This page contains document links to Construction Criteria Base


By Michael Chipley PhD, PMP, LEED AP, The PMC Group LLC

Last updated: 10-23-2014


Industrial Control Systems (ICS) are physical equipment oriented technologies and systems that deal with the actual running of plants and equipment, include devices that ensure physical system integrity and meet technical constraints, and are event-driven and frequently real-time software applications or devices with embedded software. These types of specialized systems are pervasive throughout the infrastructure and are required to meet numerous and often conflicting safety, performance, security, reliability, and operational requirements. ICSs range from building environmental controls (HVAC, lighting), to systems such as the electrical power grid. With the increasing interconnectivity of ICS to the internet, the ICS can be an entry point into the organization's other IT systems.

Within the controls systems industry, ICS systems are often referred to as Operational Technology (OT) systems. Historically, the majority of OT systems were proprietary, analog, vendor supported, and were not internet protocol (IP) enabled. Systems key components, such as Remote Terminal Units (RTUs), Programmable Logic Controllers (PLCs), Physical Access Control Systems (PACs), Intrusion Detection Systems (IDSs), closed circuit television (CCTV), fire alarm systems, and utility meters have become digital and IP enabled. OT systems use Human Machine Interfaces (HMIs) to monitor the processes, versus Graphical User Interfaces for IT systems. Most current ICS systems and subsystems are now a combination of Operational Technologies (OT) and Information Technologies (IT).

The Stuxnet, Duqu, Flame and Shamoon malware were specifically designed to target ICS and cause physical damage to the processes or equipment. Stuxnet "spoofed" the integrity of the uranium centrifuges and caused the centrifuges to overspin and self-destruct, while the operators console showed the system was operating within normal parameters. The Duqu malware looks for information that could be useful in attacking industrial control systems. Its purpose is not to be destructive; the known components are trying to gather information. The Flame malware looks for engineering drawings, specifications, and other technical details about the systems and records audio, screenshots, keyboard activity, and network traffic. The program also records Skype conversations and can turn infected computers into Bluetooth beacons which attempt to download contact information from nearby Bluetooth-enabled devices. The most recent malware attack, Shamoon, destroyed over 30,000 Saudi Armco work stations. Shamoon is capable of spreading to other computers on the network, through exploitation of shared hard drives. Once a system is infected, the virus continues to compile a list of files from specific locations on the system, erase and then send information about these files back to the attacker. Finally, the virus will overwrite the master boot record of the system to prevent it from booting as shown in Figure 1.

screenshot of the Shamoon malware showing its ability to overwrite the master boot record of a computer

Figure 1: The Shamoon malware has the ability to overwrite the master boot record of a computer. Image credit: Securelist

In February 2013, Executive Order Improving Critical Infrastructure Cybersecurity was issued which requires the National Institute of Standards and Technology (NIST) to "lead the development of a framework to reduce cyber risks to critical infrastructure (the "Cybersecurity Framework"). The Cybersecurity Framework shall include a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks. The Cybersecurity Framework shall incorporate voluntary consensus standards and industry best practices to the fullest extent possible.

While federal agencies have been required to meet stringent Cybersecurity standards for the traditional IT systems since the Federal Information Security Management Act (FISMA) was passed in 2002, the same level of protection and analysis is just beginning to be developed for building control systems. Buildings are becoming increasingly reliant on technologies that allow centralized monitoring and control of multiple building systems ( Building Automation, Fire and Life Safety, Energy Management, Physical Security, Access Control, etc.), to assist in accomplishing design and operational goals. Because of the unique operating and configuration of building control systems, traditional IT processes such as continuous monitoring, host based scanning, and automated patch management can cause building control systems to fail or become non-operational.

This section will provide an overview of the current efforts underway with regards to policy, standards, guides, and tools to assist building owners and operators, designers, and constructors meet the Cybersecurity challenges.


