Cyber Security Checklist

REV DATE APPROVED DESCRIPTION OF CHANGE

19/02/2021

Automatically generated by exSILentia® version 4.10.0.0.

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 1 of 19
Table of Contents
1 Cyber Security Checklist ..................................................................................................................................................................................................................... 3
1.1 General Project Information ..................................................................................................................................................................................................... 3
1.2 References ................................................................................................................................................................................................................................ 3
2 Cyber Security Checklist ..................................................................................................................................................................................................................... 4
2.1 Cybersecurity Risk Assessment ................................................................................................................................................................................................. 4
2.2 Cybersecurity Policy, Organization, and Awareness ................................................................................................................................................................. 4
2.3 Asset Management ................................................................................................................................................................................................................... 6
2.4 Human Resources Security ....................................................................................................................................................................................................... 6
2.5 Physical and Environmental Security ........................................................................................................................................................................................ 7
2.6 Communications and Operations Management ....................................................................................................................................................................... 9
2.7 Network Security Management .............................................................................................................................................................................................. 12
2.8 Access Control: Account Administration, Authentication, and Authorization (including Network Segmentation) ............................................................... 12
2.9 System Hardening ................................................................................................................................................................................................................... 14
2.10 Vulnerability, Patch Management and Virus Scanning ........................................................................................................................................................... 15
2.11 Cybersecurity Incident Management...................................................................................................................................................................................... 16
3 Abbreviations and Definitions .......................................................................................................................................................................................................... 18
3.1 Abbreviations .......................................................................................................................................................................................................................... 18
4 Disclaimer, Assumptions, Equipment Data ...................................................................................................................................................................................... 19
4.1 Disclaimer ............................................................................................................................................................................................................................... 19
4.2 Assumptions ........................................................................................................................................................................................................................... 19

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 2 of 19
1 Cyber Security Checklist
This document, automatically generated by the exida exSILentia® software, documents the project cyber security assessment. The assessment is based on IEC
62443-2-1 and industry best practices.

1.1 General Project Information

Project Identification:
Project Name:
Project Description:

1.2 References
DOCUMENT ID TITLE REVISION REVISION DATE
IEC 62443-2-1 Industrial communication networks - Network and system security - Part 2-1: 1.0 10-Nov-2010
Establishing an industrial automation and control system security program

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 3 of 19
2 Cyber Security Checklist

2.1 Cybersecurity Risk Assessment

REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
The organization has developed a high-level business rationale C.3.2
as a basis for its effort to manage IACS cyber security
The organization has selected a risk assessment methodology C.3.3.3.4
Likelihood and consequence scales have been calibrated for the C.3.3.3.7.3
organization
High level risk assessment has been conducted C.3.3.3.7
Key Industrial Automation and Control Systems (IACS) and their C.3.3.3.8.2;C.
devices have been identified and placed into logical groups 3.3.3.8.3
Simple Network Diagrams have been created for the IACS's C.3.3.3.8.4
identified
Detailed Risk Assessments have been conducted for each logical C.3.3.3.8.5
IACS identified
An IACS asset management program for ongoing asset tracking Best Practice
of hardware (physical), software (electronic) and administrative
(procedures, policies, training) components on process control
system networks
Risk assessments have been made part of the IACS lifecycle such C.3.3.3.8.10
that they are planned to occur at key times such as during the
development of a new or updated IACS, during implementation
of a new or updated IACS or during retirement of an IACS

2.2 Cybersecurity Policy, Organization, and Awareness

REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 4 of 19
 REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
A cyber security policy document has been approved by 5.1.1
management, published and communicated to all relevant
stakeholders
The cybersecurity policy document includes a scope statement 5.1.1
defining to what the policy applies
The cybersecurity policy is reviewed at planned intervals or if 5.1.2
significant changes occur
Management support of cybersecurity is demonstrated by: 6.1.1,6.1.3
Defined roles and responsibilities for cybersecurity across the
organization, Plans and programs to maintain cybersecurity
awareness, Sufficient resources provided to carry out
cybersecurity policy, Implementation of cybersecurity controls
coordinated across the organization

