What it asks for. IEC 62443-2-1 sets requirements for asset owners to establish, implement and maintain a security programme for their industrial automation and control systems. The current edition is organised into security programme elements that cover areas such as organisational security policy, configuration management, network and communications security, component security, user access control, event and incident management, and system integrity and availability.
In practice. Asset owners define governance and responsibilities for operational technology security, assess risk, apply policies and procedures to their control systems and measure the programme's maturity. Evidence includes OT security policies, risk assessments, asset inventories, access control records, incident procedures and maturity self-assessments.
Common gaps. OT security is often run as an extension of IT policy without accounting for safety and availability constraints. Asset inventories of control systems are frequently incomplete.