Industrial Control Systems and Operational Technology

Within the controls systems industry, Industrial Control Systems (ICS) are often referred to as Operational Technology (OT). ICS are physical equipment oriented technologies and systems that deal with the actual running of plants and equipment, include devices that ensure physical system integrity and meet technical constraints, and are event-driven and frequently real-time software applications or devices with embedded software. These types of specialized systems are pervasive throughout the infrastructure and are required to meet numerous and often conflicting safety, performance, security, reliability, and operational requirements. NIST SP 800-53 Rev. 3 Appendix I defines ICS as:

"information systems that differ significantly from traditional administrative, mission support, and scientific data processing information systems. ICS typically have many unique characteristics—including a need for real-time response and extremely high availability, predictability, and reliability. These types of specialized systems are pervasive throughout the critical infrastructure, often being required to meet several and often conflicting safety, operational, performance, reliability, and security requirements such as: (i) minimizing risk to the health and safety of the public; (ii) preventing serious damage to the environment; (iii) preventing serious production stoppages or slowdowns that result in negative impact to the Nation's economy and ability to carry out critical functions; (iv) protecting the critical infrastructure from cyber attacks and common human error; and (v) safeguarding against the compromise of proprietary information."

The term ICS is used in its broadest sense which includes:

  • Supervisory Control and Data Acquisition (Energy, Water, Wastewater, Pipeline, Airfield Lighting, Locks, and Dams, etc.)
  • Distributed Control Systems (Process and Manufacturing, etc.)
  • Building Control Systems/Building Automation Systems
  • Utility Management Control Systems
  • Electronic Security Systems
  • Fire, Life Safety, Emergency Management Systems
  • Exterior Lighting and Messaging Systems
  • Intelligent Transportation Systems

Within the Department of Defense, there are over 30 unique types of ICS as shown in Figure 2. There are an estimated 2.5 million unique ICS systems that are used in over 300,000 buildings and over 250,000 linear structures.

Examples of DoD OT and ICS systems and subsystems

Figure 2: Examples of DoD OT and ICS Systems and Subsystems1

The majority of these systems were historically proprietary, analog, vendor supported, and used direct serial, and/or wireless connection, and were not IP enabled. The systems components such as Remote Terminal Units, Programmable Logic Controllers, Physical Access Control, Intrusion Detection Systems, CCTV, fire alarm systems, and utility meters have long equipment life spans, and are typically designated as Operational Technology (OT) and Real Property Equipment.

ICSs differ significantly from traditional administrative, mission support and scientific data processing information systems, and use specialized software, hardware and protocols. ICS systems are often integrated with mainstream organizational information systems to promote connectivity, efficiency, and remote access capabilities. The "front end" portions of these ICSs resemble traditional information systems in that they use the same commercially available hardware and software components. While the majority of an ICS system still does not resemble a traditional information system (IS), the integration of the ICS's "front end" with IS introduces some of the same vulnerabilities that exist in current networked information systems.

As these systems and components became digital and IP enabled, the interconnects to the organization network and business systems began to expose the organization to exploits and significant vulnerabilities. Typically, there was not a clear line of demarcation where one system started and one ended, for example a EMCS meter could be on the utility SCADA system, or on the buildings BAS. A comparison of IT versus OT systems is provided in the table below:

Table 1—IT vs. OT Systems Comparison

 Information TechnologyOperational Technology
PurposeProcess transactions, provide informationControl or monitor physical processes and equipment
ArchitectureEnterprise wide infrastructure and applications (generic)Event-driven, real-time, embedded hardware and software (custom)
InterfacesGUI, Web browser, terminal and keyboardElectromechanical, sensors, actuators, coded displays, hand-held devices
OwnershipCIO and ITEngineers, technicians, operators and managers
ConnectivityCorporate network, IP-basedControl networks, hard wired twisted pair and IP-based
RoleSupports peopleControls machines

ICSs can have long life spans (in excess of 20 years) and be comprised of technology that while functional, do not have the same technology refresh cycle as the IT. This introduces two issues: first, depending upon the relative age and isolation of the system, there may not be a patch or upgrade path for components of the system, and second, attempting to patch the component or employing modern scanning methods might disrupt the system. ICSs have experienced complete system shutdown when an intrusion detection system (IDS) or host-based scanning system (HBSS) scan is performed on an otherwise operational ICS. For an ICS, updates should be delayed until after a thorough analysis of deployment impact has been completed. This might stretch out security update timeliness and require flexibility in security control compliance measurement and enforcement.

