chrisbst48/IT-Grundschutz-Compendium_2022_EN huggingface dataset:
IND.2.1.A6 Network Segmentation [OT Operations, Planner] (B)
ICS components MUST be separated from office IT. If ICS components depend on other components in the network in question, this SHOULD be documented sufficiently. ICS components SHOULD communicate as little as possible with other ICS components.
IND.2.1.A7 Creating Backups [OT Operations] (S)
Backups MUST be created prior to each system change in an ICS component.
IND.2.1.A8 Protection Against Malware [OT Operations] (S)
ICS components SHOULD be protected against malware by suitable mechanisms (see OPS.1.1.4 Protection Against Malware). If an anti-virus protection program is used in this regard, the program and the virus signatures approved by the manufacturer SHOULD always be up to date. If the resources on the ICS component are not sufficient or real-time requests could be endangered by the use of anti-virus protection programs, alternative safeguards (such as the isolation of the ICS component or the production network) SHOULD be implemented.
IND.2.2 Programmable Logic Controller (PLC)
Target Object: IT system / Order: R2
IND.2.2.A1 Extended System Documentation for Programmable Logic Controllers [OT Operations] (S)
Control programs and configurations SHOULD always be backed up before they are changed. Changes in configurations and the replacement of components SHOULD be fully documented.
IND.2.2.A3 Time Synchronisation [OT Operations] (S)
The system time SHOULD be set automatically through centrally automated time synchronisation.
IND.2.3 Sensors and Actuators
Target Object: IT system / Order: R2
IND.2.3.A1 Installation of Sensors [OT Operations, Maintenance Personnel] (B)
Sensors MUST be appropriately installed and be sufficiently robust. They MUST be able to provide reliable measurements despite extreme environmental conditions related to heat, cold, dust, vibration, or corrosion.
IND.2.3.A2 Calibration of Sensors [Maintenance Personnel] (S)
If necessary, sensors SHOULD be calibrated regularly. The calibration SHOULD be documented appropriately. Access to a sensor's calibration functions MUST be protected.
IND.2.3.A3 Wireless Communication (H)
Wireless management interfaces such as Bluetooth, WLAN, or NFC SHOULD NOT be used. Any unused communication interfaces SHOULD be disabled.
IND.2.4 Machine
Target Object: IT system / Order: R2
IND.2.4.A1 Remote Maintenance by Mechanical and System Engineers [OT Operations] (B)
There MUST be a central policy for remote maintenance of a machine. This MUST regulate how the respective remote maintenance solutions should be used. The policy MUST also specify how communication links should be protected. It MUST describe the activities to be monitored during remote maintenance, as well. Moreover, it SHOULD NOT be possible to access other IT systems or machines of the organisation in question via remote maintenance of a machine. If a service provider is to be used in this regard, the manner in which the information stored in the machine is to be processed MUST be agreed.
IND.2.4.A2 Operation After End of Warranty [OT Operations] (B)
A process designed to ensure that a given machine can be securely operated beyond its warranty period MUST be established. To this end, further support services MUST be contractually agreed with the supplier.
IND.2.7 Safety Instrumented Systems
Target Object: IT system / Order: R2
IND.2.7.A1 Recording and Documentation [Planner, Maintenance Personnel] (B)
All the hardware and software components, relevant information, connections, roles, and responsibilities pertaining to a given SIS MUST be recorded and documented separately.
IND.2.7.A10 Displays and Alerts Pertaining to Simulated or Bridged Variables [Planner] (S)
SIS variables that are occupied (simulated) by substitute values or bridged externally SHOULD be monitored in an appropriate manner. The values SHOULD be displayed continuously to the user. Limit values SHOULD be defined. If these limit values are reached, a suitable alert SHOULD be sent to the persons in charge.
IND.2.7.A11 Dealing with Integrated Systems [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
For integrated systems, a suitable strategy SHOULD be developed that regulates the handling of components that affect functional safety.
