工业自动化和控制系统安全 第2-4部分：工业自动化和控制系统服务提供商的安全项目要求（IEC 62443-2-4:2023 等同采用）

[中文适用范围]： 本部分IEC 62443规定了自动化解决方案集成与维护活动中，工业自动化与控制（IACS）服务提供商可向资产所有者提供的安全相关流程的综合性要求。鉴于并非所有要求均适用于各行业的各类组织，第4.1.4小节规定了“配置（Profiles）”的制定方法，以便对上述要求进行子集选取。配置用于将本文档适配于特定环境，包括非基于IACS的环境。 [外文原描述]： IEC 62443-2:2023 specifies a comprehensive set of requirements for security-related processes that IACS service providers can offer to the asset owner during integration and maintenance activities of an Automation Solution. Because not all requirements apply to all industry groups and organizations, Subclause 4.1.4 provides for the development of "profiles" that allow for the subsetting of these requirements. Profiles are used to adapt this document to specific environments, including environments not based on an IACS. NOTE 1 The term "Automation Solution" is used as a proper noun (and therefore capitalized) in this document to prevent confusion with other uses of this term. Collectively, the security processes offered by an IACS service provider are referred to as its Security Program (SP) for IACS asset owners. In a related specification, IEC 62443-2-1 describes requirements for the Security Management System of the asset owner. NOTE 2 In general, these security capabilities are policy, procedure, practice and personnel related. Figure 1 illustrates the integration and maintenance security processes of the asset owner, service provider(s), and product supplier(s) of an IACS and their relationships to each other and to the Automation Solution. Some of the requirements of this document relating to the safety program are associated with security requirements described in IEC 62443-3-3 and IEC 62443-4-2. NOTE 3 The IACS is a combination of the Automation Solution and the organizational measures necessary for its design, deployment, operation, and maintenance. NOTE 4 Maintenance of legacy system with insufficient security technical capabilities, implementation of policies, processes and procedures can be addressed through risk mitigation.