2023-07-13T07:52:30+02:00 PScript5.dll Version 5.2.2 2026-04-08T10:07:09+02:00 Acrobat Distiller 23.0 (Windows) PScript5.dll Version 5.2.2 2023-07-13T07:52:30+02:00 2026-03-09T09:52:05+01:00 2026-04-08T10:07:09+02:00 application/pdf TR3033 Acrobat Distiller 23.0 (Windows) uuid:f1974c27-4f96-4621-be17-8b4fec245c7f uuid:67181d50-5d75-46a6-83f3-176776a87eab engines={image=false textcolor=true vector=false text=true} tetml={filename={D:\drim\repository\projects\drim_75_0\metadata\9\0\90fc516641ebed5a8a8166d93e025acc\90fc516641ebed5a8a8166d93e025acc.para.xml} elements={annotations=false bookmarks=false destinations=false fields=false javascripts=false} } granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Status: S t a t u s : Relevant R e l e v a n t Version: V e r s i o n : 1.0 1 . 0 Relevant R e l e v a n t versions: v e r s i o n s : ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l Requirements R e q u i r e m e n t s ÿ ÿ ÿ ÿ ÿ ÿ Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l &38$5ÿ'51ÿ"14# & 3 8 $ � 5 � ÿ ' � 5 � 1 ÿ " � � � 1 � 4 # !715ÿ"657ÿ5#4ÿ$54%4 ! 7 1 5 � ÿ " � 6 5 � 7 ÿ � � 5 # 4 ÿ � $ � 5 4 � � % � � 4 ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Project P r o j e c t development d e v e l o p m e n t TR3033 T R 3 0 3 3 Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0, 1 . 0 , Document D o c u m e n t replaces r e p l a c e s version v e r s i o n 0 0 • • 1.0 1 . 0 (2021-05-14 ( 2 0 2 1 - 0 5 - 1 4 17:42) 1 7 : 4 2 ) Page P a g e 1 1 of o f 23 2 3 ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Page P a g e 2 2 of o f 23 2 3 ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l 1.1 1 . 1 Objective O b j e c t i v e ............................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 4 1.2 1 . 2 Target T a r g e t group g r o u p ......................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 4 1.3 1 . 3 Provision P r o v i s i o n ............................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 4 2 2 Introduction I n t r o d u c t i o n ................................................................................................................................................................. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 4 3 3 Network N e t w o r k engineering e n g i n e e r i n g and a n d design d e s i g n ................................................................................................................................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 5 3.1 3 . 1 General G e n e r a l ................................................................................................................................................................. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 5 3.1.1 3 . 1 . 1 Criticality C r i t i c a l i t y assessment a s s e s s m e n t .................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 7 3.2 3 . 2 Level L e v e l 3 3 Technical T e c h n i c a l network n e t w o r k .................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 7 3.3 3 . 3 Level L e v e l 2 2 Technical T e c h n i c a l network n e t w o r k .................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 8 3.4 3 . 4 Level L e v e l 3 3 SAS S A S network n e t w o r k ............................................................................................................................................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 8 3.5 3 . 5 Level L e v e l 2 2 SAS S A S network n e t w o r k ............................................................................................................................................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 8 3.6 3 . 6 Level L e v e l 1 1 SAS S A S field f i e l d network n e t w o r k .................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 9 3.6.1 3 . 6 . 1 General G e n e r a l ......................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 9 3.6.2 3 . 6 . 2 Field F i e l d Network N e t w o r k traffic t r a f f i c segregation s e g r e g a t i o n ................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 9 3.6.3 3 . 6 . 3 PRP P R P field f i e l d networks n e t w o r k s ........................................................................................................................................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 9 3.6.3.1 3 . 6 . 3 . 1 Non-IEC N o n - I E C 61850 6 1 8 5 0 PRP P R P field f i e l d network n e t w o r k topology t o p o l o g y .......................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1 0 3.6.3.2 3 . 6 . 3 . 2 IEC I E C 61850 6 1 8 5 0 PRP P R P network n e t w o r k ....................