Cyber security activities are coordinated by representatives from 6.1.2

different parts of the organization with relevant roles and job
functions
Requirements for confidentiality or non-disclosure agreements 6.1.5
are identified and regularly reviewed.
The organization's approach to managing cyber security and its 6.1.8
implementation is reviewed independently at planned intervals
or when significant changes to the security implementation
occur.
Risks are identified and controls implemented before granting 6.2.1
third party access (including physical, logical or network
connectivity both on and off site)
Security requirements are identified before giving customers 6.2.2
access to the organizations IACS
Agreements with third parties involving accessing, processing, 6.2.3
communicating or managing the organization's IACS cover all
relevant security requirements

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 5 of 19
2.3 Asset Management
REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
All IACS assets have been clearly identified and an inventory of 7.1.1
all important assets have been drawn up and maintained. These
assets consist of physical, logical and informational objects that
have value to the organization and are associated with the IACS.
All IACS assets are clearly owned by a designated part of the 7.1.2
organization
Rules for acceptable use of assets associated with the IACS have 7.1.3
been documented and implemented.
Information is classified in terms of its value, legal requirements, 7.2.1
sensitivity, and criticality to the organization.
Procedures for information labeling and handling in accordance 7.2.2
with the classification scheme are implemented.

2.4 Human Resources Security

REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
Security roles and responsibilities are documented and enforced 8.1.1,8.2.1
for employees, contractors and third party users.
Validation of identity and background checks are performed for 8.1.2
all candidates for employment, contractors, and third party
users with access to the IACS (both physical and cyber)
Employees, contractors and third party users with access to IACS 8.1.3
assets are required to agree and sign terms and conditions
which document their and the organization's responsibilities for
IACS security.
All employees, contractors and third party users of the IACS 8.2.2
system receive awareness training and regular updates in the
organizational policies and procedures as relevant for their job
function.

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 6 of 19
 REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
There is a disciplinary process in place for employees, 8.2.3
contractors and third party users who have committed a security
breach
Responsibilities are in place to ensure an employee's 8.3.1, 8.3.2,
contractor's or third party user's exit from the organization is 8.3.3
managed, that the return of all equipment and controlled items
and the removal of all access rights are completed

2.5 Physical and Environmental Security

REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
Security perimeters are used to protect areas that contain IACS. 9.1
This includes combination of barriers such as walls, card
controlled entry gates or manned reception desks.
Secure areas are protected by appropriate access controls to 9.1.2
ensure that only authorized personnel are allowed access
Guidelines for working in secure areas have been established 9.1.5
(e.g. unsupervised working in secure areas should be avoided,
vacant secure areas should be physically locked and periodically
checked, photographic, video, audio or other recording
equipment should not be allowed)

Access points such as delivery and loading areas and other 9.1.6
points where unauthorized persons may enter the premises are
controlled and if possible isolated from IACS.

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 7 of 19
 REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
Equipment is sited or protected to reduce risk from 9.2.1
environmental threats and hazards as well as opportunities for
unauthorized access. This includes items such as: Equipment is
sited to minimize unnecessary access, IACS with sensitive data is
positioned and the viewing angle restricted to reduce the risk of
information being viewed by unauthorized persons, Controls are
adopted to minimize the risk of potential physical security
threats such as theft, fire, explosives, smoke, water, dust,
vibration, chemical effects, overheating, etc.
Critical Equipment is protected from power failures and other 9.2.2
disruptions caused by supporting utilities
Power and telecommunications cabling equipment carrying data 9.2.3, 9.2.10
or supporting information services is protected from
interception or damage. This includes IACS distribution and
communications lines within local organizational facilities.
Equipment is maintained in accordance with the suppliers 9.2.4
recommended service intervals and specifications. Records are
kept of all suspected or actual faults and all preventative and
corrective maintenance
Controls to protect sensitive information should be taken when 9.2.4
equipment is scheduled for maintenance by personnel
unauthorized to view that information.
Equipment containing storage media is checked to ensure that 9.2.6
any sensitive data and licensed software is removed or securely
overwritten prior to disposal.
Procedures are in place to ensure that equipment, information 9.2.7
or software is not taken off-site without prior authorization
Organization keeps a current list of personnel with authorized 9.2.8
access to the facility where the IACS resides and issues and
assigns appropriate authorization credentials. Designated
officials within the organization review and approve the access
list and authorization credentials

