Utility/Building
Management
SystemApplicable, but no additional Utility/Building Management
System-specific considerations.

[NIST-SP800-34r1][NIST-SP800-53r5]
IR-4, IR-8
[NIST-SP800-184]
ISA/IEC 62443-21:D4E1
EVENT 1.8

95

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

References[ATIS-I-0000070]

Alliance for Telecommunications Industry Solutions (2018) ContextAware Identity Management Framework, ATIS-I-0000070 (ATIS,
Washington, DC). Available athttps://access.atis.org/apps/group_public/download.php/43565/ATISI0000070.pdf[Auto-ISAC]

Automotive Information Sharing and Analysis Center. Available at:https://automotiveisac.com/[CISA-CIVR-PB]

Cybersecurity and Infrastructure Security Agency (2021) Cybersecurity
Incident & Vulnerability Response Playbooks: Operational Procedures
for Planning and Conducting Cybersecurity Incident and Vulnerability
Response Activities in FCEB Information Systems. (CISA, Washington,
DC). Available athttps://www.cisa.gov/sites/default/files/publications/Federal_Governmen
t_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508
C.pdf[CISA-ICS]

Cybersecurity and Infrastructure Security Agency (2020) Industrial
Control Systems. (CISA, Washington, DC). Available at https://uscert.cisa.gov/ics[CISA-RFI-BPG]

Cybersecurity and Infrastructure Security Agency and
SAFECOM/National Council of Statewide Interoperability Coordinators(2020) Radio Frequency Interference Best Practices Guidebook. (CISA,
Washington, DC). Available athttps://www.cisa.gov/sites/default/files/publications/safecomncswic_rf_interference_best_practices_guidebook_2.7.20__final_508c.pdf[DHS-NCCIC]

Department of Homeland Security (2012) National Cybersecurity &Communications Integration Center (NCCIC) Overview. (DHS,
Washington, DC). Available athttps://csrc.nist.gov/CSRC/media/Events/ISPAB-OCTOBER2012MEETING/documents/ispab_oct2012_lzelvin_nccic-overview.pdf[EEI-2022]

Scruggs T (2022) “EEI Projects 26.4 Million Electric Vehicles Will Be
on U.S. Roads in 2030”. Edison Electric Institute. June 20, 2022.
Available at: https://www.eei.org/News/news/All/eei-projects-26million-electric-vehicles-will-be-on-us-roads-in-2030[E-ISAC]Electricity information Sharing and Analysis Center. Available at:https://www.eisac.com/s/[EO.13636]

The White House, Office of the Press Secretary. “Executive Order -Improving Critical Infrastructure Cybersecurity”. February 12, 2013.
Available at: https://obamawhitehouse.archives.gov/the-pressoffice/2013/02/12/executive-order-improving-critical-infrastructurecybersecurity

96

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure[Energies-2019]

Ronanki, D, Kelkar, A, Williamson, S. “Extreme Fast Charging
Technology—Prospects to Enhance Sustainable Electric Transportation”.
Energies 2019,12, 3721. https://doi.org/10.3390/en12193721[EPRI-2023]

Cybersecurity Platform and Certification Framework Development for
Extreme Fast Charging (XFC)-Integrated Charging Ecosystem. EPRI,
Palo Alto, CA: 2023. 3002027649. Available at:https://www.epri.com/research/products/000000003002027649[Grandview]

Grand View Research. “U.S. Electric Vehicle (EV) Charging
Infrastructure Market Size, Share & Trends Analysis Report By Charger
Type, By Connector Type, By Level of Charging, By Connectivity, By
Application, And Segment Forecasts, 2023 – 2030” Report ID: GVR-368038-309-6. Available at:https://www.grandviewresearch.com/industry-analysis/us-electricvehicle-charging-infrastructure-evci-market[IEC 61850-90-4]