An ICS physical system can span many miles; for example, locks and dams, pipelines, electric transmission and distribution systems can have many non-contiguous components, and there are a number of protocols commonly used by ICSs to allow the devices to communicate both horizontally and vertically. A building use could use a number of protocols at the same time. Typical building protocols are:

  • LonWorks
  • BACnet
  • Modbus
  • DNP 3
  • Fox

These protocols were developed initially to ensure availability and reliability, and able to communicate down to the device level with small data transmission and verification. Many devices have embedded firmware with default passwords. The protocol organizations and vendors are now working to add additional security features on new systems while working on securing legacy systems.

Buildings can have a number of primary and secondary systems used to support the tenants and/or primary function of the building (office, hospital, warehouse, school, etc.).

Communications Network and Business Systems

The Communications Network and Business Systems include the Demarcation or Point of Entry where the external communications connect with the buildings internal network and include voice, data, video and multimedia information services, such as video conferencing and email. Typically the business systems are on a separate fiber high-speed backbone.

Building Management System (BMS)

The Building Management System provides automatic monitoring, interaction and management for electricity, ventilation, water supply, security and fire control to the building. A BMS typically manages the: Building Automation System (BAS), Electronic Security System (ESS), and the Fire and Life Safety System (FLS). For larger buildings and campuses, there will usually be a Building Operations Center (BOC), Security Operations Center (SOC), or Emergency Operations Center (EOC) that has engineering, O&M, security or emergency management personnel monitoring the BMS. In smaller buildings, there may only be a workstation and panels that alarm and report to an off-site BOC, SOC, or EOC.

Building Automation System (BAS)/Building Control System (BCS)

A building automation system (BAS) or Building Control Systems (BCS) is an example of a distributed control system. The control system is a computerized, intelligent network of electronic devices designed to monitor and control the mechanical, electronic, and lighting systems in a building. A building controlled by a BAS is often referred to as an Intelligent Building or a Smart Building.2

BAS core functionality keeps the building climate within a specified range, provides lighting based on an occupancy schedule, monitors system performance and device failures, and provides malfunction alarms (via email and/or text notifications) to building engineering/maintenance staff. The BAS functionality reduces building energy and maintenance costs when compared to a non-controlled building. The BAS typically consists of:

  • Fire and Life and Safety (FLS)
  • Physical Security and Access Control (PACS)
  • Energy Management Systems (EMS), which includes Lighting Control
  • Heating, Ventilation and Air Conditioning (HVAC)

A typical BAS architecture with multiple protocols is shown in Figure 3.

Typical BAS architecture

Figure 3: Typical BAS Architecture

Electronic Security System (ESSS)

The Electronic Security System (ESS) is critical for providing a secure environment and protecting the safety of tenants. Elements include: Anti-theft Security and Alarm System, Electronic Control System, Physical Access Control System, Closed-Circuit TV Surveillance System. The ESS is typically monitored by security personnel in the SOC.

Fire and Life Safety System (FLS)

The Fire and Life Safety (FLS) system consists of the fire alarms, sensors, sprinklers, smoke purge, and exhaust fans, and is often connected to the BAS to shutdown HVAC, elevators, and other equipment. The FLS typically connects to the local fire department and alarms in the SOC and BOC. Traditionally, these systems were in separate conduits and cabling went from the control panel to the devices.

Power over Ethernet

A new technology, Power over Ethernet (PoE)3, is changing the traditional cabling process and operations of the BMS. PoE describes any of several standardized or ad-hoc systems which pass electrical power along with data on Ethernet cabling. This allows a single cable to provide both data connection and electrical power to devices such as network hubs or closed-circuit TV cameras. Unlike standards such as Universal Serial Bus which also power devices over the data cables, PoE allows long cable lengths. Power may be carried on the same conductors as the data, or it may be carried on spare pairs of the cable. A BAS with PoE is shown in Figure 4.

