# Security and Independence of Process Safety and Control Systems in the Petroleum Industry
## 3 Standards, Guidelines, and Requirements for Independence
### Iec 62443  
IEC 62443 [8] is a series of standards designed to secure industrial communication networks and OT systems. The 62443 series is considered by many actors to be a natural framework for building and safeguarding security in OT systems and is, among other things, central to DNV's class notation \"Cyber Secure\" for maritime OT systems [9]. There  
Figure 1: Example of network topology for an industrial facility. In addition to the Purdue levels, the figure also shows how components can be divided into zones (gray) and conduits (blue).  
is a limited focus on independence between 62443 series systems; however, some of the basic concepts are to divide systems and networks into appropriate zones and conduits, to group functions and devices based on criticality, and to minimize the consequences of undesirable incidents, see Figure 1. Furthermore, zones and conduits will protect devices and the links between them from undesirable outside influence.  
The philosophy of zones and conduits helps to create independence; however, there are no specific requirements for full isolation/independence. The 62443 series proposes choosing network topology and security barriers based on risk assessments, and thus the degree of independence may vary between different applications/interpretations of 62443.  
A key term in IEC 62443 is the \"Security Level\" (SL). The concept focuses on the fact that zones and conduits should be graded at different levels (SL1-SL4), and is in IEC 62443-3-3 and IEC 62443-4-2 described as requirements for systems and components included in the different zones, respectively. Based on a risk assessment, these security levels represent a framework for determining the necessary protections and measures. The higher the SL, the greater the assessed risk and the higher the level of protection one should have against any malicious attacks.  
The \"Security Level Capability\" a system or component can achieve depends on the degree of fulfilment of seven types of \"Foundational Requirements\"-FR. These are:  
* FR1--Identification and Authentication Control.
* FR2--Use Control.
* FR3--System Integrity.
* FR4--Data Confidentiality.
* FR5--Restricted Data Flow.
* FR6 --Timely Response to Events.
* FR7--Resource Availability.  
For each of the seven basic types of requirements, IEC 62443-3-3 describes a number of specific system requirements (SRs) and associated requirement enhancements that must be met to achieve a certain level of security (SL), and, to meet, for example, SL2, all requirements that are applicable for level 2 must be met for all seven basic requirements categories (FR1-FR7). Similarly, IEC 62443-4-2 contains a series of requirements that reflect the system requirements at the component level.  
The standard is extensive and rich and is well suited for use in OT environments. It is international and well-known and thus facilitates common understanding and effective interaction between actors. The main disadvantage of this series is that it is demanding to familiarize oneself with, as it is so extensive. This is especially true for smaller players, who may find that they have to devote considerable resources to familiarize themselves with standards rather than specific safety work.  
Sub-standards 3-3 and 4-2 contain requirements for systems and components related to the Security Levels (SLs), respectively. Which of the requirements to be chosen arises from a risk analysis and also an assessment from those who will operate/own the systems (through establishing a so-called \"profile\" with requirements). Application of, and possibly certification according to, IEC 62443 is not necessarily enough to assert that a system is completely independent, but it is reasonable to expect a significant degree of independence in systems that meet strict 62443 requirements. The value of a certificate depends on the requirements included in the certification, and it is up to the certification bodies to define good requirements specifications.