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1 0 4 4 Software S o f t w a r e ....................................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1 1 4.1 4 . 1 General G e n e r a l ................................................................................................................................................................. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1 1 4.2 4 . 2 Equipment E q u i p m e n t message m e s s a g e logging l o g g i n g ................................................................................................................................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1 2 4.3 4 . 3 Message M e s s a g e log l o g monitoring m o n i t o r i n g software s o f t w a r e ........................................................................................................................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1 2 4.4 4 . 4 Management M a n a g e m e n t software s o f t w a r e .......................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1 2 4.5 4 . 5 Identity I d e n t i t y and a n d access a c c e s s management m a n a g e m e n t software s o f t w a r e ......................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1 3 5 5 Components C o m p o n e n t s ................................................................................................................................................................. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1 3 5.1 5 . 1 General G e n e r a l ................................................................................................................................................................. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1 3 5.2 5 . 2 Standardisation S t a n d a r d i s a t i o n ..................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1 4 5.3 5 . 3 Network N e t w o r k equipment e q u i p m e n t .............................................................................................................................................. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1 4 5.3.1 5 . 3 . 1 Firewalls F i r e w a l l s ......................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1 4 5.4 5 . 4 Computers C o m p u t e r s ........................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1 5 5.4.1 5 . 4 . 1 Servers S e r v e r s ........................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1 5 5.4.2 5 . 4 . 2 Clients C l i e n t s ........................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1 5 5.4.3 5 . 4 . 3 Virtual V i r t u a l computers c o m p u t e r s .......................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1 5 5.5 5 . 5 Provisioning P r o v i s i o n i n g of o f new n e w devices d e v i c e s / / replacement r e p l a c e m e n t of o f devices d e v i c e s ........................................................................................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1 6 6 6 Backup B a c k u p and a n d recovery r e c o v e r y ................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1 6 7 7 Testing T e s t i n g .......................................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1 6 7.1 7 . 1 Test T e s t during d u r i n g implementation i m p l e m e n t a t i o n .................................................................................................................................. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1 6 7.2 7 . 2 Test T e s t during d u r i n g commissioning c o m m i s s i o n i n g .................................................................................................................................. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1 6 8 8 Additional A d d i t i o n a l information i n f o r m a t i o n ................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1 6 Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l 8.1 8 . 1 Definition D e f i n i t i o n and a n d abbreviations a b b r e v i a t i o n s ................................................................................................................................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1 6 8.1.1 8 . 1 . 1 Definitions D e f i n i t i o n s ..................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1 6 8.1.2 8 . 1 . 2 Abbreviations A b b r e v i a t i o n s ................................................................................................................................................