IEC 62443-3-3 Clause 11 – Resource Availability

Purpose

Preserve essential control-system services and resources through disruption, attack, failure and recovery.

For an SL-C(RA) claim, implement the applicable base SRs and every enhancement selected by the target security level and risk assessment.

Associated technologies (teaching)

Use rate limiting on firewalls to constrain abusive loads, tested VM snapshots as part of a wider backup strategy, UPS capacity for emergency power, and maintained inventory tools to understand available components and dependencies.

System requirements and requirement enhancements

• SR 7.1 – Denial of service protection
  • RE(1) – Manage communication loads (From SL: 2+)
  • RE(2) – Limit denial of service effects (From SL: 3+)
• SR 7.2 – Resource management
• SR 7.3 – Control system backup
  • RE(1) – Backup integrity verification (From SL: 2+)
  • RE(2) – Backup automation (From SL: 3+)
• SR 7.4 – Control system recovery and reconstitution
• SR 7.5 – Emergency power
• SR 7.6 – Network and security configuration settings
  • RE(1) – Machine-readable reporting of current security settings (From SL: 3+)
• SR 7.7 – Least functionality
• SR 7.8 – Control system component inventory

SR and RE summaries

Key takeaways

• FR 7 (RA) is implemented through the base SRs in Clause 11.
• REs are nested under their parent SR and add capability as the target security level rises.
• Use Annex B for the authoritative SL mapping and Clause 4 for constraints that apply across all foundational requirements.
• Technology supports the requirement, but architecture, configuration, operation and evidence determine whether the requirement is satisfied.