Requirements: Industrial Automation and Control Systems Network Classification: Internalaccording to IEC 62264-1:2013-05 clause 5.2.1, also known as the Purdue Architecture for IACS". The different levels can be seen in figure 1 below. Note the locations of the firewalls, and that it is generally permitted for control and service traffic to share the same physical network where necessary.The document also states some common requirements to computers used for engineering and monitoring purposes. This to ensure we utilize shared resources where applicable, increased standardization and simplify operation/maintenance of the equipment.Please note that additional requirements may apply as specified in other discipline technical requirement documents.If connectivity is needed between HIPPS/FWP/EmG to ensure monitoring and possible remote this may be solved by a control mechanism in a conduit.SR-77134 - The IACS networks shall support integrated security concepts as defined by TR1658.SR-86592 - The IACS network design shall safeguard aspects for facility operation, system independence, system performance and technology used.SR-86591 - Effort shall be made to share infrastructure within the individual physical infrastructures where possible based on risk assessments done. Requirements to the following needs to be maintained in the design:SR-76647 - Separate network management solutions customized to Company operational model shall be designed for:SR-86589 - The high availability networks design shall be limited to use the following network protocols in accordance with IEC 62439:• Parallel Redundancy Protocol (PRP) when zero fail over time is required• High-availability Seamless Redundancy (HSR) when zero fail over time is requiredSR-86756 - RSTP shall not be used as a network redundancy protocol in high availability networks, but may be used to add redundancy to equipment connection on edge switch ports.SR-92089 - Network edge switch ports (where Devices or Computers are connected) shall have BPDU guard enabled.SR-86588 - The networks shall have a high availability design when the data communicated is critical for safety or production, or if the connected networked component requires a high availability data link.SR-86587 - The networks shall have capacity to handle the data load for all operational modes. SR-77150 - The IACS networks shall be scalable with respect to capability and capacity. SR-77160 - The IACS networks shall be based on recognised open industry standards. SR-77459 - The IACS networks shall support Quality of Service (QoS) functionality. SR-86585 - The networks shall support Virtual Local Area Network (VLAN) functionality.SR-77669 - The IACS networks shall prioritise IACS dependent data traffic over non-dependent data traffic if deployed on a shared physical network infrastructure.SR-86586 - The IACS networks design shall protect the networked components from unwanted network traffic whererelevant. SR-77163 - The IACS networks shall be able to distribute time to networked components. SR-77648 - Time in redundant network configurations shall be sourced from redundant Real Time Clocks. SR-77133 - The IACS networks shall support end-to-end connectivity for management data where required.SR-79218 - The network IP plan shall be pre-approved by Company.SR-78009 - Computers, except server hardware used for virtual hosts, shall not be connected to different networks by- passing installed firewalls.SR-91917 - Server hardware used for virtual hosts shall not be connected across different Purdue levels.SR-86593 - If encrypted data links are used between networks on different levels, the traffic shall be decrypted before entering end-point firewalls with DPI and IDS enabled.SR-86697 - The IACS systems shall be designed so that the use of (Supplier) laptops and similar portable computers is not required for configuration, operation or maintenance.SR-86696 - Software applications necessary for maintenance, configuration and parameterisation of the IACS systems shall be included and installed on Engineering work stations.SR-76646 - Data links shall be identified and classified in accordance with its consequence for facility safety, information security and production.The framework described in NOG 123 can be used for this assessment.SR-77911 - Cyber Security Risk assessment for the System under Consideration (SuC, ref TR1658) shall be done to identify the network infrastructure to be utilized.SR-86613 - Systems critical for facility safety or production shall not be dependent of the Level 3 Technical network to execute its function.SR-86612 - The Level 3 Technical core network layer shall have a fault tolerant design.A Level 3 Technical distribution network layer should be used where there is a need for aggregating network layers and provide unique connectivity services within a distribution network segment.SR-86617 - The Level 3 Technical network shall provide distribution, policy control, and isolation points between the network segment and the rest of the IACS networks.SR-86616 - The Level 3 Technical network shall have a fault tolerant design towards the core or distribution network.SR-86615 - The Level 3 Technical network shall be connected to a high availability firewall solution in the Company secure access solution for secure data traffic within and to/from the network.SR-77773 - The Level 3 Technical network components shall be compatible and integrated with Company centralisedSR-86626 - The Level 2 SAS control edge switches shall have a high availability design towards the core network.SR-86620 - Systems critical for facility safety or production shall not be dependent of the Level 2 Technical network to execute its function.SR-86619 - The Level 2 Technical core network layer shall have a fault tolerant design.A Level 2 Technical distribution network layer should be used