IND.2.7.A12 Ensuring the Integrity and Authenticity of Application Programs and Configuration Data [Planner] (H)
Care SHOULD be taken to ensure that manufacturers develop and integrate appropriate mechanisms to ensure the integrity and authenticity of configuration data and application programs on logic systems or associated sensors and actuators. Any software that is offered for download SHOULD be protected from manipulation. Integrity violations SHOULD be detected and reported automatically.
IND.2.7.A2 Specified Use of Hardware and Software Components [Maintenance Personnel] (B)
The hardware and software components belonging to or used in connection with an SIS MUST NOT be used for any other purpose.
IND.2.7.A3 Changing the Application Program on the Logic System [Maintenance Personnel] (B)
Existing protection mechanisms on the logic system in question MUST be activated. If this is not possible, alternative measures MUST be taken. User programs on logic systems MUST ONLY be changed or released for transmission by authorised persons.
IND.2.7.A4 Making Information Security an Integral Part of Functional Safety Management [ICS Information Security Officer] (S)
All processes and responsibilities pertaining to the information security of SIS SHOULD be clearly defined. These should be described and named in the corresponding functional safety management system.
IND.2.7.A5 SIS Business Continuity Management [ICS Information Security Officer] (S)
The manner in which security incidents are to be handled SHOULD be defined in an incident response plan. This plan SHOULD define the roles and responsibilities and include the measures to be taken.
IND.2.7.A6 Secure Planning and Specification of SIS [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
Accidental or unauthorised changes to specifications, implementations, and engineering data SHOULD be prevented.
IND.2.7.A7 Separation and Independence of the SIS from the Environment [Planner, Maintenance Personnel] (S)
The SIS in question SHOULD operate within its environment without adverse effects in order to guarantee its security functions. Processes that could impact the SIS SHOULD be subject to the change management process established for functional safety management.
IND.2.7.A8 Secure Transfer of Engineering Data to SIS [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
The integrity of engineering data SHOULD be ensured during its transmission to SIS.
IND.2.7.A9 Protection of Data and Signal Connections [Planner, Maintenance Personnel, ICS Information Security Officer] (S)
If it cannot be proven that data and signal connections are not without adverse effects (unidirectionality), these connections SHOULD be suitably protected.
IND.3.2 Remote Maintenance in
Industry
Target Object: IT system / Order: R2
IND.3.2.A1 Planning the Use of Remote Maintenance in OT (B) [Planner]
In industry, a uniform, central remote maintenance concept MUST be established for all remote maintenance systems for all of an organisation''s OT. The following aspects MUST be considered in the OT remote maintenance concept: 
•	Specific requirements from system manufacturers 
•	Specific requirements of decentralised infrastructures 
•	Specific requirements for remote maintenance connections 
•	Specific requirements for the availability of remote maintenance 
•	Specific requirements due to environmental conditions 
•	Specific requirements due to existing plants 
All these aspects MUST be coordinated with all the internal and external entities involved. 
All remote maintenance access points that provide possible access to an organisation''s ICS MUST be recorded in central documentation. 
When purchasing new machines with remote maintenance functions, the corresponding information security requirements MUST be coordinated with the supplier. 
An organisation SHOULD seek to standardise the remote maintenance solutions it uses. As soon as standardised solutions for remote maintenance are planned, the OT and the office and building IT at hand MUST be jointly coordinated.
IND.3.2.A10 Observation and Control of OT Remote Maintenance Sessions (S) [Employee]
In industry, it MUST be ensured that persons working in plants or operating machines cannot be endangered directly or indirectly by active remote maintenance. Furthermore, it MUST be ensured that active remote maintenance does not interfere with the production process. 
If personal injury or damage to property is possible, it MUST be ensured that an OT employee can follow the remote maintenance activities on site (dual control principle). The OT employee SHOULD be able to intervene and interrupt a remote maintenance session if necessary.
IND.3.2.A11 Central Management of All User Accounts for OT Remote Maintenance (S) [IT Operation Department]
Only user accounts managed in a central OT or organisational directory service SHOULD be used for OT remote maintenance access.
IND.3.2.A12 Dedicated OT Remote Maintenance Solution (H) [Planner]
For remote maintenance in industry, a dedicated OT remote maintenance solution SHOULD be used that is independent from office and building IT. All other functions on the IT systems for OT remote maintenance, particularly functions for the administration of IT systems and networks outside the OT, SHOULD be deactivated or prevented. 