A BAS using power over ethernet

Figure 4: A BAS using Power over Ethernet (Contemporary Controls4)

There are a number of new PoE devices and systems that are entering the market and addressing the cybersecurity of these systems will be a challenge. When legacy systems are being modernized and/or upgraded with PoE, understanding the network connections and ripple effects of loss of communications or power must be carefully analyzed as part of the Contingency Plan and Disaster Recovery/Business Continuity Plan.

Smart Buildings/Intelligent Buildings

A Smart Building or Intelligent Building project generally covers three key elements.5

  • Communications Network and Office Automation
  • Building Management System
  • Integrated Services Infrastructure

The GSA Public Building Service (PBS) has been an active leader in the development of Smart Buildings. In March 2011, the PBS issued the Technology Policy for PBS-Owned Building Monitoring and Control Systems memo, with the objective to "converge the building's Monitoring and Control (M&C) systems infrastructure to enable smarter and more efficient operations." The GSA Smart Building concept is shown in Figure 5.

GSA Smart Buildings Concept

Figure 5: GSA Smart Buildings Concept

The GSA Smart Buildings effort had three broad objectives:

  1. Open Communication Protocols—Non-proprietary building controls that give GSA greater building management flexibility and reduce service costs

  2. Converged Control Systems Networks (IT backbone)—Elimination of unnecessarily redundant controls infrastructure such as conduit, cables, switches, and UPS's that will then allow interoperability and security compliance

  3. Normalized Data for Systems Communications—Different controls manufacturers or even disparate systems can "talk" to each other allowing for data collection and analysis and more flexibility and management control

The resulting efforts are the convergence of the IT and OT into a new hybrid where the CIO provides the switches, routers and firewalls as Government Furnished Equipment (GFE), and all the building monitoring and control systems plug into the CIO fiber backbone in the distribution closet, as shown in Figure 6.

Converged building M&C connected in the distribution closet

Figure 6: Converged Building M&C Connected in the Distribution Closet

While the GSA Smart Buildings model may work for many organizations, many others may not want to have the ESS or FLS running on the same fiber as the BAS. The redundancy and operational impact of converged systems is still a relatively new area.

To help evaluate system interdependencies, GSA has developed the Sustainable Facilities Tool. A sustainable building can operate more efficiently and cost less when the impacts of systems on each other are considered. The system bundling section can be leveraged to further understand whole building synergies and explore examples for ideas on what technologies might best be bundled together.

Achieving the design and operational performance requires a substantial change in mindset and training across multiple disciplines, changes in acquisition and contract language, and changes in the buildings operations and maintenance. GSA has developed a revised delivery process and is in the process of updating the Public Building Services Facilities Standard 100. The new process is shown in Figure 7.

GSA Smart Buildings Life Cycle Approach

Figure 7: GSA Smart Buildings Life Cycle Approach

Smart buildings are now becoming the norm across the country, and as the buildings get ever smarter and interconnected with Smart Cars, Smart Cities, etc., they become vulnerable to outside attack and malware. As the IT and OT systems continue to converge, the need for new Cybersecurity skills and training for the facilities workforce will need to be developed.

Cyber-Physical Systems and the Critical Infrastructure Cybersecurity Framework

An emerging classification developed by the National Science Foundation and NIST is to classify the hybrid IT and OT as Cyber-Physical Systems (CPS). CPS are defined as integrated, hybrid networks of cyber and engineered physical elements; co-designed and co-engineered to create adaptive and predictive systems, and respond in real time to enhance performance.6 CPS reflect the advances in technology, similar to the shift that occurred going from the Industrial Revolution/Physical Systems to the Internet Revolution/Cyber Systems, and now transitioning to Industrial Internet Revolution/Cyber Physical Systems as shown in Figures 8 and 9.