where there is a need for aggregating network layers and provide unique connectivity services within a distribution network segment.SR-86623 - The Level 2 Technical network shall have a fault tolerant design towards the core or distribution network.SR-86622 - The Level 2 Technical network shall have a high availability firewall solution installed to restrict data traffic within and to/from the network.SR-86636 - Systems critical for facility safety or production shall not be dependent of the Level 3 SAS network to execute its function.SR-86635 - The Level 3 SAS core network layer shall have a fault tolerant design.SR-86634 - The Level 3 SAS network shall provide distribution, policy control, and isolation points between the network segment and the rest of the network.SR-86633 - The Level 3 SAS network shall have a fault tolerant design towards the core network.SR-86632 - The Level 3 SAS network shall have a high availability firewall solution installed for secure data traffic within and to/from the network.SR-86631 - The Level 2 SAS HMI core network layer shall have a high availability design. SR-86627 - The Level 2 SAS HMI edge switches shall have a high availability design towards the core network.The Level 2 SAS control networks should be used for controller to controller data traffic and to provide network connection to solutions in the Level 2 SAS network and Level 1 SAS field networks.SR-86625 - The Level 2 SAS control core network layer shall have a high availability design.SR-77672 - PRP field networks shall have a dual star design as indicated in the figure below.SR-86639 - The Level 1 SAS field networks layer shall have a high availability design.SR-86644 - A SAS Level 1 field distribution network layer shall be used where there is a need for aggregating network layers and provide unique connectivity services within a distribution network segment.SR-86643 - Where independent A and B cable routing is required, separate Level 1 SAS core network switches shall be used.SR-86642 - The Level 1 SAS PCS field networks shall have a redundant firewall solution installed for enabling secure data links between the field devices and the management solutions.SR-86687 -The level 1 IEC 61850 network shall use PRP, specified in Clause 4 of IEC 62439-3:2012, both for Station Bus and (if implemented) Process Bus.SR-78573 - Non-SAS logic solvers in Class 2 packages, which use the field network to communicate to e.g. MCCs, shall have separate VLANs for this purpose.SR-78572 - Level 2 Technical network traffic shall be in separate VLANs to the SAS VLANs, where the device supports this.Figure 2 Diagram showing principle of locating the two PRP hubs physically separateSR-78496 - Devices and computers which does not support PRP shall be connected using a redbox. SR-78494 - Devices and computers shall be connected to a port on a switch.SR-78553 - If the SAS logic solver does not support PRP, one redbox shall be used for connecting PRP A and PRP B to the SAS A network, and another redbox shall be used for similar connection to the SAS B network.SR-78551 - Communication to Level 2 Technical network shall be done through a separate redbox.Control system Control system Note: both PRP A and B (orange and green) and redundant A and B (red and blue) are available to suit the control system.PRP A net PRP B net SAS A net SAS B net Service netSR-78030 - Software licenses shall be registered to Company and activated before project handover to operation.HV Switchboard A HV Switchboard B MV Switchboards A MV Switchboards B LV Switchboard A LV Switchboard BFigure 4 Principle drawing for IEC61850 station bus network topology using PRPlEDs should connect to the network using PRP, without the use of a redbox. SR-78543 - Switches used in IEC 61850 networks shall not enable write MMS support. SR-78542 - Where PTP is required, switches used in IEC 61850 networks shall support PTP.SR-83693 - The agreed official software version for all software components shall be available for installation before project handover to operation.SR-83695 - All agreed official software patches shall be installed before project handover to operation. SR-83692 - The operating system shall be of Long-term Support (LTS) version where available.SR-78482 - The network and networked equipment shall provide data for inventory, backup status, health and performance.Use of staging should be considered to avoid unnecessary exposure to external networks.SR-81821 - The message log monitoring software and protocols shall be based on recognised open standards.SR-78484 - The facility shall have a message log monitoring solution for capture and storage of message logs from all networked IACS.SR-78477 - The message log monitoring solution shall provide a secure interface for communicating message log data to other Company systems.SR-78478 - The message log monitoring solution shall be able to save all messages to files on a Company file share.SR-78464 - The message log monitoring solution shall include a historian module for capturing and storing time stamped equipment data.SR-78470 - The message log monitoring solution shall as a minimum provide the following information:SR-81838 - The management software shall include a module for capturing changes to the hardware configuration, back- up the configurations and ability to load them to the hardware component.SR-81837 - It shall be possible to recover configuration data on the management software from backups.Requirements: Industrial Automation and Control Systems Network Classification: InternalSR-86601 - The system shall support different levels of user access rights to prevent unauthorised access to system and application software.SR-86600 - The system shall have a role-based access allowing assignment of users/user groups to roles.SR-86599 - It shall be possible to configure the access roles