1 Scope
2 Purpose
3 Intended Audience
4 General Terms and Definitions
5 Background
6 Developing a Security Program
   6.1 Leadership Commitment
   6.2 Develop a Business Case
   6.3 Develop a Charter or Scope
   6.4 Program Tasks
   6.5 Special Considerations for Manufacturing
         and Control Systems
   6.6 Program
   6.7 Manufacturing and Control System Change
         Management Plan
   6.8 The Security Lifecycle
   6.9 Program Step Details
7 Define Risk Goals
8 Assess and Define Existing System
   8.1 Form Cross-Functional Team
   8.2 Pre-Risk Analysis Activities
   8.3 Update the Screening Inventory
   8.4 Make Preliminary Assessment of Overall Vulnerability
9 Conduct Risk Assessment and Gap Analysis
   9.1 Conduct Detailed Risk Analysis Vulnerability
         Assessment of the Prioritized Assets
   9.2 Prioritize Systems for Implementation Phase of
         Risk Mitigation Plan
10 Design or Select Countermeasures
   10.1 Implement Risk Mitigation Strategies Based upon
         Detected Vulnerabilities
   10.2 Address Vulnerabilities
   10.3 Formalize Change Management Plan for the System
11 Procure or Build Countermeasures
   11.1 Translate Requirements from Design Phase to
         Specification or Complete Construction
12 Define Component Test Plans
   12.1 Decisions to Make When Planning a Test Program
   12.2 Sufficient Testing
   12.3 Component Test Plans
13 Test Countermeasures
14 Define Integration Test Plan
15 Perform Pre-Installation Integration Test
16 Define System Validation Test Plan
17 Perform Validation Test on Installed System
18 Finalize Operational Security Measures
   18.1 Establish Operational Security Baseline
   18.2 Finalize Operational Security Policy
   18.3 Establish Management of Change (MOC) Program
   18.4 Establish Periodic Audit Plan
   18.5 Establish Audit Metrics
   18.6 Establish Audit Metrics Reporting Procedure
   18.7 Establish Compliance Requirements
   18.8 Establish Corrective Action Procedures
   18.9 Disaster Recovery
   18.10 Monitoring and Logging
   18.11 Intrusion Detection
   18.12 Incident Response
   18.13 Contingency Plans
   18.14 Normal
   18.15 Formalize Audit Plan for the System
   18.16 Implement
19 Routine Security Reporting and Analysis
20 Periodic Audit and Compliance Measures
21 Reevaluate Security Countermeasures
22 Work with Suppliers and Consultants
   22.1 System Suppliers
   22.2 Consultants
   22.3 Integrators
   22.4 User Group
23 Participate in Industry Forums and Development Programs
   23.1 ISA-The Instrumentation, Systems, and Automation
         Society
   23.2 U.S. National Institute of Standards and Technology
         (NIST)
   23.3 North American Electric Reliability Council (NERC)
   23.4 Chemical Industry Data Exchange (CIDX)
   23.5 Institute of Electrical and Electronics Engineers
         (IEEE)
   23.6 International Electrotechnical Commission (IEC)
   23.7 International Council on Large Electric Systems
         (CIGRE)
   23.8 U.S. Department of Energy National SCADA Test Bed
         Program
   23.9 Process Control System Cyber Security Forum (PCSRF)
24 Bibliography and References
Annex A - Sample Policies and Procedures Document
Annex B - A Sample Vulnerability Assessment Procedure
Annex C - Integrating Security into Supplier Practices