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2 2 8.2 8 . 2 Changes C h a n g e s from f r o m previous p r e v i o u s version v e r s i o n ............................................................................................................................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 2 3 8.3 8 . 3 References R e f e r e n c e s ........................................................................................................................................................... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 2 3 Page P a g e 3 3 of o f 23 2 3 ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Page P a g e 4 4 of o f 23 2 3 ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l 1 1 Objective, O b j e c t i v e , target t a r g e t group g r o u p and a n d provision p r o v i s i o n 1.1 1 . 1 Objective O b j e c t i v e The T h e objective o b j e c t i v e of o f this t h i s document d o c u m e n t is i s to t o define d e f i n e design d e s i g n requirements r e q u i r e m e n t s for f o r the t h e on-premise o n - p r e m i s e Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s (IACS) ( I A C S ) Ethernet-based E t h e r n e t - b a s e d networks, n e t w o r k s , and a n d technical t e c h n i c a l requirements r e q u i r e m e n t s for f o r network n e t w o r k and a n d client c l i e n t / / server s e r v e r equipment e q u i p m e n t used u s e d in i n IACS. I A C S . Many M a n y of o f the t h e requirements r e q u i r e m e n t s in i n this t h i s document d o c u m e n t will w i l l aid a i d compliance c o m p l i a n c e with w i t h TR1658. T R 1 6 5 8 . IACS I A C S covers c o v e r s in i n this t h i s context c o n t e x t all a l l networked n e t w o r k e d systems s y s t e m s installed i n s t a l l e d on-premise o n - p r e m i s e to t o facilitate f a c i l i t a t e the t h e production p r o d u c t i o n facility f a c i l i t y operations, o p e r a t i o n s , e.g. e . g . Industrial I n d u s t r i a l Control C o n t r o l Systems S y s t e m s (ICS), ( I C S ) , condition c o n d i t i o n monitoring m o n i t o r i n g systems, s y s t e m s , telecommunication t e l e c o m m u n i c a t i o n infrastructure, i n f r a s t r u c t u r e , operational o p e r a t i o n a l management m a n a g e m e n t systems, s y s t e m s , etc. e t c . For F o r modifications m o d i f i c a t i o n s to t o systems s y s t e m s in i n operation o p e r a t i o n some s o m e requirements r e q u i r e m e n t s in i n this t h i s document d o c u m e n t may m a y conflict c o n f l i c t with w i t h the t h e installed i n s t a l l e d solution. s o l u t i o n . Conflicts C o n f l i c t s are a r e to t o be b e assessed a s s e s s e d during d u r i n g the t h e front-end f r o n t - e n d engineering e n g i n e e r i n g phase, p h a s e , and a n d where w h e r e local l o c a l design d e s i g n will w i l l be b e maintained, m a i n t a i n e d , substitution/addendum s u b s t i t u t i o n / a d d e n d u m requirements r e q u i r e m e n t s should s h o u l d be b e made m a d e in i n accordance a c c o r d a n c e with w i t h TR0002 T R 0 0 0 2 “Management “ M a n a g e m e n t system s y s t e m principles”. p r i n c i p l e s ” . The T h e project p r o j e c t must m u s t identify i d e n t i f y whether w h e t h e r Company C o m p a n y provided p r o v i d e d items i t e m s should s h o u l d be b e utilized u t i l i z e d for f o r parts p a r t s of o f deliveries, d e l i v e r i e s , e.g. e . g . monitoring m o n i t o r i n g and a n d management m a n a g e m e n t software, s o f t w a r e , software s o f t w a r e licenses, l i c e n s e s , equipment e q u i p m e n t hardware h a r d w a r e etc. e t c . 1.2 1 . 2 Target T a r g e t group g r o u p The T h e target t a r g e t group g r o u p for f o r this t h i s document d o c u m e n t is i s personnel p e r s o n n e l that t h a t specify, s p e c i f y , engineer, e n g i n e e r , fabricate, f a b r i c a t e , install, i n s t a l l , maintain, m a i n t a i n , modify, m o d i f y , upgrade u p g r a d e or o r operate o p e r a t e IACS I A C S networks. n e t w o r k s . 1.3 1 . 3 Provision P r o v i s i o n Provision P r o v i s i o n is i s made m a d e in i n Company C o m p a n y Management M a n a g e m e n t System S y s t e m (TR3030 ( T R 3 0 3 0 “Automation, “ A u t o m a t i o n , Technical T e c h n i c a l requirements r e q u i r e m e n t s and a n d standards”). s t a n d a r d s ” ) . 