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 8 of 19
 REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
Organization controls all physical access points to the facility 9.2.9
where the IACS resides and verified individual access
authorizations before granting access to the facility.
Organization controls physical access to the IACS independent of 9.2.9
the physical access controls for the facility. Identity verification
is required for entry to the most secured IACS spaces
Organization controls physical access to IACS devices that 9.2.11
display information to prevent unauthorized individuals from
observing the display output.
Physical access to the IACS is monitored to detect and respond 9.2.12
to physical security incidents
Visitors are escorted and their activity monitored 9.2.13
The organization maintains a record of all physical access, both 9.2.14
visitor and authorized individuals for a minimum of one year
Physical security of the plant is observed to determine if IACS Best Practice
systems are well secured and in accordance with documented
procedures. These observations should not be announced in
advance so they are done in the plants normal alert level.
Network cabling is neat, organized and color coded for function. Best Practice

2.6 Communications and Operations Management

REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
Documented procedures exist for system activities associated 10.1.1
with the IACS (e.g. control's station start-up and close down,
backup, equipment maintenance, media handling, control room
and network management, system migration and updates, and
safety)
Changes to IACS facilities and systems are controlled by a 10.1.2
change management system

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 9 of 19
 REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
The change management system follows separation of duty 10.1.2, 10.1.3
principles to avoid conflict of interest as well as unauthorized or
unintentional modification or misuse of the organizations assets.
Development, test, and operational facilities are separated to 10.1.4
reduce the risks of unauthorized access or changes to the
operational system
Hard copy documents output from the IACS are marked using 10.1.5
standard naming conventions to identify any special
dissemination, handling, or distribution instructions
Procedures are in place to ensure that security controls, service 10.2.1
definitions and delivery levels are included in third party service
delivery agreements.
The services, reports and records provided by third parties are 10.2.2
regularly monitored, reviewed and audited.
Detection, prevention, and recovery controls to protect against 10.4.1
malicious code and appropriate user awareness procedures are
implemented
The use of mobile code (software code which transfers from one 10.4.2
computer to another computer and then executes automatically
and performs a specific function with little or no user
interaction) must be authorized
Controls are in place to prevent unauthorized mobile code from 10.4.2
executing
Controls are in place to ensure that authorized mobile code 10.4.2
operates according to a clearly defined security policy
Malicious code protection mechanisms are updated whenever 10.4.3
new releases are available in accordance with organization
configuration management policy and procedures
The organization receives IACS security alerts and advisories on 10.4.4
a regular basis and takes appropriate actions in response
Back-up copies of information and software are taken and 10.5.1
tested regularly in according with an agreed backup policy

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 10 of 19
 REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
USB ports are either: Disabled in software (e.g. via group policy), ISA-
Disable in hardware (e.g. physical USB locks), Enabled but with a TR99.00.02-
strict access policy and security measures in place to enforce the 2004
policy
Audit logs recording user activities, exceptions and information 10.10.1
security events are produced and kept for an agreed upon
period documented in a policy or procedure.
Log files are examined periodically to find system intrusions 10.10.2
Log files are protected against tampering and unauthorized 10.10.3
access
Security Information & Event Management (SIEM) tools are used Best Practice
to assist in monitoring system log files
Intrusion Detection or Prevention Systems are used to detect Best Practice
attacks on the system and alerts are sent to appropriate
personnel when such attacks are detected.
Intrusion Detection or Prevention systems are deployed behind Best Practice
ICS firewalls with ICS specific signatures
A policy exists covering the use of laptops and portable Best Practice
Whitelisting techniques are used to ensure that only approved Best Practice
devices are connected to the network
A policy exists to ensure that approved devices have been Best Practice
scanned with up to date virus scanners.
All portable media must be run through an anti-virus scanner Best Practices
prior to connecting to the IACS. A dedicated anti-virus scanning
computer is available to perform this task
A policy is in place for management of removable media 10.7.1
including tapes, disks, flash disks, removable hard drives, CDs,
DVDs and printed media
A policy is in place to securely and safely dispose removable 10.7.2
media when no longer required

