# A Harmonized Information Security Taxonomy for Cyber Physical Systems
## 6 Discussion  
The harmonized taxonomy brings together a variety of existing taxonomies into a harmonized, single-reference taxonomy. It links the core elements to the CPS lifecycle phases and allows the specific aspects of risk and incident response management to be uniquely classified in the taxonomy.  
Utilizing the taxonomy has the following advantages:  
* It supports a common reference framework between the information technology (IT) and operational technology disciplines, especially with regard to business risk. This is an effect of utilizing a hybrid approach to the taxonomy, as the impact of IT risks on CPSs and vice versa can be analyzed and assessed without changing the harmonized taxonomy structure.  
* The classification and grouping of risk- and incident-related information can be consistently and accurately applied. This can then be used to improve the security management programs and update the required supporting risk mitigation technologies. Lessons learned from IT or CPS incidents can be applied without having to change the harmonized taxonomy. If the IT or broader business risk aspects do not apply to the CPSs, these aspects will simply not be applied. This flexibility also allows for broad industry application. A less comprehensive taxonomy that was (for example) developed for the petrochemical industry would require customization if it were to be applied to heavy manufacturing. This is because the CPSs being utilized and the process requirements are very different, even though similar business risks can be experienced. Flexibility is enabled by not specifying the process or system requirements as part of the harmonized taxonomy elements or structure and by rather capturing them in the assessment of broad business risk. For example, the batch and source tracking information of a pharmaceutical plant is critical. Thus, securing information is a critical part of threat assessment, whereas batch information security for the coal supply to a power station will be much less critical. The harmonized taxonomy is equally applicable to both scenarios.
* Utilizing the taxonomy allows for its application as a reference framework during any stage of the system lifecycle. This is demonstrated in Section 5, where the generic application methodology shows the repeated application of the same taxonomy elements in different steps and at different lifecycle stages.
* Applying the harmonized taxonomy elements during incident investigations allows the easy identification of risk and risk mitigation gaps (as demonstrated by the case study mapping). This facilitates focused updates and changes to protection measures to close any possible gaps and reduce overall company risk. The harmonized taxonomy as presented is deficient in the following respect. The digital forensics taxonomy core element does not provide a high level of detail for supervisory and field equipment, since proprietary technologies are still being used at these levels. This deficiency can be partially mitigated, however, if the correct support relationship with the system manufacturer is in place. The digital forensics core element as presented is still usable as a guide but might require additional detailed sub-elements based on industry or business requirements. This requirement will be addressed in future work. Section 7 next concludes this paper.