to limited parts of the system and/or limited parts of the application software.SR-86598 - The identity and access management software shall include functionality for cyber security controls including audit controls. As a minimum the following are to be included:SR-86605 - The project shall in due time get a final acceptance from Company on the network equipment and computer hardware standardisation chosen.SR-79188 - Replacement of redundant hardware components shall be possible during normal operation, without any loss of functionality or production.SR-86604 - The network equipment and networked computers shall be able to export message logs including alarm and events (security events included).SR-86603 - The networked components shall support connectivity without need of extensive manual integration services. SR-86608 - The networked components shall communicate by the use of Ethernet. SR-86607 - All unused communication ports on network equipment and networked components shall be locked, disabled or protected by software means. If not possible through software, a physical port lock product shall be used.SR-86606 - The network equipment and networked components shall handle wire-speed network storms gracefully, i.e. network port may be shut down temporarily but shall automatically be re-enabled when the storm has ended.SR-86699 - Devices with a Ethernet service port; these shall be connected to the network. SR-78500 - Devices with a serial/USB service port; these shall be connected to the network using a serial/IP server.It is not necessary to connect multiple service ports if the functionality is already taken care of for the device.SR-78501 - Devices with only one network interface shall support both control and service traffic.solution, including a HMI panel from the user's work desk, for open/close of predefined firewall rulesets.5.2 Standardisation The network equipment for use in protected area should be from one manufacturer and of the same product family. The network equipment for use outside protected area should be from one manufacturer and of the same product family. SR-79191 - The client hardware shall be from one manufacturer and of the same product family within a system. SR-79186 - The server hardware shall be from one manufacturer and of the same product family within a system.SR-86610 - The network equipment and computer hardware shall be commercial of the shelf products that are suitable for its intended use.SR-79207 - The network equipment used in the core or distribution networks shall have minimum 1 Gigabit/s bandwidth on uplinks and edge ports.SR-79210 - The network equipment shall be able to be managed from the management software.SR-79212 - The network equipment shall do automatic startup with correct configuration without any user intervention after loss of power.SR-79209 - The network equipment’s configuration shall be available for online or offline upload after replacement of component.SR-81377 - Where redbox functionality is needed; the edge switch shall support redbox functionality.SR-78021 - The main firewall solutions at Level 3 Technical network, Level 3 SAS Technical network and Level 2 Technical network shall be redundant firewall cluster solutions with state synchronisation that support Deep Package Inspection (DPI) and Intrusion Detection System (IDS).SR-84565 - The management interface of the firewalls shall be protected. SR-86649 - The main firewall at Level 2 Technical network shall be integrated with an independent managed barrierSR-92429 - Virtual hardware allocation shall be in accordance to actual needs and have the capacity to handle predictedSR-77781 - Server hardware with server operating system shall be used as run-time environment when Level 2 or Level 3 application software demands for 24x7 operation.SR-77780 - Server hardware shall run a virtualisation environment. SR-78010 - Server hardware shall include a dedicated out-of-band management interface. SR-79217 - The server hardware shall have rack or DIN rail mount.SR-79216 - The server hardware shall be fault tolerant against disk failures and with automatic online recovery when replacing a disk.SR-79215 - The internal power supplies and fans in the server hardware shall be active redundant. SR-78032 - All application software with a demand for 24x7 operation installed in the server shall run as a service in the background, independently whether interface user is logged in or out to the applications.SR-77782 - Clients shall run as bare metal installation, no virtualisation required.The client hardware may be removed if the system solves the same with a virtual computer as part of a Server hardware.SR-78012 - A dedicated physical network port shall be used in the server hardware for connecting the Hypervisor management interface to the relevant management system.SR-92430 - If a Hypervisor cluster is installed for redundancy, redundancy on management shall be implemented according to best practice from the applicable Hypervisor vendor.SR-78008 - Virtual machines shall be supplied in Open Virtualization Format (OVF) if the virtual machine is to be implemented on a Hypervisor from another delivery.SR-78007 - All virtual disks shall be thick provisioned Lazy zeroed. Thick provisioned Eager zeroed virtual disks may be used if vendor application requires it.procedure for update and scanning shall be made and executed.SR-78023 - The provisioning of the new device shall be done using applications on the EWS.SR-78027 - The provisioning procedure shall include enabling of ports, configuring IP addresses and other details necessary for the new device to be inserted into the network and receive its main configuration from the EWS.SR-78026 - Initial configuration using a network cable shall be preferred over USB.SR-78033 - Larger infrastructures (e.g. SAS) shall provide their own internal