This page contains document links to Construction Criteria Base


By Michael Chipley PhD, PMP, LEED AP, The PMC Group LLC

Last updated: 09-24-2015


Industrial Control Systems (ICS) are physical equipment oriented technologies and systems that deal with the actual running of plants and equipment, include devices that ensure physical system integrity and meet technical constraints, and are event-driven and frequently real-time software applications or devices with embedded software. These types of specialized systems are pervasive throughout the infrastructure and are required to meet numerous and often conflicting safety, performance, security, reliability, and operational requirements. ICSs range from building environmental controls (HVAC, lighting), to systems such as the electrical power grid. With the increasing interconnectivity of ICS to the internet, the ICS can be an entry point into the organization's other IT systems.

Within the controls systems industry, ICS systems are often referred to as Operational Technology (OT) systems. Historically, the majority of OT systems were proprietary, analog, vendor supported, and were not internet protocol (IP) enabled. Systems key components, such as Remote Terminal Units (RTUs), Programmable Logic Controllers (PLCs), Physical Access Control Systems (PACs), Intrusion Detection Systems (IDSs), closed circuit television (CCTV), fire alarm systems, and utility meters have become digital and IP enabled. OT systems use Human Machine Interfaces (HMIs) to monitor the processes, versus Graphical User Interfaces for IT systems. Most current ICS systems and subsystems are now a combination of Operational Technologies (OT) and Information Technologies (IT).

The Stuxnet, Duqu, Flame and Shamoon malware were specifically designed to target ICS and cause physical damage to the processes or equipment. Stuxnet "spoofed" the integrity of the uranium centrifuges and caused the centrifuges to overspin and self-destruct, while the operators console showed the system was operating within normal parameters. The Duqu malware looks for information that could be useful in attacking industrial control systems. Its purpose is not to be destructive; the known components are trying to gather information. The Flame malware looks for engineering drawings, specifications, and other technical details about the systems and records audio, screenshots, keyboard activity, and network traffic. The program also records Skype conversations and can turn infected computers into Bluetooth beacons which attempt to download contact information from nearby Bluetooth-enabled devices. The most recent malware attack, Shamoon, destroyed over 30,000 Saudi Armco work stations. Shamoon is capable of spreading to other computers on the network, through exploitation of shared hard drives. Once a system is infected, the virus continues to compile a list of files from specific locations on the system, erase and then send information about these files back to the attacker. Finally, the virus will overwrite the master boot record of the system to prevent it from booting as shown in Figure 1.

screenshot of the Shamoon malware showing its ability to overwrite the master boot record of a computer

Figure 1: The Shamoon malware has the ability to overwrite the master boot record of a computer. Image credit: Securelist

In February 2013, Executive Order Improving Critical Infrastructure Cybersecurity was issued which requires the National Institute of Standards and Technology (NIST) to "lead the development of a framework to reduce cyber risks to critical infrastructure (the "Cybersecurity Framework"). The Cybersecurity Framework shall include a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks. The Cybersecurity Framework shall incorporate voluntary consensus standards and industry best practices to the fullest extent possible.

While federal agencies have been required to meet stringent Cybersecurity standards for the traditional IT systems since the Federal Information Security Management Act (FISMA) was passed in 2002, the same level of protection and analysis is just beginning to be developed for building control systems. Buildings are becoming increasingly reliant on technologies that allow centralized monitoring and control of multiple building systems ( Building Automation, Fire and Life Safety, Energy Management, Physical Security, Access Control, etc.), to assist in accomplishing design and operational goals. Because of the unique operating and configuration of building control systems, traditional IT processes such as continuous monitoring, host based scanning, and automated patch management can cause building control systems to fail or become non-operational.

This section will provide an overview of the current efforts underway with regards to policy, standards, guides, and tools to assist building owners and operators, designers, and constructors meet the Cybersecurity challenges.


