工业自动化和控制系统安全 第2-1部分：IACS 资产所有者的安全计划要求

[中文适用范围]： IEC 62443 的这一部分规定了运行中的工业自动化和控制系统 (IACS) 的资产所有者安全计划 (SP) 政策和程序要求。本文件使用 IEC TS 62443‑1‑1 中所述的 IACS 构成的广泛定义和范围。在本文件中，资产所有者还包括 IACS 的运营商。 [外文原描述]： IEC 62443-2-1:2024 specifies asset owner security program (SP) policy and procedure requirements for an industrial automation and control system (IACS) in operation. This document uses the broad definition and scope of what constitutes an IACS as described in IEC TS 62443‑1‑1. In the context of this document, asset owner also includes the operator of the IACS. This document recognizes that the lifespan of an IACS can exceed twenty years, and that many legacy systems contain hardware and software that are no longer supported. Therefore, the SP for most legacy systems addresses only a subset of the requirements defined in this document. For example, if IACS or component software is no longer supported, security patching requirements cannot be met. Similarly, backup software for many older systems is not available for all components of the IACS. This document does not specify that an IACS has these technical requirements. This document states that the asset owner needs to have policies and procedures around these types of requirements. In the case where an asset owner has legacy systems that do not have the native technical capabilities, compensating security measures can be part of the policies and procedures specified in this document. This edition includes the following significant technical changes with respect to the previous edition: a) revised requirement structure into SP elements (SPEs), b) revised requirements to eliminate duplication of an information security management system (ISMS), and c) defined a maturity model for evaluating requirements.