To ensure maximum independence, dedicated Internet access SHOULD also be used for OT remote maintenance.
IND.3.2.A14 Technical Control of Remote Maintenance Sessions (H) [Planner, Data Protection Officer]
Supplementary to IND.3.2.A10 Observation and Control of OT Remote Maintenance Sessions, OT remote maintenance sessions SHOULD be continuously regulated by a technical solution. In this context, command-level activities (i.e. manual and automated commands) SHOULD be technically monitored and automatically prevented where necessary. 
In addition, sessions SHOULD be monitored across components. If technical monitoring is used, an alarm SHOULD be triggered for anomalies in user behaviour and for specific rule violations (e.g. as soon as a sudden increase in communication volume is detected).
IND.3.2.A2 Consistent Documentation of Remote Maintenance by OT and Office and Building IT (B) [IT Operation Department, Maintenance Personnel]
In industry, OT and office and building IT MUST jointly record and document all the OT remote maintenance access points in place. 
Particularly for remote maintenance components that are integrated into package units, all disabled access points MUST also be documented.
IND.3.2.A3 Regular Checks and Exceptions for Existing OT Remote Maintenance Access (B) [IT Operation Department]
All facilities MUST be audited regularly to ensure that all their remote maintenance access points comply with the target status (i.e. the current remote maintenance concept for the OT).
IND.3.2.A4 Binding Regulation of OT Remote Maintenance by Third Parties (B)
Appropriately restrictive regulations for OT remote maintenance must be contractually agreed with all external users (i.e. manufacturers, integrators and maintenance service providers). These contractual arrangements MUST ensure at all times that external users only use OT remote maintenance access in a controlled and coordinated manner. 
The activities certain external users are permitted to carry out and the remote maintenance access points they are to use MUST be defined internally. The internal employees who authorise, observe and, if necessary, support the remote maintenance access and activities of external users MUST also be defined. 
Especially for safety machines, the internal OT employee in question MUST have both organisational and technical sovereignty over the times at which remote maintenance is carried out. The possibility of establishing an outward VPN tunnel MUST be forbidden by contract.
IND.3.2.A5 Internal Coordination for OT Remote Maintenance with Office and Building IT (B) [Planner]
OT, office and building IT, and all other organisational units involved MUST establish appropriately restrictive regulations for all components and interfaces that directly or indirectly enable remote OT maintenance at their organisation. These internal regulations MUST ensure controlled and coordinated use of the respective OT remote maintenance access points at all times. The following aspects MUST be regulated: 
•	Processes 
•	Responsibilities 
•	Authorisations
IND.3.2.A6 Securing All Remote Maintenance Access to OT (B) [IT Operation Department]
In industry, OT MUST be able to control any access to an IT system that provides a remote maintenance service to the OT. For this purpose, access MUST be secured by at least one security component under the responsibility of the OT. 
All types of remote maintenance access SHOULD be standardised. All access SHOULD be controlled and explicitly allowed using central authentication components. 
If OT remote maintenance access points include decentralised infrastructures or components integrated in package units, the access points MUST be secured by an additional security component that is neither integrated nor part of the decentralised infrastructure.
IND.3.2.A7 Technical Decoupling of Access (S) [Planner]
All remote access to any components in an OT zone SHOULD be decoupled. At each remote access point to OT, an IT system SHOULD be in place that terminates the connection before the transition into the target OT zone and establishes a new, regulated connection to the remote maintenance service with a different protocol. 
All tools and programs required for remote maintenance SHOULD support multi-user operation and be installed and able to function on this IT system. The IT system SHOULD be a jump server or an application layer gateway (ALG) positioned in a dedicated security segment, such as a demilitarised zone (DMZ). 
The IT system for decoupling access SHOULD be the responsibility of OT (i.e. ideally located in an OT DMZ).