Industrial Control Systems and Operational Technology

Within the controls systems industry, Industrial Control Systems (ICS) are often referred to as Operational Technology (OT). ICS are physical equipment oriented technologies and systems that deal with the actual running of plants and equipment, include devices that ensure physical system integrity and meet technical constraints, and are event-driven and frequently real-time software applications or devices with embedded software. These types of specialized systems are pervasive throughout the infrastructure and are required to meet numerous and often conflicting safety, performance, security, reliability, and operational requirements.

NIST SP 800-53 R4 defines ICS as:

An information system used to control industrial processes such as manufacturing, product handling, production, and distribution. Industrial control systems include supervisory control and data acquisition (SCADA) systems used to control geographically dispersed assets, as well as distributed control systems (DCSs) and smaller control systems using programmable logic controllers to control localized processes.

NIST SP 800-82 R2 further expands on the characteristics of ICS:

Although some characteristics are similar, ICS also have characteristics that differ from traditional information processing systems. Many of these differences stem from the fact that logic executing in ICS has a direct effect on the physical world. Some of these characteristics include significant risk to the health and safety of human lives and serious damage to the environment, as well as serious financial issues such as production losses, negative impact to a nation's economy, and compromise of proprietary information. ICS have unique performance and reliability requirements and often use operating systems and applications that may be considered unconventional to typical IT personnel. Furthermore, the goals of safety and efficiency sometimes conflict with security in the design and operation of control systems.

The term ICS is used in its broadest sense which includes:

  • Supervisory Control and Data Acquisition (Energy, Water, Wastewater, Pipeline, Airfield Lighting, Locks, and Dams, etc.)
  • Distributed Control Systems (Process and Manufacturing, etc.)
  • Building Control Systems/Building Automation Systems
  • Utility Management Control Systems
  • Electronic Security Systems
  • Fire, Life Safety, Emergency Management Systems
  • Exterior Lighting and Messaging Systems
  • Intelligent Transportation Systems

Within the Department of Defense, there are over 30 unique types of ICS as shown in Figure 2. There are an estimated 2.5 million unique ICS systems that are used in over 300,000 buildings and over 250,000 linear structures.

Examples of DoD OT and ICS systems and subsystems

Figure 2: Examples of DoD OT and ICS Systems and Subsystems1

The majority of these systems were historically proprietary, analog, vendor supported, and used direct serial, and/or wireless connection, and were not IP enabled. The systems components such as Remote Terminal Units, Programmable Logic Controllers, Physical Access Control, Intrusion Detection Systems, CCTV, fire alarm systems, and utility meters have long equipment life spans, and are typically designated as Operational Technology (OT) and Real Property Equipment.

ICSs differ significantly from traditional administrative, mission support and scientific data processing information systems, and use specialized software, hardware and protocols. ICS systems are often integrated with mainstream organizational information systems to promote connectivity, efficiency, and remote access capabilities. The "front end" portions of these ICSs resemble traditional information systems in that they use the same commercially available hardware and software components. While the majority of an ICS system still does not resemble a traditional information system (IS), the integration of the ICS's "front end" with IS introduces some of the same vulnerabilities that exist in current networked information systems.

As these systems and components became digital and IP enabled, the interconnects to the organization network and business systems began to expose the organization to exploits and significant vulnerabilities. Typically, there was not a clear line of demarcation where one system started and one ended, for example a EMCS meter could be on the utility SCADA system, or on the buildings BAS. A comparison of IT versus OT systems is provided in the table below:

Table 1—IT vs. OT Systems Comparison

 Information TechnologyOperational Technology
PurposeProcess transactions, provide informationControl or monitor physical processes and equipment
ArchitectureEnterprise wide infrastructure and applications (generic)Event-driven, real-time, embedded hardware and software (custom)
InterfacesGUI, Web browser, terminal and keyboardElectromechanical, sensors, actuators, coded displays, hand-held devices
OwnershipCIO and ITEngineers, technicians, operators and managers
ConnectivityCorporate network, IP-basedControl networks, hard wired twisted pair and IP-based
RoleSupports peopleControls machines

