# A Risk Assessment Analysis to Enhance the Security of OT WAN with SD-WAN
## 3 Background  
### OT Risk Management Frameworks  
Critical systems have several notable risk management frameworks in the OT cyber-security field, which are structured methodologies for securing ICS and CPS. The most popular include the NIST Cybersecurity Framework (CSF), ISO/IEC 27001, ISA/IEC 62443, and NERC CIP. Each of these frameworks has distinct strengths in terms of what aspects of cybersecurity they are designed to help with; in the case of OT environments, NIST CSF and ISA/IEC 62443 are quite popular since they are considered broad and detailed [66] (p. 101677), [67] (pp. 59-72). The NIST Cybersecurity Framework allows for a broad and flexible approach to cybersecurity by equally covering IT and OT environments. It structures five major core components around the actions of Identify, Protect, Detect, Respond, and Recover. This ensures that risks are well understood and managed in a comprehensive manner and permits an organization to adjust the framework to suit its needs. This allows NIST CSFto be very flexible and have a very wide acceptance base in different industries. These elements also position NIST CSF as applicable in diverse and ever-evolving threats found in OT environments, where flexibility and comprehensiveness in risk management can serve well [17, 68]. ISO/IEC 27001 is an internationally accepted standard that gives a rigorous, structured approach to managing information security. Its core component, the Plan-Do-Check-Act cycle, maintains a uniform process of managing and enhancing information security. While ISO/IEC 27001 is largely IT-oriented, its vast documentation depth and compliance requisites can be applied to OT through large efforts. Compliance with several global regulations makes it widely applicable for organizations seeking international compliance. However, its concentration on IT and implementation complexity make the framework less liked by OT users compared to NIST CSF and ISA/IEC 62443 [69]. ISA/IEC 62443 is specifically tailored to address the challenges associated with securing OT (ICS/CPS) systems, which come with unique requirements. The framework is divided into several parts that offer guidelines on various security aspects in ICS, including general concepts, policies and procedures, system requirements, and component requirements. This level of detailed technical guidance ensures that the security requirements for individual components and overall systems are thoroughly developed and robust. The lifecycle approach of ISA/IEC 62443 facilitates ongoing security enhancements from design through operation and maintenance, making it particularly effective for the OT environment, which necessitates specialized security controls. Another notable strength of this framework is its strong sectoral focus, making it highly valued in industries that utilize OT [70]. NERC CIP standards are applicable and mandatory for the whole North American energy sector, focusing on the security of electric utilities. The scope of the standards involves everything from identification of assets to the management of security, personnel training, electronic and physical security, system security management, and even incident reporting. While NERC CIP provides detailed and specific directives regarding its guidelines, its functionality and mandates are exclusively applicable to the energy sector. This targeted nature makes the framework less suitable for use in other OT environments. However, its prescriptive compliance guarantees high levels of security and reliability specifically within its designated sector [71]. In summary, NIST CSF and ISA/IEC 62443 are more inclined toward industrial systems, making them inclusive, flexible, and better suited in an OT environment. While it is broad in applicability and has an emphasis on betterment, NIST CSF allows itself to be tailored toward various industries. In turn, ISA/IEC 62443 elaborates on detailed technical standards, arming it with solid security protocols meant explicitly for OT.