2 2 Introduction I n t r o d u c t i o n The T h e IACS I A C S are a r e critical c r i t i c a l for f o r enabling e n a b l i n g a a safe, s a f e , efficient e f f i c i e n t and a n d sustainable s u s t a i n a b l e operation o p e r a t i o n of o f the t h e production p r o d u c t i o n facility, f a c i l i t y , and a n d therefore t h e r e f o r e have h a v e high h i g h demands d e m a n d s regarding r e g a r d i n g network n e t w o r k availability a v a i l a b i l i t y and a n d data d a t a integrity. i n t e g r i t y . Due D u e to t o the t h e IACS I A C S critical c r i t i c a l function f u n c t i o n they t h e y also a l s o are a r e a a high h i g h risk r i s k target t a r g e t for f o r cyber c y b e r threats. t h r e a t s . It I t is i s therefore t h e r e f o r e important i m p o r t a n t that t h a t the t h e network n e t w o r k design d e s i g n and a n d the t h e components c o m p o n e n t s used u s e d in i n the t h e network, n e t w o r k , enables e n a b l e s secure s e c u r e resilient r e s i l i e n t quality q u a l i t y network n e t w o r k services. s e r v i c e s . Figure F i g u r e 1 1 below b e l o w visualise v i s u a l i s e a a basic b a s i c network n e t w o r k architecture a r c h i t e c t u r e for f o r an a n upstream u p s t r e a m oil o i l & & gas g a s production p r o d u c t i o n facility f a c i l i t y that t h a t incorporate i n c o r p o r a t e security s e c u r i t y through t h r o u g h zones z o n e s and a n d conduits, c o n d u i t s , and a n d availability a v a i l a b i l i t y through t h r o u g h pre-defined p r e - d e f i n e d network n e t w o r k types. t y p e s . Note N o t e that t h a t additional a d d i t i o n a l conduits c o n d u i t s may m a y apply a p p l y based b a s e d on o n design d e s i g n choices c h o i c e s made. m a d e . Supervisory S u p e r v i s o r y monitoring m o n i t o r i n g and a n d network n e t w o r k management m a n a g e m e n t is i s a a prerequisite p r e r e q u i s i t e to t o enable e n a b l e an a n safe s a f e and a n d efficient e f f i c i e n t operation o p e r a t i o n of o f the t h e networks. n e t w o r k s . This T h i s requires r e q u i r e s standardisation. s t a n d a r d i s a t i o n . As A s such s u c h the t h e main m a i n strategy s t r a t e g y is i s to t o require r e q u i r e strong s t r o n g and a n d resilient r e s i l i e n t IACS I A C S network n e t w o r k infrastructure, i n f r a s t r u c t u r e , and a n d require r e q u i r e the t h e use u s e of o f firewalls, f i r e w a l l s , VLANs V L A N s and a n d QoS Q o S to t o protect p r o t e c t the t h e IACS I A C S components c o m p o n e n t s to t o the t h e greatest g r e a t e s t practical p r a c t i c a l degree d e g r e e from f r o m cyber c y b e r threats t h r e a t s and a n d disturbances d i s t u r b a n c e s in i n ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ the t h e network. n e t w o r k . Such S u c h a a strong s t r o n g network n e t w o r k infrastructure i n f r a s t r u c t u r e generally g e n e r a l l y requires r e q u i r e s managed m a n a g e d and a n d redundant r e d u n d a n t networks, n e t w o r k s , preferably p r e f e r a b l y with w i t h zero z e r o fail-over f a i l - o v e r time t i m e in i n case c a s e of o f a a network n e t w o r k failure f a i l u r e or o r network n e t w o r k maintenance. m a i n t e n a n c e . Each E a c h IACS I A C S device d e v i c e or o r computer c o m p u t e r is i s connected c o n n e c t e d directly d i r e c t l y to t o a a switch s w i t c h to t o allow a l l o w the t h e network n e t w o r k to t o control c o n t r o l the t h e traffic t r a f f i c going g o i n g to t o the t h e device. d e v i c e . In I n order o r d e r to t o ensure e n s u r e cyber c y b e r security s e c u r i t y and a n d the t h e integrity i n t e g r i t y of o f the t h e IACS I A C S system, s y s t e m , the t h e IACS I A C S network n e t w o r k infrastructure i n f r a s t r u c t u r e is i s structured s t r u c t u r e d Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} 6. 6 . Additional A d d i t i o n a l ICS I C S internal i n t e r n a l networks n e t w o r k s as a s required r e q u i r e d by b y system s y s t e m specific s p e c i f i c requirement r e q u i r e m e n t ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l according a c c o r d i n g to t o IEC I E C 62264-1:2013-05 6 2 2 6 4 - 1 : 2 0 1 3 - 0 5 clause c l a u s e 5.2.1, 5 . 2 . 