Thu, 2020-09-03

All studies recently published agree that the Industrial Automation and Control Systems (IACS) increasingly constitute a target for cyber-attacks aiming at disturbing Member States’ economies, at disabling our critical infrastructures or at taking advantage from our people. Such hostile acts take place in a context of geostrategic tensions, for the satisfaction of organised crime’s purposes, or else in support of possible activist causes. In this context, the ERNCIP Thematic Group (TG) “Case studies for the cybersecurity of Industrial Automation & Control Systems” was started in January 2014 to answer the question: “Do European critical infrastructure operators need to get IACS’ components or subsystems tested and “certified” (T&C) with regards to their cybersecurity?” And should the answer have been yes, it had to answer a corollary question: “What are (roughly) the conditions of feasibility for implementing successfully a European IACS components cybersecurity Compliance & Certification Scheme?” This TG’s undertaking was a research project, not a task force seeking to deliver an immediately applicable standard. It mobilised representatives of IACS vendors, industrial operators, European Institutions and national cybersecurity authorities.

Thu, 2020-09-03

The present report on Recommendations for the Implementation of a European IACS Components Cybersecurity Certification Scheme (ICCS) has been produced with a close and consistent reference and relevance to the EU CyberSecurity Act, following a rationale that allows it to constitute the most solid basis for a future European Cybersecurity Certification Scheme dedicated to the subject of Industrial Automation & Control Systems Components. To this end, given its high quality and the completeness of its technical content, this report can be considered to be included in the Union Rolling Work Programme so as to be thereafter further developed by ENISA as a candidate European Cybersecurity Certification Scheme in the respective area.

Wed, 2018-07-11

The principal goal of this report is to present the experiments of the industrial automation and control systems (IACS) component Cybersecurity Certification Framework (ICCF) performed in 2017 by the national exercise teams (NETs) of several Member States, namely France, Poland and Spain. Based on real-life cases of use and simulations of ICCF activities, this report documents the current practices of these countries and NET members’ views in relation to IACS products’ cybersecurity certification. These studies have led to a series of findings that will be useful for the future of the ICCF in the context of the European Cybersecurity Certification Framework. In conclusion, a plan of action is proposed for the 2018-2019 period.

Wed, 2017-02-22

The principal goal of this report is to propose an initial set of common European requirements and broad guidelines that will help fostering IACS cybersecurity certification in Europe. It describes the IACS component Cybersecurity Certification Framework (ICCF) and its elements and makes suggestions for its governance, adoption and implementation. This report is not intended to be a standard, nor aims at the establishment of new ones, as this effort’s focus is to perform and publish a feasibility study that could foster the certification of IACS components in Europe.