IND.3.2.A8 Explicit Approval of Every OT Remote Maintenance Session (S) [Employee]
Each remote maintenance session SHOULD be pre-approved by an OT employee of the operator organisation responsible for the target system of the session. This responsible OT employee SHOULD only enable the remote maintenance access following this approval. Explicit approval SHOULD be required both for unscheduled cases of need and during coordinated maintenance windows. Approval SHOULD only be valid for a limited period of time so that the responsible OT employee retains sovereignty over the time of remote maintenance (see requirement IND.3.2.A3 Regular Checks and Exceptions for Existing OT Remote Maintenance Access). 
Furthermore, external remote maintenance access SHOULD be established exclusively from the inside out (i.e. from the OT network). In particular, open ports for remote maintenance MUST NOT be accessible from the outside (i.e. from untrusted networks).
IND.3.2.A9 Secure Exchange of Files Involved in OT Remote Maintenance (S) [Planner, IT Operation Department]
A secure procedure SHOULD be established for exchanging files involved in OT remote maintenance (e.g. configuration files, updates, or manuals). At minimum, this MUST include a check for malware. 
Establishing a connection between a data exchange system and file source SHOULD not be automated; it should be initiated and authenticated by an organisation''s OT prior to any file exchange. File exchanges SHOULD always be logged.
INF.1 Generic Building
Target Object: Building/room / Order: R2
INF.1.A1 Planning the Building Protection [Planner] (B)
The protection for a building MUST be defined based on the (planned) use of a building and the protection needs of the business processes operated within it. In particular, security aspects regarding the protection of persons, commodities, and IT in the building MUST be taken into consideration, from fire prevention and electrical aspects to site access control. The security requirements from different areas MUST be coordinated.
INF.1.A10 Compliance with Relevant Standards and Regulations [Construction Company, Construction Manager] (B)
When planning, erecting, and converting buildings and installing technical equipment, all the relevant standards and regulations MUST be taken into consideration.
INF.1.A12 Key Management (S)
There SHOULD be a lock-up plan for all keys to a given building. The manufacture, storage, management, and issue of keys SHOULD be organised in a centralised manner. Backup keys SHOULD be available and secured, but kept on hand for emergencies. Keys that have not been issued SHOULD be stored securely. Every key issued SHOULD be documented.
INF.1.A13 Regulations Governing Access to Distributors (S)
Rapid access to the distributors of all supply facilities within a building SHOULD be possible if and when required. Access to distributors SHOULD be restricted to a small group of authorised persons.
INF.1.A14 Lightning Protection Devices (S)
A lightning protection system SHOULD be installed according to the applicable standard. A comprehensive lightning and surge protection concept SHOULD be in place. At minimum, buildings with comprehensive IT equipment SHOULD be equipped with lightning protection devices of protection class II according to DIN EN 62305, “Lightning Protection”. The lightning protection system SHOULD be inspected and serviced regularly.
INF.1.A15 Plans Detailing the Location of Supply Lines (S)
Up-to-date layout plans of all supply lines SHOULD be available for a given building. It SHOULD be specified who is responsible for maintaining and updating the layout plans of all supply lines. The plans SHOULD be stored in such a way that only authorised persons may access them, but they must be quickly accessible in case of need.
INF.1.A16 Avoiding References to the Locations of Sensitive Building Areas (S)
References to the locations of sensitive areas SHOULD be avoided. Sensitive areas of buildings SHOULD not be easily visible from the outside.
INF.1.A17 Structural Smoke Protection [Planner] (S)
A building's structural smoke protection SHOULD be checked after installation and conversion work. Regular checks SHOULD be carried out to ensure that smoke protection components are still functioning.
INF.1.A18 On-Site Fire Safety Inspections (S)
On-site fire safety inspections SHOULD take place regularly, i.e. at least once or twice a year. Deficiencies identified during on-site fire safety inspections SHOULD be rectified immediately.
INF.1.A19 Notification of the Fire Safety Officer (S)
The Fire Safety Officer SHOULD be informed of work being performed on cable trays, hallways, and escape and rescue routes. They SHOULD check that fire safety measures are being implemented properly.
INF.1.A2 Appropriate Segmentation of Circuits (B)
Regular checks MUST be carried out to ensure that the protection and design of a building's circuits still meet the actual requirements at hand.