ICSs can have long life spans (in excess of 20 years) and be comprised of technology that while functional, do not have the same technology refresh cycle as the IT. This introduces two issues: first, depending upon the relative age and isolation of the system, there may not be a patch or upgrade path for components of the system, and second, attempting to patch the component or employing modern scanning methods might disrupt the system. ICSs have experienced complete system shutdown when an intrusion detection system (IDS) or host-based scanning system (HBSS) scan is performed on an otherwise operational ICS. For an ICS, updates should be delayed until after a thorough analysis of deployment impact has been completed. This might stretch out security update timeliness and require flexibility in security control compliance measurement and enforcement.

An ICS physical system can span many miles; for example, locks and dams, pipelines, electric transmission and distribution systems can have many non-contiguous components, and there are a number of protocols commonly used by ICSs to allow the devices to communicate both horizontally and vertically. A building use could use a number of protocols at the same time. Typical building protocols are:

  • LonWorks
  • BACnet
  • Modbus
  • DNP 3
  • Fox

These protocols were developed initially to ensure availability and reliability, and able to communicate down to the device level with small data transmission and verification. Many devices have embedded firmware with default passwords. The protocol organizations and vendors are now working to add additional security features on new systems while working on securing legacy systems.

Buildings can have a number of primary and secondary systems used to support the tenants and/or primary function of the building (office, hospital, warehouse, school, etc.).

Communications Network and Business Systems

The Communications Network and Business Systems include the Demarcation or Point of Entry where the external communications connect with the buildings internal network and include voice, data, video and multimedia information services, such as video conferencing and email. Typically the business systems are on a separate fiber high-speed backbone.

Building Management System (BMS)

The Building Management System provides automatic monitoring, interaction and management for electricity, ventilation, water supply, security and fire control to the building. A BMS typically manages the: Building Automation System (BAS), Electronic Security System (ESS), and the Fire and Life Safety System (FLS). For larger buildings and campuses, there will usually be a Building Operations Center (BOC), Security Operations Center (SOC), or Emergency Operations Center (EOC) that has engineering, O&M, security or emergency management personnel monitoring the BMS. In smaller buildings, there may only be a workstation and panels that alarm and report to an off-site BOC, SOC, or EOC.

Building Automation System (BAS)/Building Control System (BCS)

A building automation system (BAS) or Building Control Systems (BCS) is an example of a distributed control system. The control system is a computerized, intelligent network of electronic devices designed to monitor and control the mechanical, electronic, and lighting systems in a building. A building controlled by a BAS is often referred to as an Intelligent Building or a Smart Building.2

BAS core functionality keeps the building climate within a specified range, provides lighting based on an occupancy schedule, monitors system performance and device failures, and provides malfunction alarms (via email and/or text notifications) to building engineering/maintenance staff. The BAS functionality reduces building energy and maintenance costs when compared to a non-controlled building. The BAS typically consists of:

  • Fire and Life and Safety (FLS)
  • Physical Security and Access Control (PACS)
  • Energy Management Systems (EMS), which includes Lighting Control
  • Heating, Ventilation and Air Conditioning (HVAC)

A typical BAS architecture with multiple protocols is shown in Figure 3.

Typical BAS architecture

Figure 3: Typical BAS Architecture

Electronic Security System (ESSS)

The Electronic Security System (ESS) is critical for providing a secure environment and protecting the safety of tenants. Elements include: Anti-theft Security and Alarm System, Electronic Control System, Physical Access Control System, Closed-Circuit TV Surveillance System. The ESS is typically monitored by security personnel in the SOC.

Fire and Life Safety System (FLS)

The Fire and Life Safety (FLS) system consists of the fire alarms, sensors, sprinklers, smoke purge, and exhaust fans, and is often connected to the BAS to shutdown HVAC, elevators, and other equipment. The FLS typically connects to the local fire department and alarms in the SOC and BOC. Traditionally, these systems were in separate conduits and cabling went from the control panel to the devices.

