信息技术.安全技术.能源公用事业行业特定的过程控制系统基于ISO/IEC 27002标准的安全管理指南

[中文适用范围]： 本指南的范围涵盖能源公用事业行业使用的过程控制系统，用于控制和监测电力、天然气和热力的产生、传输、存储和分配以及支持过程的控制。 这尤其包括以下系统、应用程序和组件： ——整体 IT 支持的集中式和分布式过程控制、监控和自动化技术以及用于其操作的 IT 系统，例如编程和参数化设备； ——数字控制器和自动化组件，例如控制和现场设备或PLC，包括数字传感器和执行器元件； ——过程控制领域中使用的所有进一步支持IT系统，例如用于补充数据可视化任务以及用于控制、监视、数据归档和文档目的； ——过程控制领域使用的整体通信技术，如网络、遥测、遥控应用和远程控制技术； ——数字计量和测量设备，例如用于测量能源消耗、发电或排放值； ——数字保护和安全系统，例如保护继电器或安全PLC； ——未来智能电网环境的分布式组件； ——上述系统上安装的所有软件、固件和应用程序。 [外文原描述]： ISO/IEC TR 27019:2013 provides guiding principles based on ISO/IEC 27002 for information security management applied to process control systems as used in the energy utility industry. The aim of ISO/IEC TR 27019:2013 is to extend the ISO/IEC 27000 set of standards to the domain of process control systems and automation technology, thus allowing the energy utility industry to implement a standardized information security management system (ISMS) in accordance with ISO/IEC 27001 that extends from the business to the process control level. The scope of ISO/IEC TR 27019:2013 covers process control systems used by the energy utility industry for controlling and monitoring the generation, transmission, storage and distribution of electric power, gas and heat in combination with the control of supporting processes. This includes in particular the following systems, applications and components: the overall IT-supported central and distributed process control, monitoring and automation technology as well as IT systems used for their operation, such as programming and parameterization devices; digital controllers and automation components such as control and field devices or PLCs, including digital sensor and actuator elements; all further supporting IT systems used in the process control domain, e.g. for supplementary data visualization tasks and for controlling, monitoring, data archiving and documentation purposes; the overall communications technology used in the process control domain, e.g. networks, telemetry, telecontrol applications and remote control technology; digital metering and measurement devices, e.g. for measuring energy consumption, generation or emission values; digital protection and safety systems, e.g. protection relays or safety PLCs; distributed components of future smart grid environments; all software, firmware and applications installed on above mentioned systems. Outside the scope of ISO/IEC TR 27019:2013 is the conventional or classic control equipment that is non-digital, i.e. purely electro-mechanical or electronic monitoring and process control systems. Furthermore, energy process control systems in private households and other, comparable residential building installations are outside the scope of ISO/IEC TR 27019:2013. Telecommunication systems and components used in the process control environment are also not directly part of the scope of ISO/IEC TR 27019:2013. These are covered by ISO/IEC 27011:2008.