+IND.3.2.A7 Technical Decoupling of Access (S) [Planner]

IND.3.2.A7 Technical Decoupling of Access (S) [Planner]

All remote access to any components in an OT zone SHOULD be decoupled. At each remote access point to OT, an IT system SHOULD be in place that terminates the connection before the transition into the target OT zone and establishes a new, regulated connection to the remote maintenance service with a different protocol.

All tools and programs required for remote maintenance SHOULD support multi-user operation and be installed and able to function on this IT system. The IT system SHOULD be a jump server or an application layer gateway (ALG) positioned in a dedicated security segment, such as a demilitarised zone (DMZ).

The IT system for decoupling access SHOULD be the responsibility of OT (i.e. ideally located in an OT DMZ).

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

Krav

3. Relaterade regleringar

Regleringar

Länkade ärenden

Länkar
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.37 Repudiation of Actions