信息安全、网络安全和隐私保护-能源公用事业行业的信息安全控制

[中文适用范围]： 本文件为能源公用事业行业提供基于ISO/IEC 27002:2022的信息安全控制，用于控制和监管电力、气体、石油和热量的生产和生成、传输、存储和分配，以及与相关支持过程的控制。具体包括但不限于以下内容：集中式和分布式的过程控制、监控和自动化技术及相关信息系统的操作，如编程和参数化设备；数字控制器和自动化组件，例如控制和现场设备或可编程逻辑控制器（PLC），包括数字传感器和执行器元件；在过程控制系统中使用的进一步支持信息系统，例如用于补充数据可视化任务以及控制、监控、数据存档、历史记录日志、报告和文档目的的信息系统；在过程控制系统中使用的通信技术，如网络、遥测、远程控制应用和远程控制技术；高级计量基础设施（AMI）组件，例如智能电表；测量设备，例如用于排放值的测量；数字保护和安全系统，例如保护继电器、安全PLC、紧急调节机制；能源管理系统，例如分布式能源资源（DER）、电动汽车充电基础设施以及私人家庭、住宅建筑或工业用户安装；智能电网环境中的分布式组件，例如在能源网络、私人家庭、住宅建筑或工业用户安装中；上述系统上安装的所有软件、固件和应用程序，例如配电管理系统（DMS）应用或故障检测系统（OMS）；容纳上述设备和系统的任何场所；上述系统的远程维护系统。本文件不适用于核设施的过程控制领域。该领域由IEC 63096涵盖。 [外文原描述]： This document provides information security controls for the energy utility industry, based on ISO/IEC 27002:2022, for controlling and monitoring the production or generation, transmission, storage and distribution of electric power, gas, oil and heat, and for the control of associated supporting processes. This includes in particular the following: — central and distributed process control, monitoring and automation technology as well as information systems used for their operation, such as programming and parameterization devices; — digital controllers and automation components such as control and field devices or programmable logic controllers (PLCs), including digital sensor and actuator elements; — all further supporting information systems used in the process control domain, e.g. for supplementary data visualization tasks and for controlling, monitoring, data archiving, historian logging, reporting and documentation purposes; — communication technology used in the process control domain, e.g. networks, telemetry, telecontrol applications and remote-control technology; — Advanced metering infrastructure (AMI) components, e.g. smart meters; — measurement devices, e.g. for emission values; — digital protection and safety systems, e.g. protection relays, safety PLCs, emergency governor mechanisms; — energy management systems, e.g. for distributed energy resources (DER), electric charging infrastructures, and for private households, residential buildings or industrial customer installations; — distributed components of smart grid environments, e.g. in energy grids, in private households, residential buildings or industrial customer installations; — all software, firmware and applications installed on above-mentioned systems, e.g. distribution management system (DMS) applications or outage management systems (OMS); — any premises housing the abovementioned equipment and systems; — remote maintenance systems for abovementioned systems. This document does not apply to the process control domain of nuclear facilities. This domain is covered by IEC 63096.