INF.1.A20 Alert Plan and Fire Drills (S)
An alert plan for the measures to be taken in case of a fire SHOULD be drawn up. The alert plan SHOULD be reviewed and updated at regular intervals. Fire drills SHOULD be performed at regular intervals.
INF.1.A22 Secure Doors and Windows (H)
Doors and windows SHOULD be selected on the basis of the protection objectives of the area to be secured, the protection needs of the organisation in question, and the appropriate classification in line with the relevant standards. All the safeguarding measures meant to secure the windows, doors, and walls enclosing a given space SHOULD be appropriate and of equal quality with regard to burglary, fire and smoke. The proper functioning of safety doors and windows SHOULD be checked regularly
INF.1.A23 Formation of Security Zones [Planner] (H)
Rooms with similar protection needs SHOULD be consolidated into zones in order to treat comparable risks in a uniform way and reduce the costs of required security safeguards.
INF.1.A24 Automatic Drainage (H)
All areas at risk of water damage SHOULD be equipped with an automatic drainage system. Regular checks SHOULD be performed to ensure that active and passive drainage systems still function.
INF.1.A25 Selection of Appropriate Locations [Top Management] (A)
When selecting or planning a building location, the environmental conditions that could influence information security SHOULD be checked. There SHOULD be an overview of the location-related threats at hand. These threats SHOULD be addressed by means of additional compensating safeguards.
INF.1.A26 Gatekeeper or Security Service (H)
The tasks of a gatekeeper or security service SHOULD be clearly documented. The gatekeeper SHOULD observe and monitor all movements of persons at the gate and at all other entrances in line with the respective organisation's security concept. All employees and visitors SHOULD be able to identify themselves to the gatekeepers. Visitors SHOULD be escorted to the person to be visited or collected from the entrance. The gatekeepers SHOULD be promptly informed of any changes in site access authorisations.
INF.1.A27 Burglary Protection (S)
Adequate safeguards for burglary protection SHOULD be implemented and adapted to the local conditions at hand. Care SHOULD be taken during the planning, implementation, and operation of burglary protection to ensure that it is consistent, including in terms of its quality. It SHOULD be regularly inspected by a person with corresponding expertise. Employees SHOULD be aware of the regulations for burglary protection.
INF.1.A3 Compliance with Fire Prevention Regulations (B)
The current fire prevention regulations and the requirements imposed by the building inspectors MUST be met. The escape routes MUST be marked in accordance with the respective regulations and kept unobstructed. Regular checks MUST be carried out to determine whether the escape routes are usable and not blocked by any obstacles so that the building in question can be evacuated quickly in the event of a dangerous situation. The local fire department SHOULD be consulted when fire prevention plans are being developed. An IT related fire prevention concept MUST be drawn up and implemented. Unnecessary fire loads MUST be avoided. Organisations MUST have a Fire Safety Officer or another person who is assigned the tasks involved. This person MUST be suitably trained.
INF.1.A30 Selection of an Appropriate Building (H)
When selecting an appropriate building, it SHOULD be checked whether all the security requirements relevant for later use can be implemented. For every building, the existing threats and the safeguards required to prevent or reduce damage SHOULD be documented in advance.
INF.1.A31 Moving Out of Buildings [Central Administration] (H)
Before moving out of a building, an organisation SHOULD draw up an inventory of all items relevant to information security for the move, such as hardware, software, storage media, files, or documents. Once the move is complete, all rooms SHOULD be checked for items left behind.
INF.1.A32 Firestop Seal Register (H)
A firestop seal register SHOULD be maintained. This SHOULD record all the individual types of such partitions. After work is performed on firestop seals, the changes SHOULD be entered into the register within four weeks.
INF.1.A34 Intruder and Fire Detection System (H)
There SHOULD be an intruder and fire detection system appropriate for the rooms and risks at hand. The intruder and fire detection system SHOULD be inspected and serviced regularly. It MUST be ensured that the recipients of intrusion and fire detection alerts are capable of responding appropriately from both a technical and personnel-related perspective.