CPS Timeline Contex

Figure 8: CPS Timeline Context7

CPS are enabling a new generation of 'smart systems'. NIST has taken an active role and lead in defining the CPS and has held several workshops, resulting in several publications in early 2013:

  • National Institute of Standards and Technology (NIST) Executive Roundtable on Cyber-physical Systems
  • National Institute of Standards and Technology (NIST) Executive Roundtable on Cyber-physical Innovation
  • National Institute of Standards and Technology (NIST) Executive Roundtable on Cyber-physical Systems Strategic R&D
  • National Institute of Standards and Technology (NIST) Industrial Internet Workshop, The Industrial Internet and Cyber-Physical Systems: A Government Perspective

Essential CPS characteristics include8:

  • Cyber, engineered, and human elements as treated as integral components of a total system to create synergy and enable desired, emergent properties
  • Integration of deep physics-based and digital world models provides learning and predictive capabilities for decision support (e.g., diagnostics, prognostics) and autonomous function
  • Systems engineering-based open architecture and standards provide for modularity and composability for customization, systems of products, and complex or dynamic applications
  • Reciprocal feedback loops between computational and distributed sensing/actuation and monitoring/control elements enables adaptive multi-objective performance
  • Networked cyber components provide a basis for scalability, complexity management, and resilience
CPS Common Core Context

Figure 9: CPS Common Core Context9

A comparison of the CPS systems and impacts across various sectors are provided in Table 2.

Table 2—Cyber-Physical Sector Context10

Innovative Products or ApplicationsCyber-Physical SystemsImpacts
Smart Manufacturing and Production
Agile manufacturingIntelligent controlsEnhanced global competitiveness
Supply chain connectivityProcess and assembly automationU.S.-based high tech manufacturing
 Robotics working safely with humansGreater efficiency, agility, and reliability
Transportation and Mobility
Autonomous or smart vehicles (surface, air, water, and space)Drive by wire vehicle systemsAccident prevention and congestion reduction (zero-fatality highways)
Vehicle-to-vehicle and vehicle-to-infrastructure communicationPlug ins and smart carsGreater safety and convenience of travel
 Interactive traffic control systems 
 Next-generation air transport control 
Electricity systemsSmart electric power gridGreater reliability, security, and diversity of energy supply
Renewable energy supplyPlug-in vehicle charging systemsIncreased energy efficiency
Oil and gas productionSmart oil and gas distribution grid 
Civil Infrastructure
Bridges and damsActive monitoring and control systemMore safe, secure, and reliable infrastructure
Municipal water and wastewater treatmentSmart grids for water and wastewaterAssurance of water quality and supply
 Early warning systemsAccident warning and prevention
Medical devicesWireless body area networksImproved outcomes and quality of life
Personal care equipmentAssistive healthcare systemsCost-effective healthcare
Disease diagnosis and preventionWearable sensors and implantable devicesTimely disease diagnosis and prevention
Buildings and Structures
High performance residential and commercial buildingsWhole building controlsIncreased building efficiency, comfort and convenience
Net-zero energy buildingsSmart HVAC equipmentImproved occupant health and safety
AppliancesBuilding automation systemsControl of indoor air quality
 Networked appliance systems 
Soldier equipmentSmart (precision-guided) weaponsIncreased warfighter effectiveness, security, and agility
Weapons and weapons platformsWearable computing/sensing uniforms 
Supply equipmentIntelligent, unmanned vehiclesDecreased exposure for human warfighters and greater capability for remote warfare
Autonomous and smart underwater sensorsSupply chain and logistics systems 
Emergency Response
First responder equipmentDetection and surveillance systemsIncreased emergency responder effectiveness, safety, efficiency, and agility
Communications equipmentResilient communications networksRapid ability to respond to natural and other disasters
Fire-fighting equipmentIntegrated emergency response systems 

NIST has developed a reference architecture shown in Figure 10 that:

CPS Reference Architecture

Figure 10: CPS Reference Architecture

  • Provides a common lexicon and taxonomy that can apply across CPS
  • Shows a common architectural vision to help facilitate interoperability between components and systems
  • Enables creation of reusable CPS components and tools to measure and evaluate their performance
  • Promotes communication across diverse stakeholder community
  • Provides a common lexicon and taxonomy that can apply across CPS
  • Shows a common architectural vision to help facilitate interoperability between components and systems
  • Enables creation of reusable CPS components and tools to measure and evaluate their performance
  • Promotes communication across diverse stakeholder community

The use of the CPS terminology and reference architecture will continue to be an evolving area.

