The ISAGCA, International Society of Automation Global Cybersecurity Alliance wish to thank the NIST for the 

opportunity to file these comments in response to the Workshop and Call for Position Papers on Standards 

and Guidelines to Enhance Software Supply Chain Security, related to the May 12, 2021, EO 14028. 

The ISAGCA is a collaborative forum hosted by the International Society of Automation (ISA), a 40,000-

member global professional automation engineering society. ISAGCA’s mission is to advance cybersecurity 

readiness through awareness, education, standards, and knowledge sharing. Membership is open to any 

organization concerned about cybersecurity—end users, automation providers, system integrators, 

consultants, government agencies, and more 

ISAGCA member companies, industry organizations, and their constituents represent over $1.5 Trillion in 

annual revenues, coming from industries such as Oil & Gas, Pharma, Automotive, Automation suppliers, IT 

suppliers, and cybersecurity products and services. 

ISAGCA Member companies and thought leaders have a long history of adopting a standards-based approach 

for securing automation products and operating sites based on the ISA/IEC 62443 series of international 

cybersecurity standards. The scope of ISA/IEC 62443 standards applies to critical software in all phases of 

the automation solution lifecycle. 

Product suppliers have been developing automation products using ISA/IEC 62443 security lifecycle practices 

in their development processes since 2010. Companies are having their development processes and products 

independently audited/certified to be conformant with ISA/IEC 62443 via accredited certification bodies in 

the US and around the globe. Company examples include ABB, Aveva, Azbil, Bayshore Networks, Carrier 

Corporation, CISCO, Eaton, Emerson Automation Solutions, Emerson Power & Water Solutions, GE Power 

Conversion, Hima, Hitachi, Honeywell, Johnson Controls, Nexus Controls, Rockwell Automation, Schneider 

Electric, Siemens, Toshiba, Yokogawa, Valmet, Wartsila, and many others. 

End users (asset owner/operators) are establishing cybersecurity programs at operating sites based upon 

ISA/IEC 62443, including their critical software. 

The internationally recognized ISA/IEC 62443 standards have been adopted in the USA and throughout the 

globe. This is important since most product suppliers (includes critical software) have global customers. 

Further, many end-user companies operate internationally. ISA/IEC 62443 provides a common vocabulary for 

managing cybersecurity capabilities. A globally accepted set of standards reduces barriers to trade where 

country-specific product certifications are mutually recognized. It also provides end-users the basis for 

establishing companywide cybersecurity practices useful in all geographies. 

ISA and its members have been an ardent supporter of the NIST CSF and contributed to its development of 

NIST CSF in 2014 and the ISA/IEC 62443 standard. The NIST CSF includes several key standards as informative 

references as a basis for implementing the NIST CSF requirements. ISA/IEC 62443 are featured prominently 

for operational technology and automation. See attached Table A which shows where the ISA/IEC 62443 

standards align with the NIST CSF requirements. 

ISAGCA members request that NIST, in their Executive Order deliverables, consider the attached input to the 

Executive Order. Respectfully submitted by Andre Ristaino on behalf of the ISAGCA members. Feel free to 

reach out to me with any questions or to schedule a briefing on these recommendations. 

Contact Info: Andre Ristaino, ISA Managing Director, Global Alliances, Consortia, Conformity Assessment 

aristaino@isa.org Phone: 919-323-7660 67 T.W. Alexander Drive RTP, NC 27709 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

ISAGCA asks that you consider these additions to the Executive Order: 

1. Reference these standards when defining “Critical Software”: EO Section 4(g). 

a. ISA/IEC 62443-3-3-SR.5.2RE(2)/RE(3); ISA/IEC 62443-4-2-CR.2.10/CR.7.1) to define commands 

and essential functions including parameters and associated data that must be properly 

protected either by built-in technical capabilities (ISA/IEC 62443-4-2), integrated system 

capabilities (ISA/IEC 62443-3-3) and/or procedural/organizational capabilities(ISA/IEC 62443-4-

1; ISA/IEC 62443-2-4 and ISA/IEC 62443-2-1). 

b. ISA/IEC 62443-2-4 standard defines best practices for OT Service Providers with a set of security 

capabilities that an organization needs to have while designing a secure automation solution. 

That includes the associated, hardware, software, and data. 

c. ISA/IEC 62443-2-4-SP.03.01BR provides Rationale to ISA/IEC 62443-3-2 including capability to 

translate a business, production and ultimately safety risk into technical and procedural 

capabilities that a system needs to encompass to become feasible 

d. ISA/IEC 62443-2-4-SP.03.09BR/10BR) including its safeguarding requirements needed to 

perform the risk translation includes the capacity to identify and manage security vulnerabilities 

and associated threats for all the associated components of the automation solution and its 

authorized data storage points, data flows and control actions by design 

2. Reference ISA/IEC 62443 4-1 Product Security Development Life-Cycle Requirements as a standard to 

secure software development lifecycle for Operational Technologies. EO Section 4(e) which describes 

component or system development lifecycle requirements related to cyber security for those 

components or systems intended for use in an OT environment and provides guidance on how to meet 

the requirements described for each element. When a Product Supplier is using an ISA/IEC 62443-4-1 

compliant process, enables a Service Provider to follow the ISA/IEC 62443-2-4 compliant practices to 

integrate, configure, validate, commission, and maintain an intended security posture by design. 

3. Reference ISA/IEC 62443 4-2 Technical Security Requirements for Automation Components as a 

standard to secure software development lifecycle for Operational Technologies components. EO 

Section 4(e) 

4. Reference ISA/IEC 62443 3-3 System Security Requirements and Security Levels as a standard to define 

security measures that shall be applied to the federal government’s use of critical software. E.O. 

Section 4(I) 

5. Reference ISA/IEC 62443 4-1 Product Security Development Life-Cycle Requirements (Section 9) to 

define the minimum requirements for testing software source code. See EO Sections 4(e)(iv, v) and 

4(r). 

6. Reference ISA/IEC 62443-4-1-SM-9 Security Requirements for externally provided components requires 

software development organizations to have a process to identify and manage security risks of all 

externally provided components used within the product. An SBOM implementation can be utilized as 

a method satisfy this requirement. The rationale of that requirement provides the guidance for 

compliance, referring to the Defense in Depth strategy, identifying all components as well as their 

security context, rigor applied to the component implementation, verification/validation, notifications, 

etc. 

Many independent conformity assessment programs are already in place in the USA and around the globe 

which provide assurances that suppliers are utilizing the ISA/IEC 62443 requirements in their software design, 

development, deployment, and maintenance practices. 
Table A – Map of ISA 62443 to NIST CSF