+IND.1.A11 Secure Procurement and System Development (S)

IND.1.A11 Secure Procurement and System Development (S)

If OT systems are to be procured, planned, or developed, information security regulations SHOULD be established in this regard. The documents SHOULD be part of any related tender.

During procurement, planning, or development, information security SHOULD be taken into consideration through the entire lifecycle. Prerequisites and implementation instructions for the secure operation of ICS components by manufacturers SHOULD be planned and implemented at an early stage. Uniform requirements for information security that correspond to the protection needs at hand SHOULD be defined for ICS components. These SHOULD be taken into consideration when procuring new ICS components. Compliance and implementation SHOULD be documented.

The organisation in question SHOULD document how the system fits into its concepts for zoning, authorisation, and vulnerability management (as well as for virus protection) and adapt them if necessary. A plan for maintaining operations should a given partner stop providing its services SHOULD be formulated.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

Wymagania

3. Powiązane regulacje

Regulacje

Powiązane zgłoszenia

Powiązania
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.20 Information or Products from an Unreliable Source
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.28 Software Vulnerabilities or Errors