International Electrotechnical Commission (2020) IEC TR 61850-904:2020 Communication networks and systems for power utility
automation - Part 90-4: Network engineering guidelines (IEC, Geneva,
Switzerland). Available at https://webstore.iec.ch/publication/64801[IEC61850-90-12]

International Electrotechnical Commission (2020) IEC TR 61850-9012:2020 Communication networks and systems for power utility
automation - Part 90-12: Wide area network engineering guidelines.
(IEC, Geneva, Switzerland). Available athttps://webstore.iec.ch/publication/63706[IEC62439-3]

International Electrotechnical Commission (2021) IEC 62439-3
Industrial communication networks - High availability automation
networks - Part 3: Parallel Redundancy Protocol (PRP) and Highavailability Seamless Redundancy (HSR). (IEC, Geneva, Switzerland).
Available at https://webstore.iec.ch/publication/64423[IEC62443-2-1]

International Electrotechnical Commission (2010) IEC 62443-2-1:2010
Industrial communication networks - Network and system security - Part
2-1: Establishing an industrial automation and control system security
program. (IEC, Geneva, Switzerland). Available athttps://webstore.iec.ch/publication/7030[IEC62443-3-3]

International Electrotechnical Commission (2013) IEC 62443-3-3:2013
Industrial communication networks - Network and system security - Part
3-3: System security requirements and security levels. (IEC, Geneva,
Switzerland). Available at https://webstore.iec.ch/publication/7033[IETF-RFC4082]

Perrig A, Song D, Canetti R, Tygar JD, Briscoe B (2005) Timed Efficient
Stream Loss-Tolerant Authentication (TESLA): Multicast Source
Authentication Transform Introduction. (Internet Engineering Task Force(IETF) Network Working Group), IETF Request for Comments (RFC)
4082. https://doi.org/10.17487/RFC4082[ISO 24089]

International Organizations for Standardization. (2023). Road vehicles97

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Software update engineering. (24089:2023). Available athttps://www.iso.org/standard/77796.html[ISO-SAE-21434]

International Organizations for Standardization/SAE. (2021).
Road vehicles — Cybersecurity engineering.(21434:2021). Available athttps://www.iso.org/obp/ui/en/#iso:std:iso-sae:21434:ed-1:v1:en[Johnson-Berg]

Johnson J, Berg T, Anderson B, Wright, B. (2022). Review of Electric
Vehicle Charger Cybersecurity Vulnerabilities, Potential Impacts, andDefenses. Energies. 15. 3931. https://doi.org/10.3390/en15113931.

[NERC-CIP-008-6]

North American Electric Reliability Corporation (2020) CIP-008-6 –Cyber Security – Incident Reporting and Response Planning. Available
at https://www.nerc.com/pa/Stand/Reliability%20Standards/CIP-0086.pdf[NERC-GridEx]

North American Electric Reliability Corporation (2020) GridEx.
Available at https://www.nerc.com/pa/CI/ESISAC/Pages/GridEx.aspx[NIST-CSF]

National Institute of Standards and Technology (2018) Framework for
Improving Critical Infrastructure Cybersecurity, Version 1.1. (National
Institute of Standards and Technology, Gaithersburg, MD).
https://doi.org/10.6028/NIST.CSWP.04162018[NIST-IR7298]

Paulsen C, Byers R. (2022). Glossary of Key Information Security
Terms. Available at:https://csrc.nist.gov/publications/detail/nistir/7298/rev-3/final[NIST-IR7800]

Waltermire D, Halbardier A, Humenansky A, Mell P (2012) Applying
the Continuous Monitoring Technical Reference Model to the Asset,
Configuration, and Vulnerability Management Domains. (National
Institute of Standards and Technology, Gaithersburg, MD), NISTInteragency or Internal Report (IR) 7800 (Draft). Available athttps://csrc.nist.gov/CSRC/media/Publications/nistir/7800/draft/documen
ts/Draft-NISTIR-7800.pdf[NIST-IR8014]