Power over Ethernet

A new technology, Power over Ethernet (PoE)3, is changing the traditional cabling process and operations of the BMS. PoE describes any of several standardized or ad-hoc systems which pass electrical power along with data on Ethernet cabling. This allows a single cable to provide both data connection and electrical power to devices such as network hubs or closed-circuit TV cameras. Unlike standards such as Universal Serial Bus which also power devices over the data cables, PoE allows long cable lengths. Power may be carried on the same conductors as the data, or it may be carried on spare pairs of the cable. A BAS with PoE is shown in Figure 4.

A BAS using power over ethernet

Figure 4: A BAS using Power over Ethernet (Contemporary Controls4)

There are a number of new PoE devices and systems that are entering the market and addressing the cybersecurity of these systems will be a challenge. When legacy systems are being modernized and/or upgraded with PoE, understanding the network connections and ripple effects of loss of communications or power must be carefully analyzed as part of the Contingency Plan and Disaster Recovery/Business Continuity Plan.

Smart Buildings/Intelligent Buildings

A Smart Building or Intelligent Building project generally covers three key elements.5

  • Communications Network and Office Automation
  • Building Management System
  • Integrated Services Infrastructure

The GSA Public Building Service (PBS) has been an active leader in the development of Smart Buildings. In March 2011, the PBS issued the Technology Policy for PBS-Owned Building Monitoring and Control Systems memo, with the objective to "converge the building's Monitoring and Control (M&C) systems infrastructure to enable smarter and more efficient operations." The GSA Smart Building concept is shown in Figure 5.

GSA Smart Buildings Concept

Figure 5: GSA Smart Buildings Concept

The GSA Smart Buildings effort had three broad objectives:

  1. Open Communication Protocols—Non-proprietary building controls that give GSA greater building management flexibility and reduce service costs

  2. Converged Control Systems Networks (IT backbone)—Elimination of unnecessarily redundant controls infrastructure such as conduit, cables, switches, and UPS's that will then allow interoperability and security compliance

  3. Normalized Data for Systems Communications—Different controls manufacturers or even disparate systems can "talk" to each other allowing for data collection and analysis and more flexibility and management control

The resulting efforts are the convergence of the IT and OT into a new hybrid where the CIO provides the switches, routers and firewalls as Government Furnished Equipment (GFE), and all the building monitoring and control systems plug into the CIO fiber backbone in the distribution closet, as shown in Figure 6.

Converged building M&C connected in the distribution closet

Figure 6: Converged Building M&C Connected in the Distribution Closet

While the GSA Smart Buildings model may work for many organizations, many others may not want to have the ESS or FLS running on the same fiber as the BAS. The redundancy and operational impact of converged systems is still a relatively new area.

To help evaluate system interdependencies, GSA has developed the Sustainable Facilities Tool. A sustainable building can operate more efficiently and cost less when the impacts of systems on each other are considered. The system bundling section can be leveraged to further understand whole building synergies and explore examples for ideas on what technologies might best be bundled together.

Achieving the design and operational performance requires a substantial change in mindset and training across multiple disciplines, changes in acquisition and contract language, and changes in the buildings operations and maintenance. GSA has developed a revised delivery process and is in the process of updating the Public Building Services Facilities Standard 100. The new process is shown in Figure 7.

GSA Smart Buildings Life Cycle Approach

Figure 7: GSA Smart Buildings Life Cycle Approach

Smart buildings are now becoming the norm across the country, and as the buildings get ever smarter and interconnected with Smart Cars, Smart Cities, etc., they become vulnerable to outside attack and malware. As the IT and OT systems continue to converge, the need for new Cybersecurity skills and training for the facilities workforce will need to be developed.

The Department of Homeland Security Interagency Security Committee has developed several publications for risk assessments, facility security levels, and converged IT and OT assets, with an emphasis on physical access control systems, intrusion detection systems, and CCTV systems.