1 , also a l s o known k n o w n as a s the t h e Purdue P u r d u e Architecture A r c h i t e c t u r e for f o r IACS". I A C S " . The T h e different d i f f e r e n t levels l e v e l s can c a n be b e seen s e e n in i n figure f i g u r e 1 1 below. b e l o w . Note N o t e the t h e locations l o c a t i o n s of o f the t h e firewalls, f i r e w a l l s , and a n d that t h a t it i t is i s generally g e n e r a l l y permitted p e r m i t t e d for f o r control c o n t r o l and a n d service s e r v i c e traffic t r a f f i c to t o share s h a r e the t h e same s a m e physical p h y s i c a l network n e t w o r k where w h e r e necessary. n e c e s s a r y . The T h e document d o c u m e n t also a l s o states s t a t e s some s o m e common c o m m o n requirements r e q u i r e m e n t s to t o computers c o m p u t e r s used u s e d for f o r engineering e n g i n e e r i n g and a n d monitoring m o n i t o r i n g purposes. p u r p o s e s . This T h i s to t o ensure e n s u r e we w e utilize u t i l i z e shared s h a r e d resources r e s o u r c e s where w h e r e applicable, a p p l i c a b l e , increased i n c r e a s e d standardization s t a n d a r d i z a t i o n and a n d simplify s i m p l i f y operation/maintenance o p e r a t i o n / m a i n t e n a n c e of o f the t h e equipment. e q u i p m e n t . Please P l e a s e note n o t e that t h a t additional a d d i t i o n a l requirements r e q u i r e m e n t s may m a y apply a p p l y as a s specified s p e c i f i e d in i n other o t h e r discipline d i s c i p l i n e technical t e c h n i c a l requirement r e q u i r e m e n t documents. d o c u m e n t s . 3 3 Network N e t w o r k engineering e n g i n e e r i n g and a n d design d e s i g n 3.1 3 . 1 General G e n e r a l SR-77004 S R - 7 7 0 0 4 - - The T h e following f o l l o w i n g physical p h y s i c a l IACS I A C S network n e t w o r k infrastructures i n f r a s t r u c t u r e s shall s h a l l be b e available a v a i l a b l e at a t the t h e facility: f a c i l i t y : 1. 1 . Level L e v e l 3 3 Technical T e c h n i c a l Network N e t w o r k 2. 2 . Level L e v e l 3 3 SAS S A S network n e t w o r k 3. 3 . Level L e v e l 2 2 Technical T e c h n i c a l Network N e t w o r k 4. 4 . Level L e v e l 2 2 SAS S A S HMI H M I and a n d Control C o n t r o l networks n e t w o r k s 5. 5 . Level L e v e l 1 1 SAS S A S Field F i e l d networks n e t w o r k s as a s applicable a p p l i c a b l e Security S e c u r i t y Level L e v e l Targets T a r g e t s ( ( SL-T4 S L - T 4 1 1 [ [ SL-T3 S L - T 3 ] ] ( ( SL-T2 S L - T 2 ] ] ( ( SL-T1 S L - T 1 Company C o m p a n y IT I T Systems S y s t e m s Telecom T e l e c o m systems s y s t e m s Company C o m p a n y IT I T Network N e t w o r k Safety S a f e t y and a n d Automation A u t o m a t i o n System S y s t e m Level L e v e l 3 3 SAS S A S Net N e t Compar C o m p a r jre j r e Level L e v e l 3 3 Technical T e c h n i c a l Net N e t Access A c c e s s I I System S y s t e m Management M a n a g e m e n t Network N e t w o r k I I [ [ Information I n f o r m a t i o n Management M a n a g e m e n t ] ] | | Management M a n a g e m e n t Information I n f o r m a t i o n II I I Condition C o n d i t i o n II I I Production P r o d u c t i o n 1 1 1 1 Operational O p e r a t i o n a l 11 1 1 Telecom T e l e c o m 11 1 1 Network N e t w o r k II I I Field F i e l d Device D e v i c e Management M a n a g e m e n t 11 1 1 Monitoring M o n i t o r i n g 11 1 1 Optimalisation O p t i m a l i s a t i o n II I I Support S u p p o r t II I I systems s y s t e m s II I I Management M a n a g e m e n t II I I Management M a n a g e m e n t Level L e v e l 2 2 SAS S A S HMI H M I Net N e t Level L e v e l 2 2 Technical T e c h n i c a l Net N e t Critical C r i t i c a l Electrical E l e c t r i c a l lystems l y s t e m s Subsea S u b s e a systems s y s t e m s SAS S A S C C xitrol x i t r o l clas c l a s s s 2 2 SAS S A S C C xitrol x i t r o l class c l a s s 3 3 Network N e t w o r k Management M a n a g e m e n t Systems S y s t e m s not n o t under u n d e r control c o n t r o l ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ byCCR b y C C R Action A c t i o n HMI H M I Collaboration C o l l a b o r a t i o n Operator O p e r a t o r HMI H M I Page P a g e 5 5 of o f 23 2 3 Level L e v e l 1 1 SAS S A S Control C o n t r o l Nets N e t s ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ Control C o n t r o l Control C o n t r o l Control C o n t r o l ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ Control C o n t r o l Field F i e l d devices d e v i c e s Field F i e l d devices d e v i c e s Field F i e l d devices d e v i c e s Level L e v e l 1 1 SAS S A S Field F i e l d Nets N e t s ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Field F i e l d devices d e v i c e s MCC M C C I I VSD V S D I I IED I E D Tibted T i b t e d gateway g a t e w a y Control C o n t r o l Control