Hastings NE, Franklin JM (2015) Considerations for Identity
Management in Public Safety Mobile Networks. (National Institute ofStandards and Technology, Gaithersburg, MD), NIST Interagency orInternal Report (IR) 8014. https://doi.org/10.6028/NIST.IR.8014[NIST-IR8179]

Paulsen C, Boyens JM, Bartol N, Winkler K (2018) Criticality Analysis
Process Model: Prioritizing Systems and Components. (National Instituteof Standards and Technology, Gaithersburg, MD), NIST Interagency orInternal Report (IR) 8179. https://doi.org/10.6028/NIST.IR.8179[NIST-IR8320]

Bartock M, Souppaya M, Savino R, Knoll T, Shetty U, Cherfaoui M,
Yeluri R, Malhotra A, Banks D, Jordan M, Pendarakis D, Rao JR,
Romness P, Scarfone K (2022) Hardware-Enabled Security: Enabling aLayered Approach to Platform Security for Cloud and Edge Computing
Use Cases. (National Institute of Standards and Technology,

98

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8320.
https://doi.org/10.6028/NIST.IR.8320[NIST-SP1271]

NIST SP 1271, Getting Started with the NIST Cybersecurity Framework:
A Quick Start Guide. https://doi.org/10.6028/NIST.SP.1271[NIST-SP800-30r1]

Joint Task Force Transformation Initiative (2012) Guide for Conducting
Risk Assessments. (National Institute of Standards and Technology,
Gaithersburg, MD), NIST Special Publication (SP) 800-30, Rev. 1.
https://doi.org/10.6028/NIST.SP.800-30r1[NIST-SP800-34r1]

Swanson MA, Bowen P, Phillips AW, Gallup D, Lynes D (2010)
Contingency Planning Guide for Federal Information Systems. (National
Institute of Standards and Technology, Gaithersburg, MD), NIST Special
Publication (SP) 800-34, Rev. 1, Includes updates as of November 11,
2010. https://doi.org/10.6028/NIST.SP.800-34r1[NIST-SP800-37r2]

Joint Task Force (2018) Risk Management Framework for Information
Systems and Organizations: A System Life Cycle Approach for Security
and Privacy. (National Institute of Standards and Technology,
Gaithersburg, MD), NIST Special Publication (SP) 800-37, Rev. 2.
https://doi.org/10.6028/NIST.SP.800-37r2[NIST-SP800-53r5]

Joint Task Force (2020) Security and Privacy Controls for Information
Systems and Organizations. (National Institute of Standards andTechnology, Gaithersburg, MD), NIST Special Publication (SP) 800-53,
Rev. 5. Includes updates as of December 10, 2020.
https://doi.org/10.6028/NIST.SP.800-53r5[NIST-SP800-61r2]

Cichonski PR, Millar T, Grance T, Scarfone KA (2012) Computer
Security Incident Handling Guide. (National Institute of Standards andTechnology, Gaithersburg, MD), NIST Special Publication (SP) 800-61,
Rev. 2. https://doi.org/10.6028/NIST.SP.800-61r2[NIST-SP800-92]

Kent K, Souppaya MP (2006) Guide to Computer Security Log
Management. (National Institute of Standards and Technology,
Gaithersburg, MD), NIST Special Publication (SP) 800-92.
https://doi.org/10.6028/NIST.SP.800-92[NIST-SP800-115]

Scarfone KA, Souppaya MP, Cody A, Orebaugh AD (2008) Technical
Guide to Information Security Testing and Assessment. (National
Institute of Standards and Technology, Gaithersburg, MD), NIST Special
Publication (SP) 800-115. https://doi.org/10.6028/NIST.SP.800-115[NIST-SP800-128]

Johnson LA, Dempsey KL, Ross RS, Gupta S, Bailey D (2011) Guide
for Security-Focused Configuration Management of Information
Systems. (National Institute of Standards and Technology, Gaithersburg,
MD), NIST Special Publication (SP) 800-128, Includes updates as of
October 10, 2019. https://doi.org/10.6028/NIST.SP.800-128[NIST-SP800-137]

