🔥🔥 Don’t Miss Out on Our End of Autumn Sale. If you have any questions, feel free to click the bottom right corner to contact our customer service..

Concat us[email protected]
Shopping Cart

No products in the cart.

🔍
BS EN IEC 62645:2020

BS EN IEC 62645:2020

$198.66

Nuclear power plants. Instrumentation, control and electrical power systems. Cybersecurity requirements

Published By Publication Date Number of Pages
BSI 2020 60
PDF Format Searchable Printable Preview Now
Guaranteed Safe Checkout
Categories: ,

If you have any questions, feel free to reach out to our online customer service team by clicking on the bottom right corner. We’re here to assist you 24/7.
Email:[email protected]

1.1 General

This document establishes requirements and provides guidance for the development and management of effective computer security programmes for I&C programmable digital systems. Inherent to these requirements and guidance is the criterion that the power plant I&C programmable digital system security programme complies with the applicable country’s requirements.

This document defines adequate measures for the prevention of, detection of and reaction to malicious acts by digital means (cyberattacks) on I&C programmable digital systems. This includes any unsafe situation, equipment damage or plant performance degradation that could result from such an act, such as:

  • malicious modifications affecting system integrity;

  • malicious interference with information, data or resources that could compromise the delivery of or performance of the required I&C programmable digital functions;

  • malicious interference with information, data or resources that could compromise operator displays or lead to loss of management of I&C programmable digital systems;

  • malicious changes to hardware, firmware or software at the programmable logic controller (PLC) level.

Human errors leading to violation of the security policy and/or easing the aforementioned malicious acts are also in the scope of this document.

This document describes a graded approach scheme for assets subject to digital compromise, based on their relevance to the overall plant safety, availability, and equipment protection.

Excluded from the scope of this document are considerations related to:

  • non-malevolent actions and events such as accidental failures, human errors (except those impacting the performance of cybersecurity controls) and natural events. In particular, good practices for managing applications and data, including back-up and restoration related to accidental failure, are out of scope;

    NOTE 1 Although such aspects are often covered by security programme in other normative contexts (e.g., in the ISO/IEC 27000 series or in the IEC 62443 series), this document is only focused on the protection against malicious acts by digital means (cyberattacks) on I&C programmable digital systems. The main reason is that in the nuclear generation domain, other standards and practices already cover accidental failures, unintentional human errors, natural events, etc. The focus of IEC 62645 is made to provide the maximum consistency and the minimum overlap with these other nuclear standards and practices.

  • site physical security, room access control and site security surveillance systems. These systems, while not specifically addressed in this document, are to be covered by plant operating procedures and programmes;

    NOTE 2 This exclusion does not deny that cybersecurity has clear dependencies on the security of the physical environment (e.g., physical protection, power delivery systems, heating/ventilation/air-conditioning systems (HVAC), etc.).

  • the aspect of confidentiality of information about I&C digital programmable systems is out of the scope of this document (see 5.4.3.2.3).

Annex A provides a rationale for and comments about the scope, definition and the document’s application, and in particular about the exclusions and limitations previously mentioned.

Standards such as ISO/IEC 27001 and ISO/IEC 27002 are not directly applicable to the cyber protection of nuclear I&C programmable digital systems. This is mainly due to the specificities of these systems, including the regulatory and safety requirements inherent to nuclear facilities. However, this document builds upon the valid high level principles and main concepts of ISO/IEC 27001:2013, adapts them and completes them to fit the nuclear context.

This document follows the general principles given in the IAEA reference manual NSS17.