Cyber-Physical Systems and the Critical Infrastructure Cybersecurity Framework

An emerging classification developed by the National Science Foundation and NIST is to classify the hybrid IT and OT as Cyber-Physical Systems (CPS). CPS are defined as integrated, hybrid networks of cyber and engineered physical elements; co-designed and co-engineered to create adaptive and predictive systems, and respond in real time to enhance performance.6 CPS reflect the advances in technology, similar to the shift that occurred going from the Industrial Revolution/Physical Systems to the Internet Revolution/Cyber Systems, and now transitioning to Industrial Internet Revolution/Cyber Physical Systems as shown in Figures 8 and 9.

CPS Timeline Contex

Figure 8: CPS Timeline Context7

CPS are enabling a new generation of 'smart systems'. NIST has taken an active role and lead in defining the CPS and has held several workshops, resulting in several publications in early 2013:

  • National Institute of Standards and Technology (NIST) Executive Roundtable on Cyber-physical Systems
  • National Institute of Standards and Technology (NIST) Executive Roundtable on Cyber-physical Innovation
  • National Institute of Standards and Technology (NIST) Executive Roundtable on Cyber-physical Systems Strategic R&D
  • National Institute of Standards and Technology (NIST) Industrial Internet Workshop, The Industrial Internet and Cyber-Physical Systems: A Government Perspective

Essential CPS characteristics include8:

  • Cyber, engineered, and human elements as treated as integral components of a total system to create synergy and enable desired, emergent properties
  • Integration of deep physics-based and digital world models provides learning and predictive capabilities for decision support (e.g., diagnostics, prognostics) and autonomous function
  • Systems engineering-based open architecture and standards provide for modularity and composability for customization, systems of products, and complex or dynamic applications
  • Reciprocal feedback loops between computational and distributed sensing/actuation and monitoring/control elements enables adaptive multi-objective performance
  • Networked cyber components provide a basis for scalability, complexity management, and resilience
CPS Common Core Context

Figure 9: CPS Common Core Context9

A comparison of the CPS systems and impacts across various sectors are provided in Table 2.

Table 2—Cyber-Physical Sector Context10

Innovative Products or ApplicationsCyber-Physical SystemsImpacts
Smart Manufacturing and Production
Agile manufacturingIntelligent controlsEnhanced global competitiveness
Supply chain connectivityProcess and assembly automationU.S.-based high tech manufacturing
 Robotics working safely with humansGreater efficiency, agility, and reliability
Transportation and Mobility
Autonomous or smart vehicles (surface, air, water, and space)Drive by wire vehicle systemsAccident prevention and congestion reduction (zero-fatality highways)
Vehicle-to-vehicle and vehicle-to-infrastructure communicationPlug ins and smart carsGreater safety and convenience of travel
 Interactive traffic control systems 
 Next-generation air transport control 
Electricity systemsSmart electric power gridGreater reliability, security, and diversity of energy supply
Renewable energy supplyPlug-in vehicle charging systemsIncreased energy efficiency
Oil and gas productionSmart oil and gas distribution grid 
Civil Infrastructure
Bridges and damsActive monitoring and control systemMore safe, secure, and reliable infrastructure
Municipal water and wastewater treatmentSmart grids for water and wastewaterAssurance of water quality and supply
 Early warning systemsAccident warning and prevention
Medical devicesWireless body area networksImproved outcomes and quality of life
Personal care equipmentAssistive healthcare systemsCost-effective healthcare
Disease diagnosis and preventionWearable sensors and implantable devicesTimely disease diagnosis and prevention
Buildings and Structures
High performance residential and commercial buildingsWhole building controlsIncreased building efficiency, comfort and convenience
Net-zero energy buildingsSmart HVAC equipmentImproved occupant health and safety
AppliancesBuilding automation systemsControl of indoor air quality
 Networked appliance systems 
Soldier equipmentSmart (precision-guided) weaponsIncreased warfighter effectiveness, security, and agility
Weapons and weapons platformsWearable computing/sensing uniforms 
Supply equipmentIntelligent, unmanned vehiclesDecreased exposure for human warfighters and greater capability for remote warfare
Autonomous and smart underwater sensorsSupply chain and logistics systems 
Emergency Response
First responder equipmentDetection and surveillance systemsIncreased emergency responder effectiveness, safety, efficiency, and agility
Communications equipmentResilient communications networksRapid ability to respond to natural and other disasters
Fire-fighting equipmentIntegrated emergency response systems 

