# Cybersecurity Requirements for Industrial Machine Control Systems
## 4 Relationship Between Safety Categories and PLs and Security Levels
* SL 4--protection against intentional violation using sophisticated means with extended resources, IACS-specific skills, and high motivation. We are considering three levels of machine security because SL4 takes into account sophisticated measures with expanded resources and high motivation, which can be undertaken mainly by highly skilled and equipped special forces teams that are not considered to be involved in attacking industrial machines. SL4 can be considered in the protection of power plants, nuclear power plants, and chemical plants, which if attacked can cause catastrophes. Moreover, three types of SLs are specified as follows:  
* Target, SL-T (required);
* Capability, SL-C;
* Achieved, SL-A. Type SL-T defines the required effectiveness of countermeasures, devices, and systems that should be implemented to prevent cyber-attacks. \begin{table}
\begin{tabular}{c c} \hline \hline
**SL** & **Qualitative Description** \\ \hline
1 & Low \\
2 & Medium \\
3 & High \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Security levels according to IEC TS 62433-1-1 [22]. Type SL-A is the actual SL achieved by the actual system. The achieved SL-A level should be greater than or equal to the required SL-T level. Type SL-C means that the device in question has the ability to provide a given SL when properly configured and integrated. There is a need to establish a direct relationship between the PL safety level according to ISO 13849-1 and the SL according to IEC TS 62443-1-1 [22]. It can be deduced that the higher the PL is, the higher the risk is reduced by the safety-related control system; therefore, the higher the PL is, the higher the SL should be against cyber-attacks so that the considered safety function is not lost. The relationship between PL/category and SL can be determined from Figures 6 and 7. Cybersecurity in a four-level system must encompass a wide range of tasks to ensure comprehensive protection and operational efficiency. This includes the following:  
* Developing a clear understanding of the system's architecture, vulnerabilities, and potential attack vectors across all levels, from local devices to cloud-based services. * Implementing synchronized protocols for real-time threat detection and response. This ensures that actions taken at one level (e.g., local control) align with strategies at higher levels (e.g., enterprise management). * Securing both the physical and virtual components of the system. This includes robust firewalls, encryption methods, and redundancy measures to prevent unauthorized access and ensure data integrity in the network of data exchange. * Recognizing the human factor in system security, such as errors in judgement, fatigue, or lack of training and mitigating these risks through regular training programmes, ergonomic interfaces, and automated alerts to support decision-making processes. A fully integrated approach, leveraging group of standards such as IEC 62443 and ISO 27001 [21], is essential to address these diverse tasks. Additionally, advanced tools like AI-driven anomaly detection can enhance the system's ability to identify and counteract threats dynamically. It is important to note that the analysis presented in this article focuses on specific aspects of cybersecurity, particularly on protection mechanisms at the lower levels of the hierarchy, such as machine control systems and local networks. However, protection at the bottom of the hierarchy does not ensure the cybersecurity of the entire system. A comprehensive approach requires addressing vulnerabilities across all layers, from local control systems to enterprise-level networks and cloud infrastructure. Future research should expand on this work by analyzing the interdependencies and security strategies necessary for ensuring system-wide resilience.