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 11 of 19
2.7 Network Security Management
REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
Network segmentation strategies employing security zones have 10.6.1
been developed and implemented
Controls are in place to safeguard confidentiality and integrity of 10.6.1
data passing over public networks or wireless networks
High risk IACS are isolated from or employ a barrier device to 10.6.1
separate it from other zones with different security levels or risk
The network is analyzed to determine if there are any redundant Best Practice
network loops. Unnecessary redundant loops are removed.
Isolated networks are analyzed to determine if there are any Best Practices
unintended connections. If so such connections have been
removed
If the network crosses trust boundaries, DMZ's are created to Best Practice
connect multiple networks of different trust levels.
All network switches are configured with strong unique Best Practice
passwords
Dual homed servers have been eliminated. DMZ's are instead Best Practice
used to accomplish data transfer between two networks.
A Management of Change (MoC) process is in place for all Best Practice
network changes include changes to the configuration of
switches and routers
Best practices for switch configuration are documented and Best Practice
used. The NSA best practice or equivalent document is used.
Non-industrial grade switches are not used Best Practice
All switches are configured and have strong unique passwords Best Practice

2.8 Access Control: Account Administration, Authentication, and Authorization (including Network Segmentation)
REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 12 of 19
 REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
An access control policy for IACS has been developed and 11.1.1
implemented
There is a procedure in place for user registration and de- 11.2.1
registration which includes assigning users unique ID's and
granting them the minimum level of access control needed in
order to perform their job function.
Access to configuration settings and cybersecurity settings of all Best Practice
control system products should be limited to the most restrictive
mode that is consistent with the manufacturer's
recommendations and operational requirements
User access rights are reviewed periodically by management at 11.2.4
regular intervals
Policies are in place to ensure that users follow good security 11.3.1
practices in the selection and use of passwords
A policy exists for specifying password strength, usage time, and Best Practice
complexity
A policy exists specifying unique accounts for non-operator Best Practice
logins
A policy exists to restrict access to Windows desktop and other Best Practice
unnecessary applications for devices that are part of the IACS
Unattended equipment security policies are in place such as the 11.3.2
following: Users are advised to terminate active sessions when
finish, Users are advised to logout of systems when activity is
complete, Unattended equipment is prevented from
unauthorized use by a key lock or an equivalent control such as
password access

Clear desk and screen policies are in place to protect sensitive 11.3.3
information
Appropriate authentication methods are used to control access 11.4.2
by remote users

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 13 of 19
 REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
Best practices for remote access are documented and followed. Best Practice
Examples include the following: Change TCP port numbers for
well-known remote access protocols from their defaults;
Configure VPN such that split tunneling is not allowed by
technical policy; Monitor and log (log user ID, time and duration
of remote access) all remote access sessions; Require multi-
factor (e.g. two-factor or greater) authentication for any remote
access sessions.

Physical and logical access to diagnostic and configuration ports 11.4.4

is controlled.
For critical systems, inactive sessions are configured to 11.5.5
shutdown after a defined period of inactivity
Guidance and best practices for secure usage of wireless 11.7.3
technologies have been developed if such technologies are
allowed

2.9 System Hardening

REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
Unnecessary functions or features have been removed or Best Practice
disabled from IACS
IACS components have been locked down so that unnecessary Best Practice
functions or components cannot be added without permission.
Security best practices provided by vendors are applied Best practice

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 14 of 19
 REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
Policy for file sharing should be in place and followed. Insecure Best Practice
practices related to file sharing such as the following should be
avoided: Mistake 1: Sharing an entire hard drive, Mistake 2:
Letting anonymous people write to your computer, Mistake 3:
Sharing folders containing system data, Mistake 4: Giving the
"everyone" group permissions on any share.