NIST has developed a reference architecture shown in Figure 10 that:

CPS Reference Architecture

Figure 10: CPS Reference Architecture

  • Provides a common lexicon and taxonomy that can apply across CPS
  • Shows a common architectural vision to help facilitate interoperability between components and systems
  • Enables creation of reusable CPS components and tools to measure and evaluate their performance
  • Promotes communication across diverse stakeholder community
  • Provides a common lexicon and taxonomy that can apply across CPS
  • Shows a common architectural vision to help facilitate interoperability between components and systems
  • Enables creation of reusable CPS components and tools to measure and evaluate their performance
  • Promotes communication across diverse stakeholder community

The use of the CPS terminology and reference architecture will continue to be an evolving area.

National Institute of Standards and Technology Computer Security Resource Center

The NIST Computer Security Division, Computer Security Resource Center is where the standards and publications are maintained. NIST 800-53 Recommended Security Controls for Federal Information Systems and Organizations, and NIST 800-82 Guide to Industrial Control Systems (ICS) Security are used by most federal agencies as the baseline to evaluate their systems. Both publications were updated and published in spring 2013.

The STUXNET, FLAME, and other cyber attacks have shown how vulnerable the nation's ICS are. As the Smart Grid develops, enhanced security controls are being developed by NIST, to include the NISTIR 7628 Guidelines for Smart Grid Cyber Security, and the NIST Framework and Roadmap for Smart Grid Interoperability Standard, Release 2.0. Buildings that have Advanced Smart Metering and other web or wireless connections to the system should be secured and tested to ensure vulnerabilities are mitigated and risks minimized.

Department of Homeland Security ICS-CERT

The Department of Homeland Security Control Systems Security Program is part of the United States Computer Emergency Readiness Team (US-CERT) and provides tools, standards, training, and publications for ICS.

The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) works to reduce risks within and across all critical infrastructure sectors by partnering with law enforcement agencies and the intelligence community and coordinating efforts among Federal, state, local, and tribal governments and control systems owners, operators, and vendors. Additionally, ICS-CERT collaborates with international and private sector Computer Emergency Response Teams (CERTs) to share control systems-related security incidents and mitigation measures.

Similar to the advancement of the number of malicious malware and hacking of traditional IT systems, critical infrastructure (CI) is now a primary target and the number of ICS-CERT reported incidents is exponentially increasing.

Pie chart depicting vulnerablitilies by location in architecture

Figure 11: ICS Vulnerabilities reported to ICS-CERT by ISA 99 Layer

CSET is a desktop software tool that guides users through a step-by-step process to assess their control system and information technology network security practices against recognized industry standards. The output from CSET is a prioritized list of recommendations for improving the cybersecurity posture of the organization's enterprise and industrial control cyber systems. The tool derives the recommendations from a database of cybersecurity standards, guidelines, and practices. Each recommendation is linked to a set of actions that can be applied to enhance cybersecurity controls.

Screen shot of the DHS Cyber Security Evaluation Tool

Figure 12: DHS Cyber Security Evaluation Tool

CSET has been designed for easy installation and use on a stand-alone laptop or workstation. It incorporates a variety of available standards from organizations such as National Institute of Standards and Technology (NIST), North American Electric Reliability Corporation (NERC), International Organization for Standardization (ISO), U.S. Department of Defense (DoD), and others. When the tool user selects one or more of the standards, CSET will open a set of questions to be answered. The answers to these questions will be compared against a selected security assurance level, and a detailed report will be generated to show areas for potential improvement.