backup solution which may utilize the shared facility solution for offline backup.SR-78036 - To reduce the amount of data being synchronized to onshore centralized storage for offsite backup, systems shall use block level backup rotation when offline backup is copied to the shared facility solution.SR-79219 - The components configuration shall be available for online or offline upload after replacement of equipment.SR-78786 - To ensure the integrity of the delivered system before connecting it to the network a Cyber SecurityA conduit can be a single service (i.e., a single Ethernet network) or can be made up of multiple data carriers (multiple network cables and direct physical accesses). As with zones, it can be made of both physical and logical constructs. Conduits may connect entities within a zone or may connect different zones.As with zones, conduits may be either trusted or untrusted. Conduits that do not cross zone boundaries are typically trusted by the communicating processes within the zone. Trusted conduits crossing zone boundaries must use an end-to- end secure process.Untrusted conduits are those that are not at the same level of security as the zone endpoint. In this case the security of the communication becomes the responsibility of the individual channel. Further information on this scenario is available in the Annex.A conduit regulates communication between one or more devices in the same security zone or different security zones. A conduit within a security zone could be the control center LAN. A conduit between two zones could be the WAN connection between the primary and backup control centers. Conduits can be trusted or untrusted. Each conduit is assigned a security level.Data Representation of facts, concepts, or instructions in a manner suitable for communication, interpretation, or processing by humans or by automatic means. (Source: ISO/IEC/IEEE 24765:2017).Data link Means of connecting one networked device to another for the purpose of transmitting and receiving digital information.Devices Devices, also referred to as “Embedded Devices”, are components such as (but not limited to) PLCs, VSD controllers, Motor starters, Thyristor controllers, Flow computers, lEDs, Serial servers, Communication devices, Advanced analysers etc.A “Device” is basically any configurable I programmable Component which is not considered a “Computer” or “Network Equipment”.Note that Windows CE (Compact Embedded), or Windows loT Core, are not considered general-purpose Operating Systems. Components running these operating systems (typically local HMI Panels) are considered “Devices”.Distribution network layer The distribution layer aggregates the uplinks from the edge (also called access) layer to the core network layer. See "Network distribution switch".End user In product development, an end user (sometimes end-user) is a person who ultimately uses or is intended to ultimately use a product. The end user stands in contrast to users who support or maintain the product.Engineering Work Station The maintenance stations for industrial control systems where system management and application software engineering,Firewall A network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted internal network and untrusted external network. (Source; Wikipedia)High Availability A characteristic of a system, which aims to ensure an agreed level of operational performance, usually uptime, for a higher than normal period. (Source; Wikipedia)Human-Machine Interface (HMI) Provides the physical interface between technical systems and the personnel operating and maintaining the production facility, e.g. operator stations, large screen displays, critical action panels present in control rooms, local control panels and engineering work stations.Hypervisor A hypervisor is a computer software, firmware or hardware that creates and runs virtual machines. A computer on which a hypervisor runs one or more virtual machines is called a host machine, and each virtual machine is called a guest machine. The hypervisor presents the guest operating systems with a virtual operating platform and manages the execution of the guest operating systems. Multiple instances of a variety of operating systems may share the virtualized hardware resources. (Source; Wikipedia)Intelligent electronic device (IED) Microprocessor-based controllers of power system equipment, such as circuit breakers, transformers and capacitor banks. lEDs receive data from sensors and power equipment and can issue control commands, such as tripping circuit breakers if they sense voltage, current, or frequency anomalies, or raise/lower voltage levels in order to maintain the desired level.May Indicates a course of action permissible within the limits of the document. (Source: Company Management system)Network equipment Electronic devices which are required for communication and interaction between devices on a computer network, also known as Networking hardware, e.g. switches, firewalls, routers, etc. (Source; Wikipedia)Network equipment management Services provided include fault analysis, performance management, provisioning of networks/network equipment and maintaining quality of service.Network core switch A core switch is a high-capacity switch generally positioned within the backbone or physical core of a network. Core switches provide the final aggregation point for the network and allow multiple aggregation modules to work together. The core is designed to be highly reliable and stable to aggregate all the elements in the operational facility, typically Layer 3 (ISO/IEC 7498) devices, with high speed connectivity, redundant links, and redundant hardware.Network distribution switch The distribution layer in provides policy-based connectivity and demarcation between the access layer and the core layer. In small-to-medium size networks, it