# Cybersecurity Requirements for Industrial Machine Control Systems
## 1 Introduction  
The effective cybersecurity of industrial systems requires the cooperation of both manufacturers and machine users. Remote access and password monitoring should not be a coincidence, as negligence can result in the appearance of cyber-attacks, for example, by former employees on both the manufacturer's and user's side, as well as other external parties. Cyber-attacks are primarily associated with attacks via the Internet; however, one should also take into account the unintentional infection of the system by connecting a virus-ridden data carrier, such as a portable memory stick, or deliberate sabotage associated with unrestricted access by an internal company employee to programmable devices on production lines. Cyber-attacks can cause, among other things, the following:  
* Halting production or reducing production;
* Loss of quality of manufactured workpieces, which may not be easy to detect quickly and exposes the company to financial losses;* Loss of data--encryption by blackmailers demanding ransom;
* Falsification of documentation and the introduction of chaos in various departments of the company;
* Emission of hazardous substances into the environment--contamination of the environment and danger to local residents or the wider area;
* Loss of safety functions in machine control systems, which can directly expose employees to mechanical hazards, hazards associated with the emission of hazardous substances, and many others. It is therefore important to implement appropriate protections in terms of cybersecurity with expenditures commensurate with the potential consequences caused by cybercrime. A company should have a policy in place related to cybersecurity, which should be constantly improved due to the fact that cyber criminals are constantly looking for opportunities to attack through the vulnerabilities they discover. Policies related to cybersecurity should address, among other things, the management of passwords for programmable devices, such as the following:  
* Rules for creating passwords for newly acquired PLCs/microcontrollers/machine computers;
* How often they should be changed (e.g., due to employee turnover);
* Where they should be stored (on the local computer's disc/on the network on a server, whether in encrypted form; consider that such a computer can also be attacked, resulting in the loss of stored passwords; another solution is to store passwords written on paper);
* Who should have access to stored passwords;
* Rules for supervising compliance with the policy (checking that passwords are not written, for example, with a marker on the controller or on the door of the control cabinet or on electrical diagrams, etc.). It is also important to deliberately assign permissions and formulate requirements for remote machine operation as follows:  
* Encrypted connections required;
* Access only within a certain pool of IP addresses;
* Degree of password complexity;
* Temporary access rather than unlimited time;
* Read-only connection, if sufficient;
* Generation of a post-intervention checksum;
* Recording the date, time, and personal data of the modifier. Experience shows that as programmable devices are used, vulnerabilities in their software become apparent. This therefore requires the constant monitoring of software updates. This issue is often neglected, giving cyber criminals more freedom of action. The purpose of this study is to analyze cybersecurity requirements for industrial machine control systems, focusing on their integration with safety levels (SLs) and performance levels (PLs). The study aims to fill the gap in the literature by providing a comprehensive framework for linking safety and security requirements in industrial systems, addressing both hardware and network-level vulnerabilities. The remainder of this article will mainly analyze the aspect concerning the loss of safety functions (SFs) in machine control systems due to a cyber-attack, which can result in hazards to employees.