CSET provides an excellent means to perform a self-assessment of the security posture of your control system environment.

GRASSMARLIN ICS Network Discovery Tool

In support of a passive means to generate an Industrial Control System network and discover IP devices, NSA has developed the GRASSMARLIN (GM) tool. GRASSMARLIN is a software prototype that provides a method for discovering and cataloging SCADA (Supervisory Control and Data Acquisition) and ICS (Industrial Control System) systems on IP-based networks. GRASSMARLIN uses a variety of sources to generate this data, including PCAP files, router and switch configuration files, CAM tables and live network packet captures. The tool can automatically determine the available networks and generate the network topology as well as visualize the communication between hosts. GRASSMARLIN is still in a prototype phase.

Grassmarlin has been approved for Open Source distribution. The executables and documentation can be accessed via the link below. is available to U.S. military, DoD government civilians and DoD contractors for Government authorized use. Access to requires a valid DoD Common Access Card (CAC) OR an external PKI certificate issued by an accepted Federal Government Agency, Industry Partner or a DoD-approved External Certificate Authority (ECA) with DoD government sponsor registered with The GM POC is Jerome Crocker.

A GM Plug-In has been integrated into the DHS ICS-CERT Cyber Security Evaluation Tool (CSET) 6.2 released January 2015. When installing the tool, use Custom Install and select the GM Plug-In option. If you need assistance and/or technical support with CSET and GM Plug-In, contact Barry Hansen or Michael Chipley.

Department of Homeland Security Science and Technology

DHS S&T has developed several tools to assess the risk and resiliency of buildings, to include the cyber threat. The Integrated Rapid Visual Screening Tool, and the Owners Performance Requirement Tool assist building owners and operators evaluate the threats, vulnerabilities, and consequences and compare mitigation options.

Committee for National Security Systems ICS Overlay

The CNSS provides a forum for the discussion of policy issues, and is responsible for setting national-level Information Assurance policies, directives, instructions, operational procedures, guidance, and advisories for U.S. Government (USG) departments and agencies for the security of National Security Systems (NSS).

In April 2012, DoD formed a Technical Working Group (TWG) and undertook the task of creating the first CNSSI 1253 ICS-PIT Overlay:

"Security control overlays are specifications of security controls and supporting guidance used to complement the security control baselines and parameter values in the Committee on National Security Systems Instruction (CNSSI) No. 1253 and to complement the supplemental guidance in the NIST SP 800-53. Organizations select and apply CNSSI No. 1253 security control overlays by using the guidance in each of the standardized, approved and CNSS-published overlays."

The TWG delivered the first ICS-PIT Overlay to the CNSS in January, 2013, after extensive collaboration among 65 representatives spanning DoD, DHS and numerous agencies. The Overlay is both a "primer," with a standard architecture and layers diagram, and a pictorial of typical devices, sensors and actuators that enable the I&E, IT and Information Assurance (IA) staff in the field to identify and understand the operational protocols (Modbus, LonTalk, etc.), network ports, and connections.

CNSSI 1253 ICS Overlay Enclave Authorization Boundary and Layers

Figure 13: CNSSI 1253 ICS Overlay Enclave Authorization Boundary and Layers

The initial ICS-PIT Overlay was DoD-centric and used DoD specific parameters, and was issued as an informational and training document, and was included in the CSET 5.1 release. About the same time, working with the NIST SP 800-82R2 writing team, much of the material from the CNSSI ICS Overlay was incorporated into the update to 800-82, to include the new section 2.5 Other Types of Control Systems. With the release of NIST 800-53 R4 and NIST SP 800-82 R2, the CNSSI ICS Overlay is now obsolete and should not be used.