is possible to collapse the core into the distribution switches.Network edge switch The edge switch (also called access switch) provides the demarcation between the network infrastructure and the devicesthat leverage that infrastructure. As such, it provides a security, QoS, and policy trust boundary. When looking at the overall IACS network design, the edge switch provides the majority of these access layer services and is a key element in enabling multiple IACS network services.Network message log server In computing, a log file is a file that records either events that occur in an operating system or other software runs, ormessages between different users of a communication software. Logging is the act of keeping a log. In the simplest case, messages are written to a single log file. Many operating systems, software frameworks and programs include a logging system. A widely used logging standard is syslog. The Network message log server provides storage of syslog messages I SNMP traps with functionality like forwarding, filtering, analysis etc.Network Time Protocol (NTP) Protocol used to synchronize clocks throughout a computer network, defined in RFC documents. The current protocol is version 4 (NTPv4), which is a proposed standard as documented in RFC 5905. It is backward compatible with version 3, specified in RFC 1305.Operator station HMI equipment where the operator can perform control and monitoring. One or more operator stations will form an operator workplace.Protected area This term is used to address location of non-explosion protected safety critical equipment such that the probability of gas exposure to ignition sources or damage is as low as reasonably practicable. Such equipment will be protected long enough to carry out safety functions. Such locations should be in the accommodation or in utility area close to the accommodation area. Probability for exposure of equipment within the enclosure to gas releases at 20% LEL, typically 10-4 per year or less. Special provisions, e.g. gas detection and means for isolating ignition sources, may be required. (Source: TR1055 v9.0)Precision Time Protocol (PTP) Protocol used to synchronize clocks throughout a computer network, defined in IEEE 1588 v2.Quality of Service (QoS) QoS refers to traffic prioritization and resource reservation control mechanisms rather than the achieved service quality. QoS is the ability to provide different priority to different applications, users, or data flows, or to guarantee a certain levelof performance to a data flow. (Source; Wikipedia)Short form for Redundant Box. A network switch with PRP functionality, used in IEC 61850 networks, for connecting single attached devices to a PRP network.Redundancy The presence of auxiliary equipment in a system to perform the same or similar functions as other elements for the purpose of preventing or recovering from failures. (Source: ISO/IEC/IEEE 24765:2017)Real Time Clock (RTC) A computer clock (most often in the form of an integrated circuit) that keeps track of the current time. (Soruce; Wikipedia)SAS Control class 2 Control and/or monitoring functions are partially integrated into SAS. Non-SAS control equipment are either directly connected to SAS network or interfaced to other SAS equipment via communication link. Systems and equipment under control are operated and monitored through SAS HMI following SAS HMI standard for uniform operation.SAS Control class 3 Control and monitoring functions are not integrated in SAS. No interface to SAS is required, however supervisory controlor monitoring from SAS HMI could be applied. Systems and equipment under control are operated and monitored through stand-alone HMI.Scalability The degree to which a system can have its capacities adjusted to meet system requirements. (Source: O-PAS™ Standard - Glossary and Abbreviations:2019)message is labeled with a facility code, indicating the software type generating the message, and assigned a severity level. May be uses for system management and security auditing as well as general informational, analysis, and debugging messages.System A set of elements and of relations between the elements such that the set may be looked at as a whole. (Source: ISO 5127/1)System under Consideration (SuC) System Under Consideration. IEC62443 term.Thick provisioning In virtual storage, thick provisioning is a type of storage allocation in which the amount of storage capacity on a disk is pre-allocated on physical storage at the time the disk is created.Variabel Speed Drive (VSD) A type of adjustable-speed drive used in electro-mechanical drive systems to control AC motor speed and torque by varying motor input frequency and voltage. (Source; Wikipedia)Requirements: Industrial Automation and Control Systems Network Classification: InternalZone A security zone is a logical grouping of physical, informational, and application assets sharing common security requirements.A security zone has a border, which is the boundary between included and excluded elements. Zones may be considered to be trusted or untrusted. The standard requires a minimum of three security levels for security zones: high, medium and low. Other Parts of the IEC62443 standard will define administrative and technical requirements for these security levels.cc Control Class CPU Central Processing Unit EmG Emergency Generator EPU Equipment Package Unit EWS Engineering Work Station FW Firewall FWP Firewater Pump HMI Human Machine Interface IACS Industrial Automation and Control System IED Intelligent Electronic Device IP Internet Protocol MMS Manufacturing Message Specification NTP Network Time Protocol PCS Process Control System PRP Parallel Redundancy Protocol PTP Precision Time Protocol QoS Quality of Service RTC Real Time Clock SAS Safety and Automation SystemVLAN Virtual Local Area Network VSD Variabel Speed Drive