Dempsey KL, Chawla NS, Johnson LA, Johnston R, Jones AC,
Orebaugh AD, Scholl MA, Stine KM (2011) Information Security

99

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC InfrastructureContinuous Monitoring (ISCM) for Federal Information Systems andOrganizations. (National Institute of Standards and Technology,
Gaithersburg, MD), NIST Special Publication (SP) 800-137.
https://doi.org/10.6028/NIST.SP.800-137[NIST-SP800-150]

Johnson CS, Waltermire DA, Badger ML, Skorupka C, Snyder J (2016)
Guide to Cyber Threat Information Sharing. (National Institute ofStandards and Technology, Gaithersburg, MD), NIST Special
Publication (SP) 800-150. https://doi.org/10.6028/NIST.SP.800-150[NIST-SP800-154]

Souppaya M, Scarfone K (2016) Guide to Data-Centric System Threat
Modeling. (National Institute of Standards and Technology,
Gaithersburg, MD), NIST Special Publication (SP) 800-154 (Draft).
Available at https://csrc.nist.gov/publications/detail/sp/800-154/draft[NIST-SP800-160V1] Ross RS, Oren JC, McEvilley M (2016) Systems Security Engineering:Considerations for a Multidisciplinary Approach in the Engineering ofTrustworthy Secure Systems. (National Institute of Standards andTechnology, Gaithersburg, MD), NIST Special Publication (SP) 800160, Vol. 1, Includes updates as of March 21, 2018.
https://doi.org/10.6028/NIST.SP.800-160v1[NIST-SP800-161]

Boyens J, Paulsen C, Moorthy R, Bartol N (2015) Supply Chain Risk
Management Practices for Federal Information Systems andOrganizations. (National Institute of Standards and Technology,
Gaithersburg, MD), NIST Special Publication (SP) 800-161.
http://doi.org/10.6028/NIST.SP.800-161[NIST-SP800-175Br1] Barker EB (2020) Guideline for Using Cryptographic Standards in theFederal Government: Cryptographic Mechanisms. (National Institute ofStandards and Technology, Gaithersburg, MD), NIST Special
Publication (SP) 800-175B, Rev. 1.
https://doi.org/10.6028/NIST.SP.800-175Br1[NIST-SP800-184]

Bartock MJ, Scarfone KA, Smith MC, Witte GA, Cichonski JA,
Souppaya MP (2016) Guide for Cybersecurity Event Recovery.
(National Institute of Standards and Technology, Gaithersburg, MD),NIST Special Publication (SP) 800-184.
https://doi.org/10.6028/NIST.SP.800-184[NIST-SP800-193]

Regenscheid AR (2018) Platform Firmware Resiliency Guidelines.
(National Institute of Standards and Technology, Gaithersburg, MD),NIST Special Publication (SP) 800-193.
https://doi.org/10.6028/NIST.SP.800-193[NIST-SP800-209]

Chandramouli R, Pinhas D (2020) Security Guidelines for Storage
Infrastructure. (National Institute of Standards and Technology,
Gaithersburg, MD), NIST Special Publication (SP) 800-209.
https://doi.org/10.6028/NIST.SP.800-209[NIST-SP800-218]

Souppaya M, Scarfone K, Dodson D (2022) Secure Software
Development Framework (SSDF) Version 1.1: Recommendations for
100

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Mitigating the Risk of Software Vulnerabilities. (National Institute ofStandards and Technology, Gaithersburg, MD), NIST Special
Publication (SP) 800-218. https://doi.org/10.6028/NIST.SP.800-218[NIST-SP1800-19]

Bartock M, Souppaya M, Dodson D, Carroll D, Masten R, Scinta G,
Massis P, Prafullchandra H, Malnar J, Singh H, Ghandi R, Storey L,
Yeluri R, Shea T, Dalton M, Weber R, Scarfone K, Phoenix C, Dukes A,
Haskins J, Swarts B (2022) Trusted Cloud: Security Practice Guide for
VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments.
(National Institute of Standards and Technology, Gaithersburg, MD),NIST Special Publication (SP) 1800-19. Available athttps://doi.org/10.6028/NIST.SP.1800-19[NIST-SP1800-34]