National Institute of Standards and Technology Computer Security Resource Center

The NIST Computer Security Division, Computer Security Resource Center is where the standards and publications are maintained. NIST 800-53 Recommended Security Controls for Federal Information Systems and Organizations, and NIST 800-82 Guide to Industrial Control Systems (ICS) Security are used by most federal agencies as the baseline to evaluate their systems. Both publications were updated and published in spring 2013.

The STUXNET, FLAME, and other cyber attacks have shown how vulnerable the nation's ICS are. As the Smart Grid develops, enhanced security controls are being developed by NIST, to include the NISTIR 7628 Guidelines for Smart Grid Cyber Security, and the NIST Framework and Roadmap for Smart Grid Interoperability Standard, Release 2.0. Buildings that have Advanced Smart Metering and other web or wireless connections to the system should be secured and tested to ensure vulnerabilities are mitigated and risks minimized.

Department of Homeland Security ICS-CERT

The Department of Homeland Security Control Systems Security Program is part of the United States Computer Emergency Readiness Team (US-CERT) and provides tools, standards, training, and publications for ICS.

The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) works to reduce risks within and across all critical infrastructure sectors by partnering with law enforcement agencies and the intelligence community and coordinating efforts among Federal, state, local, and tribal governments and control systems owners, operators, and vendors. Additionally, ICS-CERT collaborates with international and private sector Computer Emergency Response Teams (CERTs) to share control systems-related security incidents and mitigation measures.

Similar to the advancement of the number of malicious malware and hacking of traditional IT systems, critical infrastructure (CI) is now a primary target and the number of ICS-CERT reported incidents is exponentially increasing.

Pie chart depicting vulnerablitilies by location in architecture

Figure 11: ICS Vulnerabilities reported to ICS-CERT by ISA 99 Layer

CSET is a desktop software tool that guides users through a step-by-step process to assess their control system and information technology network security practices against recognized industry standards. The output from CSET is a prioritized list of recommendations for improving the cybersecurity posture of the organization's enterprise and industrial control cyber systems. The tool derives the recommendations from a database of cybersecurity standards, guidelines, and practices. Each recommendation is linked to a set of actions that can be applied to enhance cybersecurity controls.

Screen shot of the DHS Cyber Security Evaluation Tool

Figure 12: DHS Cyber Security Evaluation Tool

CSET has been designed for easy installation and use on a stand-alone laptop or workstation. It incorporates a variety of available standards from organizations such as National Institute of Standards and Technology (NIST), North American Electric Reliability Corporation (NERC), International Organization for Standardization (ISO), U.S. Department of Defense (DoD), and others. When the tool user selects one or more of the standards, CSET will open a set of questions to be answered. The answers to these questions will be compared against a selected security assurance level, and a detailed report will be generated to show areas for potential improvement.

CSET provides an excellent means to perform a self-assessment of the security posture of your control system environment.

Department of Homeland Security Science and Technology

DHS S&T has developed several tools to assess the risk and resiliency of buildings, to include the cyber threat. The Integrated Rapid Visual Screening Tool, and the Owners Performance Requirement Tool assist building owners and operators evaluate the threats, vulnerabilities, and consequences and compare mitigation options.

Committee for National Security Systems ICS Overlay

The CNSS provides a forum for the discussion of policy issues, and is responsible for setting national-level Information Assurance policies, directives, instructions, operational procedures, guidance, and advisories for U.S. Government (USG) departments and agencies for the security of National Security Systems (NSS).

In April 2012, DoD formed a Technical Working Group (TWG) and undertook the task of creating the first CNSSI 1253 ICS-PIT Overlay:

"Security control overlays are specifications of security controls and supporting guidance used to complement the security control baselines and parameter values in the Committee on National Security Systems Instruction (CNSSI) No. 1253 and to complement the supplemental guidance in the NIST SP 800-53. Organizations select and apply CNSSI No. 1253 security control overlays by using the guidance in each of the standardized, approved and CNSS-published overlays."