PDF Catalog

PDF Pages PDF Title
2 undefined
5 Annex ZA(normative)Normative references to international publicationswith their corresponding European publications
7 English
CONTENTS
10 FOREWORD
12 INTRODUCTION
14 1 Scope
1.1 General
15 1.2 Application
1.3 Framework
16 Figure 1 – Overall framework of IEC 62645
17 2 Normative references
3 Terms and definitions
19 Figure 2 – E/E/PE items
22 4 Abbreviated terms
5 Establishing and managing a nuclear I&C programmable digital system security programme
5.1 Context of the organization
5.1.1 Understanding the organization and its context
5.1.2 Understanding the needs and expectations of interested parties
5.1.3 Determining the scope of the I&C programmable digital system security programme
23 5.2 Programme, policy and plan
5.2.1 I&C digital programmable system security program
5.2.2 Policy
24 5.2.3 Plan
5.3 Leadership
5.3.1 Leadership and commitment
5.3.2 Roles, responsibilities and authorities
25 5.4 Planning of the programme
5.4.1 Cybersecurity objectives and planning to achieve them
5.4.2 Addressing risks and opportunities of the programme
26 5.4.3 Graded approach to I&C security and risk assessment
33 5.5 Support
5.5.1 Resources
5.5.2 Training, competence and awareness
34 5.5.3 Communications about cybersecurity
5.5.4 Documented information
5.6 Operation
5.6.1 Operation planning and control
35 5.6.2 Cybersecurity graded approach, risk assessment and risk treatment
5.7 Performance evaluation
5.7.1 Monitoring, measurement, analysis and evaluation
5.7.2 Internal audit
5.7.3 Management review
36 5.8 Improvement
5.8.1 General
5.8.2 Nonconformity and corrective action
5.8.3 Continual improvement
6 Life-cycle implementation for I&C programmable digital system security
6.1 General
6.2 System requirements specification
6.2.1 General
37 6.2.2 Security degree assignment
6.3 System specification
6.3.1 Selection of pre-existing components
6.3.2 System architecture
6.4 System detailed design and implementation
6.4.1 General
38 6.4.2 Risk assessment at the design phase
6.4.3 Design project security plan
6.4.4 Communication pathways
39 6.4.5 Security zone definition
6.4.6 Security assessment of the final design
6.4.7 Implementation activities
6.5 System integration
6.6 System validation
40 6.7 System installation
6.8 Operation and maintenance activities
6.8.1 Change control during operations and maintenance
6.8.2 Periodic reassessment of risks and security controls
6.8.3 Change management
41 6.9 Retirement activities
7 Security controls
7.1 General
7.2 Characterization
42 7.3 Security defence-in-depth
7.4 Selection and enforcement of cybersecurity controls
43 Annexes
Annex A (informative) Rationale for, and notes related to, the scope of this document
A.1 Objective of this annex
A.2 Inclusion of I&C programmable digital system not important to safety
A.3 Exclusion of site physical security, room access control and site security surveillance systems
A.4 Exclusion of non-malevolent actions and events
A.5 Development tools and platforms
44 Annex B (informative) Generic considerations about the security degrees
B.1 Rationale for three security degrees
B.1.1 General
B.1.2 Safety categories as input to security degree assignment
B.1.3 Impact on plant availability and performance as input to security degree
45 B.1.4 Resulting security degree assignment approach
B.2 Considerations about tools associated to on-line systems
B.3 Practical design and implementation
46 Annex C (informative) Correspondence with ISO/IEC 27001:2013
Table C.1 – Correspondence between ISO/IEC 27001:2013 and IEC 62645
48 Annex D (informative)Overall organisation of IEC SC 45A standards related to cybersecurity
49 Figure D.1 – Overview of IEC SC 45A standards with cybersecurity relation
50 Annex E (informative) Selection of security controls
51 Figure E.1 – Selection of security controls
52 Annex F (informative) Considerations about IEC 62645 applicability to non-NPP nuclear facilities
F.1 Applicability of IEC 62645 security graded approach to Research Reactors
F.1.1 General
F.1.2 Categorization of RRs in accordance with potential hazards
53 F.1.3 Safety categories as input to security degree assignment
Table F.1 – Correspondence between safety categories and classes as per IEC 61513
54 F.1.4 Impact on operational capacity as input to security degree
F.1.5 Considerations on requirements associated to security degrees
F.2 Applicability of IEC 62645 security graded approach to fuel cycle facilities
F.3 Applicability of IEC 62645 security graded approach to SMR
55 F.4 Reference documents
56 Annex G (informative)High-level correspondence table between IEC 62443 series and IEC 62645
58 Bibliography

Related products

BS EN IEC 62645:2020
$198.66