Diamond T, Grayson N, Polk W, Regenscheid A, Souppaya M, Brown
C, Deane C, Scarfone K (2022) Validating the Integrity of Computing
Devices. (National Institute of Standards and Technology, Gaithersburg,
MD), NIST Special Publication (SP) 1800-34 (Final). Available athttps://doi.org/10.6028/NIST.SP.1800-34[RTCA-DO-235]

Radio Technical Commission for Aeronautics (2008) RTCA DO-235A
Assessment of Radio Frequency Interference Relevant to the GNSS L1
Frequency Band. (RTCA, Washington, DC). Available athttps://standards.globalspec.com/std/1090607/RTCA%20DO-235[S.1353]

S.1353 - 113th Congress (2013-2014): Cybersecurity Enhancement Act
of 2014, S.1353, 113th Cong. (2014),
https://www.congress.gov/bill/113th-congress/senate-bill/1353/text.

101

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

Appendix A. List of Symbols, Abbreviations, and Acronyms
AAR
After Action Report
AC
Alternating Current
API
Application Programming Interface
AUTO-ISAC
Automotive Information Sharing and Analysis Center
BESS
Battery Energy Storage System
BMS
Battery Management System
CAN
Control Area Network
CD
Compact Disc
COI
Community of Interest
COTS
Commercial Off the Shelf
CRC
Cyclic Redundancy Check
CSF
Cybersecurity Framework
CTI
Cyber Threat Intelligence
CVE
Common Vulnerabilities and Exposures
CVSS
Common Vulnerability Scoring System
CWE
Common Weakness Enumeration
DAR
Data-At-Rest
DC
Direct Current
DE
Detect102

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

DER
Distributed Energy Resources
DIT
Data-In-Transit
DOE
Department of Energy
DVD
Digital Versatile Disc
E-ISACElectricity Information Sharing and Analysis Center
ECU
Electronic Control Unit
EO
Executive Order
EPRI
Electric Power Research Institute
EV
Electric Vehicle
EVSE
Electric Vehicle Supply Equipment
EVTOLSElectric Vehicle Take-Off and Landing
FERC
Federal Energy Regulatory Commission
HMI
Human-Machine Interface
ICS
Industrial Control System
ID
Identify / Identity
IIOT
Industrial Internet of Things
IOT
Internet of Things
IT
Information Technology
IEC
International Electrotechnical Commission
ISAC
Information Sharing and Analysis Center

103

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

ISOInternational Organization for Standardization
MOU
Memorandum of Understanding
MFA
Multi-Factor Authentication
NERC
North American Electric Reliability Corporation
NFC
Near Field Communication
NIST
National Institute of Standards and Technology
NVD
National Vulnerability Database
OBD-II
On-Board Diagnostic II
OCPIOpen Charge Point Interface
OCPP
Open Charge Point Protocol
OEM
Original Equipment Manufacturer
OT
Operational Technology
OTA
Over the Air
PCI
Payment Card Industry
PII
Personally Identifiable Information
PIN
Personal Identification Number
PLC
Programmable Logic Controller
PR
Protect
RBAC
Role Based Access Control
RC
Recover104

NIST IR 8473
October 2023

Cybersecurity Framework Profile
EV/XFC Infrastructure

RFRadio Frequency
RS
Respond
SBOM
Software Bill of Material
SDLC
Software Development Lifecycle
SCADA
Supervisory Control and Data Acquisition
SCRM
Supply Chain Risk Management
SD
Secure Digital
SLA
Service Level Agreement
TTP
Tactics, Techniques, and Procedures
TTX
Tabletop Exercise
V2G
Vehicle-To-Grid
XFC
Extreme Fast Charging

105