IACS Cybersecurity Roles

Roles Are Not Organisations

A role is a set of responsibilities — not the same thing as a company name. One organisation may hold several roles; one role may be split across several organisations under contract.

For example, an Asset Owner may also perform maintenance in-house, or a Product Supplier may also provide integration services. However work is allocated, accountability for cybersecurity risk of the IACS and the Equipment Under Control remains with the Asset Owner.

Principal Roles

The series identifies these principal roles and how they relate to products, the Automation Solution, and the IACS:

• Asset Owner — accountable for the IACS; operates the IACS and the Equipment Under Control
• Integration Service Provider — designs, deploys, commissions, and hands over the Automation Solution
• Maintenance Service Provider — supports the Automation Solution in operation
• Product Supplier — develops and supports products used in the Automation Solution

Product Suppliers work largely independent of a specific plant environment. Integration and Maintenance Service Providers, together with the Asset Owner, act inside the IACS environment where products become a configured Automation Solution (Zones, Conduits, essential and supporting functions), and the IACS adds the organisational measures for operation and routine maintenance.

Asset Owner

The Asset Owner is accountable and responsible for the IACS. The Asset Owner also operates the IACS and the Equipment Under Control. Before an Automation Solution project proceeds, the Asset Owner establishes the organisation’s IACS Security Program (Part 2-1), including how Product Suppliers and Service Providers will be engaged.

Across the Automation Solution Security Lifecycle, typical Asset Owner responsibilities include:

• Perform the initial cybersecurity risk assessment; partition into Zones and Conduits; set Target Security Levels
• Approve the Cybersecurity Requirements Specification (CRS)
• Develop organisational security measures for operations; validate them at handover
• Approve handover, change credentials before the system enters service, and operate the IACS
• Periodically re-assess organisational and technical measures; trigger maintenance when needed
• Approve Management of Change and decommissioning requests

Primary part for Security Program requirements: ISA/IEC 62443-2-1

Service Providers

Service Providers work on behalf of the Asset Owner to deliver or sustain an Automation Solution. The series distinguishes two service roles; one organisation may hold both. Security program requirements for these roles are in Part 2-4.

Integration Service Provider

The Integration Service Provider designs and deploys the Automation Solution — including design, installation, configuration, testing, commissioning, and handover to the Asset Owner. The Integrator may also assist with partitioning the System Under Consideration into Zones and Conduits and with risk assessment.

Typical responsibilities include:

• Detailed cybersecurity risk assessment and technical security design for each Zone and Conduit
• Guidelines for organisational security measures associated with the design
• Implement technical security measures and product security updates during integration
• Verify technical security measures during Verification & Validation

Primary part: ISA/IEC 62443-2-4

Maintenance Service Provider

The Maintenance Service Provider supports the Automation Solution after handover — maintaining security, reliability, and availability through the operational life of the IACS, including decommissioning activities when assets leave service.

Typical responsibilities include:

• Develop organisational security measures for maintenance; validate them before operations
• Perform organisational maintenance measures; monitor threats and vulnerabilities
• Implement Management of Change procedures; update organisational and technical measures
• Purge sensitive data and decommission IACS assets when approved

Primary part: ISA/IEC 62443-2-4 (facility patching also draws on Part 2-3)

Product Supplier

The Product Supplier manufactures and supports hardware and/or software products. Products may include Control Systems and Components — Embedded Devices, Host Devices, Network Devices, and/or Software Applications. The Product Supplier develops and supports these products largely outside a specific plant IACS environment; products are later configured into an Automation Solution at a site.

Typical responsibilities in the facility lifecycle include:

• Consult on the security capabilities of IACS products during Design, Implementation, and V&V
• Provide product security updates during integration and maintenance
• Provide product security support services during maintenance

How products themselves are developed securely is covered by the Product Security Lifecycle (Part 4-1). System- and component-level security capabilities that manufacturers must provide are specified in Part 3-3 (system requirements) and Part 4-2 (component requirements).

Primary parts: ISA/IEC 62443-4-1 (secure development); 3-3 and 4-2 (security capabilities)

How Parts Map to Roles

Use this quick mapping when selecting which ISA/IEC 62443 parts apply to each audience:

• Asset Owners — establish and maintain the OT / IACS security program (IEC 62443-2-1).
• Service Providers / System Integrators — securely design, implement, integrate, and maintain industrial systems (IEC 62443-2-4).
• Product Suppliers — develop secure products using a Secure Development Lifecycle (IEC 62443-4-1).
• System and Component Manufacturers — provide security capabilities within industrial systems and devices (IEC 62443-3-3 and IEC 62443-4-2).

In practice, Product Supplier and System/Component Manufacturer often sit in the same organisation: Part 4-1 covers how products are developed securely; Parts 3-3 and 4-2 specify what security capabilities the delivered system or component must provide.

Figure 1 shows which documents each principal audience is most likely to use. There is deliberate overlap beyond the primary mapping above:

• All three role groups commonly use Parts 1-1, 2-3, and 3-3
• Asset Owner also leans on Parts 2-1 and 1-3; shares 2-2 and 3-2 with Service Providers
• Service Providers are the focus of Part 2-4
• Product Suppliers are the focus of Part 4-1; Parts 3-3 and 4-2 define the technical security capabilities manufacturers deliver
• Profiles (for example 1-5 and 5-x) provide ready-to-use implementation guidance that can apply to any role
• Conformity assessment (6-1, 6-2) supports evaluation and is used mainly by assessors

Related lifecycle pages: Automation Solution Security Lifecycle · Product Security Lifecycle

Shared Responsibility Overview

Typical activities are shared across roles. A tick indicates primary ownership; “Support” indicates contributory involvement.

Key Takeaways

• IACS cybersecurity is a shared responsibility across Asset Owner, Service Providers, and Product Suppliers.
• Roles are series-wide concepts; map primarily to 2-1 (Asset Owner), 2-4 (Service Providers / Integrators), 4-1 (Product Supplier SDL), and 3-3 / 4-2 (system and component capabilities).
• A role is not identical to an organisation — duties can be combined or split, but Asset Owner accountability remains.
• Product Suppliers develop and support products; manufacturers deliver system/component security capabilities; Service Providers integrate and maintain the Automation Solution; the Asset Owner operates the IACS.
• Integration focuses on secure design through handover; Maintenance focuses on sustainment, MoC, and decommissioning.

Standards References

• ISA/IEC 62443-1-1 — Terminology, concepts and models (context for roles, Automation Solution, and IACS).
• ISA/IEC 62443-2-1 — Establishing an IACS Security Program (Asset Owner).
• ISA/IEC 62443-2-4 — Security program requirements for Integration and Maintenance Service Providers.
• ISA/IEC 62443-4-1 — Product Security Lifecycle / Secure Development Lifecycle (Product Supplier).
• ISA/IEC 62443-3-3 / 4-2 — System and component security capabilities (manufacturers of industrial systems and devices).
• ISA/IEC 62443-2-2 — Security Protection Scheme (SPS) and Security Protection Ratings; see SPS notes; Automation Solution Security Lifecycle RACI context — see lifecycle notes.