Handbook for Self-Assessing Security Vulnerabilities & Risks of Industrial Control Systems on DoD Installations

This handbook (PDF) was developed by the Air Force 346th Test Squadron, 262nd Network Warfare Squadron, Idaho National Laboratory and other stakeholder agencies in response to the need to address the lack of field guidance for ICS cybersecurity. The Department of Defense (DoD) Components and Agencies are encouraged to use this handbook to help establish a risk management framework to identify and prioritize mission-related vulnerabilities and risks that may be exposed or created by network connectivity to Industrial Control Systems (ICS). Installations & Environment (I&E)-related ICS include computer hardware, software, and associated sensors and controllers used to monitor and/or control real property, such as on-installation electricity, water, wastewater, natural gas, airfield lighting and petroleum systems. It also includes building heating and air conditioning equipment, lighting, fire and life safety systems. Supervisory Control and Data Acquisition Systems (SCADA), Distributed Control Systems (DCS), Energy Management Control Systems (EMCS) are also types of ICS.

Additional DoD ICS, facility, and building related cybersecurity information can also be found on the Installations & Environment Business Enterprise Integration office website.


There are many tools and methods that can be used to identify building control systems that are exposed on the internet. One of the most powerful is Shodan. Figure 14 illustrates a search for Tridium which shows the IP address, protocol, organization, location, application software, firmware and other details. Figure 15 illustrates a search for Distech, which shows the building controller connecting through the Tridium servers and also displays the devices ID's, operating system, MD5 Hash, and Host ID's.

Shodan Search Results for Tridium Products

Figure 14: Shodan Search Results for Tridium Products

Shodan Search Results for Distech Products

Figure 15: Shodan Search Results for Distech Products

In the majority of these cases, clicking on the IP will open the login to the operator console as shown in Figure 16. In many cases, the browser is using an unencrypted http port 80, rather than encrypted https port 443, meaning the login credentials are being sent as open text across the internet. Organizations should not expose their Building Control Systems to direct internet connections; they should be in a DMZ, separated from the IT systems, and require a VPN connection.

Direct Internet Connection To Johnson Controls Facility Explorer Login

Figure 16: Direct Internet Connection To Johnson Controls Facility Explorer Login

Other tools include Wireshark, NexDefense Sophia, NSA GrassMarlin, SamuraiSTFU, and Kali Linux.

Major Resources


Operations and Maintenance (O&M)

Computerized Maintenance Management Systems (CMMS)

Federal Agencies

Cyber Threats





Training Courses


  • "Cybersecurity of Buildings Workshop" – Jan. 28, 2014
    Focus was on the recently released draft DHS ISC Converged Systems White Paper document, GSA Smart Buildings program, and the NIST SP 800-82 Guide to Industrial Control Systems Security. This workshop built on the Cybersecurity of Building track listed below. The purpose of the Workshop was to bring the engineering, security, IT and IA communities together to build on current initiatives to create a common architecture and joint publications to develop defense in depth, continuous monitoring, incident response and recovery, and information sharing CONOPS for ICS and Converged Systems. Download materials and presentations. (ZIP 19 MB)
  • "Cybersecurity of Buildings Workshop: OT and IT Convergence - A New Paradigm". Building Innovation 2014: The National Institute of Building Sciences Annual Conference & Expo – Jan. 6, 2014.
  • "Cybersecuring Facilities and Facilities Systems". National Academy of Sciences (NAS) Federal Facilities Council (FFC) – May 2015.


1 Courtesy of Fred E. Abbitt, CISSP-ISSEP, CSSA / Physical and Control System Security SME, Information Systems Engineering Command, Information Assurance and Security Engineering Directorate





6 Key metrics include: efficiency and sustainability, agility and flexibility, reliability and resilience, safety and security.

7 NIST Shyam Sunder Industrial Internet Workshop, March 2013

8 National Institute of Standards and Technology (NIST) Executive Roundtable on Cyber-physical Systems

9 NIST Shyam Sunder Industrial Internet Workshop, March 2013

10 NIST Shyam Sunder Industrial Internet Workshop, March 2013