Information security is often not considered during procurement due to insufficient security requirements or cost considerations. As a result, ICS components can sometimes contain serious vulnerabilities (e.g. in hardware or software) which are very difficult to fix later.