The TWG delivered the first ICS-PIT Overlay to the CNSS in January, 2013, after extensive collaboration among 65 representatives spanning DoD, DHS and numerous agencies. The Overlay is both a "primer," with a standard architecture and layers diagram, and a pictorial of typical devices, sensors and actuators that enable the I&E, IT and Information Assurance (IA) staff in the field to identify and understand the operational protocols (Modbus, LonTalk, etc.), network ports, and connections.

CNSSI 1253 ICS Overlay Enclave Authorization Boundary and Layers

Figure 13: CNSSI 1253 ICS Overlay Enclave Authorization Boundary and Layers

The initial ICS-PIT Overlay was DoD-centric and used DoD specific parameters, but was formally adopted by the CNSS in March, 2013. The initial version will be included in the CSET 5.1 release as an informational and training document; scheduled for a summer 2013 release.

Recognizing the value of the ICS-PIT Overlay, the CNNS has requested that the Overlay be generalized and made applicable to all CNSS stakeholders. The Overlay is currently being modified, and is expected to be formally submitted to the CNSS committee in June of 2013, with an expected approval and release date of August or September ET 6.0 release with a target release date of November 2013.

Handbook for Self-Assessing Security Vulnerabilities & Risks of Industrial Control Systems on DoD Installations

This handbook (PDF) was developed by the Air Force 346th Test Squadron, 262nd Network Warfare Squadron, Idaho National Laboratory and other stakeholder agencies in response to the need to address the lack of field guidance for ICS cybersecurity. The Department of Defense (DoD) Components and Agencies are encouraged to use this handbook to help establish a risk management framework to identify and prioritize mission-related vulnerabilities and risks that may be exposed or created by network connectivity to Industrial Control Systems (ICS). Installations & Environment (I&E)-related ICS include computer hardware, software, and associated sensors and controllers used to monitor and/or control real property, such as on-installation electricity, water, wastewater, natural gas, airfield lighting and petroleum systems. It also includes building heating and air conditioning equipment, lighting, fire and life safety systems. Supervisory Control and Data Acquisition Systems (SCADA), Distributed Control Systems (DCS), Energy Management Control Systems (EMCS) are also types of ICS.

Additional DoD ICS, facility, and building related cybersecurity information can also be found on the Installations & Environment Business Enterprise Integration office website.

Major Resources


Operations and Maintenance (O&M)

Computerized Maintenance Management Systems (CMMS)

Federal Agencies

Cyber Threats




Training Courses


  • "Cybersecurity of Buildings Workshop" – Jan. 28, 2014
    Focus was on the recently released draft DHS ISC Converged Systems White Paper document, GSA Smart Buildings program, and the NIST SP 800-82 Guide to Industrial Control Systems Security. This workshop built on the Cybersecurity of Building track listed below. The purpose of the Workshop was to bring the engineering, security, IT and IA communities together to build on current initiatives to create a common architecture and joint publications to develop defense in depth, continuous monitoring, incident response and recovery, and information sharing CONOPS for ICS and Converged Systems. Download materials and presentations. (ZIP 19 MB)
  • "Cybersecurity of Buildings Workshop: OT and IT Convergence - A New Paradigm". Building Innovation 2014: The National Institute of Building Sciences Annual Conference & Expo – Jan. 6, 2014.
  • "Cybersecuring Facilities and Facilities Systems". National Academy of Sciences (NAS) Federal Facilities Council (FFC) – May 2015.


1 Courtesy of Fred E. Abbitt, CISSP-ISSEP, CSSA / Physical and Control System Security SME, Information Systems Engineering Command, Information Assurance and Security Engineering Directorate





6 Key metrics include: efficiency and sustainability, agility and flexibility, reliability and resilience, safety and security.

7 NIST Shyam Sunder Industrial Internet Workshop, March 2013

8 National Institute of Standards and Technology (NIST) Executive Roundtable on Cyber-physical Systems

9 NIST Shyam Sunder Industrial Internet Workshop, March 2013

10 NIST Shyam Sunder Industrial Internet Workshop, March 2013