Default user accounts are removed or renamed (e.g. Admin, Best Practice
Guest)

2.10 Vulnerability, Patch Management and Virus Scanning

REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
Systems are periodically checked for known vulnerabilities Best Practice
Unsupported components with known vulnerabilities are Best Practice
updated to supported components
A register or database of all applications on the ICS system is Best Practice
kept to aid in checking for known vulnerabilities.
Non-critical applications with known vulnerabilities are removed Best Practice
(e.g. Adobe, Flash, Internet Explorer, Java, MS Office, Games)
Risk analysis is used to determine whether the benefit of Best Practice
correcting the vulnerability outweighs the risk of deploying
patches
Patches are deployed to machines on a priority basis Best Practice
Patches, updates, and virus definition files are not distributed to Best Practice
the IACS directly from the business network.
A dedicated patch manager and anti-virus server in the DMZ is Best Practice
used to distribute patches and virus definitions to the IACS
Automated patch management tools and services are used to Best Practice
improve critical patch response time

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 15 of 19
 REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
Compatibility of Windows patches with major control software Best Practice
suppliers is done before deploying to control system machines
Patches are tested on non-critical systems before deploying on Best Practice
production machines.
Anti-virus software is running on all Windows based hosts. Best Practice
Virus definition files are regularly updated Best Practice
Virus definition updates are staggers so that all computers are Best Practice
not updated at the same time.
Compatibility of anti-virus software and signatures are verified Best Practice
with major control system software suppliers
Alert methods from control system vendors are in place to Best Practice
identify anti-virus updates that are NOT appropriate for the IACS
A rollback procedure is in place in case any anti-virus updates Best Practice
are incompatible with the IACS
Anti-virus updates are deployed to machines on a priority basis Best Practice

2.11 Cybersecurity Incident Management

REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
An incident response procedure is in place defining the actions 13.1.1,
and responsivities for reporting and responding to incidents. 13.1.2, 13.2.1
The organization monitors the types, volumes, and costs of 13.2.2
security incidents
Personnel are trained in their incident response roles and 13.2.5
responsibilities with respect to the IACS including periodic
refresher training
The incident response procedure documents when external 13.2.9
parties (government, local law enforcement) need to be notified
and who will make such notifications

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 16 of 19
 REFERENCE
REQUIREMENT COMPLETE COMPLIANCE ARGUMENT OPEN ISSUES
IEC 62443-2-1
Failed cybersecurity breaches are investigated as well as Best Practice
successful ones
Drills are periodically carried out to test the cybersecurity Best Practice
response process.

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 17 of 19
3 Abbreviations and Definitions

3.1 Abbreviations
DMZ Demilitarized Zone (sometimes referred to as a perimeter network or screened subnet)
IACS Industrial Automation Control System
MoC Management of Change
SIS Safety Instrumented System

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 18 of 19
4 Disclaimer, Assumptions, Equipment Data

4.1 Disclaimer
The user of the exSILentia® software is responsible for verification of all results obtained and their applicability to any particular situation. Calculations are
performed per guidelines in applicable international standards. exida.com L.L.C. accepts no responsibility for the correctness of the regulations or standards on
which the tool is based. In particular, exida.com L.L.C. accepts no liability for decisions based on the results of this software. The exida.com L.L.C. guarantee is
restricted to the correction of errors or deficiencies within a reasonable period when such errors or deficiencies are brought to its attention in writing. exida.com
L.L.C. accepts no responsibility for adjustments made by the user to this automatically generated report.

4.2 Assumptions
An overview of the specific assumptions made for each of the exSILentia® tool modules, including SILect and SILver, is listed in the user guide as well as in the
detailed reports that can be generated for each of these tools.

The cyber security requirements listed in this document are based on a draft copy of IEC 62443-2-1 and industry best practices. The majority of the requirements
listed are derived from the standard with little or no additional interpretation. For some requirements additional interpretations were needed. exida.com L.L.C.
accepts no responsibility for the correctness of the regulations or standards on which the tool is based. In particular, exida.com L.L.C. accepts no liability for
decisions based on the results of this software. The exida.com L.L.C. guarantee is restricted to the correction of errors or deficiencies within a reasonable period
when such errors or deficiencies are brought to our attention in writing. exida.com L.L.C. accepts no responsibility for adjustments made to this automatically
generated report made by the user.

exSILentia-CSC-001-01-a
Cyber Security Checklist February 19, 2021 Page 19 of 19