C o n t r o l Figure F i g u r e 1 1 Example E x a m p l e of o f Upstream U p s t r e a m Oil O i l & & Gas G a s facility f a c i l i t y zones z o n e s and a n d conduits c o n d u i t s model. m o d e l . SL-T S L - T levels l e v e l s in i n the t h e figure f i g u r e are a r e only o n l y guidance. g u i d a n c e . TR1658 T R 1 6 5 8 shall s h a l l be b e followed f o l l o w e d to t o assess a s s e s s which w h i c h SL-T S L - T to t o be b e used u s e d and a n d placement p l a c e m e n t of o f conduits. c o n d u i t s . Not N o t all a l l network n e t w o r k connections c o n n e c t i o n s in i n the t h e figure f i g u r e between b e t w e e n "control " c o n t r o l zones" z o n e s " are a r e necessarily n e c e s s a r i l y used u s e d for f o r control c o n t r o l traffic, t r a f f i c , some s o m e information i n f o r m a t i o n and a n d general g e n e r a l alarms a l a r m s may m a y be b e transported t r a n s p o r t e d through t h r o u g h the t h e same s a m e physical p h y s i c a l layer, l a y e r , e.g. e . g . for f o r CC3 C C 3 connections c o n n e c t i o n s to t o the t h e Field F i e l d network, n e t w o r k , as a s such s u c h information i n f o r m a t i o n normally n o r m a l l y is i s received r e c e i v e d through t h r o u g h the t h e control c o n t r o l nodes n o d e s by b y the t h e SAS S A S system. s y s t e m . Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 Field F i e l d devices d e v i c e s Field F i e l d devices d e v i c e s granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Page P a g e 6 6 of o f 23 2 3 ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l If I f connectivity c o n n e c t i v i t y is i s needed n e e d e d between b e t w e e n HIPPS/FWP/EmG H I P P S / F W P / E m G to t o ensure e n s u r e monitoring m o n i t o r i n g and a n d possible p o s s i b l e remote r e m o t e this t h i s may m a y be b e solved s o l v e d by b y a a control c o n t r o l mechanism m e c h a n i s m in i n a a conduit. c o n d u i t . SR-77134 S R - 7 7 1 3 4 - - The T h e IACS I A C S networks n e t w o r k s shall s h a l l support s u p p o r t integrated i n t e g r a t e d security s e c u r i t y concepts c o n c e p t s as a s defined d e f i n e d by b y TR1658. T R 1 6 5 8 . SR-86592 S R - 8 6 5 9 2 - - The T h e IACS I A C S network n e t w o r k design d e s i g n shall s h a l l safeguard s a f e g u a r d aspects a s p e c t s for f o r facility f a c i l i t y operation, o p e r a t i o n , system s y s t e m independence, i n d e p e n d e n c e , system s y s t e m performance p e r f o r m a n c e and a n d technology t e c h n o l o g y used. u s e d . SR-86591 S R - 8 6 5 9 1 - - Effort E f f o r t shall s h a l l be b e made m a d e to t o share s h a r e infrastructure i n f r a s t r u c t u r e within w i t h i n the t h e individual i n d i v i d u a l physical p h y s i c a l infrastructures i n f r a s t r u c t u r e s where w h e r e possible p o s s i b l e based b a s e d on o n risk r i s k assessments a s s e s s m e n t s done. d o n e . Requirements R e q u i r e m e n t s to t o the t h e following f o l l o w i n g needs n e e d s to t o be b e maintained m a i n t a i n e d in i n the t h e design: d e s i g n : 1. 1 . System S y s t e m independency, i n d e p e n d e n c y , reliability, r e l i a b i l i t y , availability, a v a i l a b i l i t y , maintainability, m a i n t a i n a b i l i t y , and a n d performance p e r f o r m a n c e 2. 2 . Cyber C y b e r security s e c u r i t y 3. 3 . Network N e t w o r k monitoring m o n i t o r i n g and a n d management m a n a g e m e n t SR-76647 S R - 7 6 6 4 7 - - Separate S e p a r a t e network n e t w o r k management m a n a g e m e n t solutions s o l u t i o n s customized c u s t o m i z e d to t o Company C o m p a n y operational o p e r a t i o n a l model m o d e l shall s h a l l be b e designed d e s i g n e d for: f o r : 1. 1 . Level L e v e l 3 3 Technical T e c h n i c a l network n e t w o r k and a n d firewall f i r e w a l l equipment, e q u i p m e n t , including i n c l u d i n g connected c o n n e c t e d EPU E P U control c o n t r o l system s y s t e m edge e d g e network n e t w o r k switches s w i t c h e s 2. 2 . Level L e v e l 2 2 Technical T e c h n i c a l network n e t w o r k and a n d firewall f i r e w a l l equipment, e q u i p m e n t , including i n c l u d i n g connected c o n n e c t e d EPU E P U control c o n t r o l system s y s t e m edge e d g e network n e t w o r k switches s w i t c h e s 3. 3 . Level L e v e l 3, 3 , 2 2 and a n d 1 1 SAS S A S network n e t w o r k and a n d firewall f i r e w a l l equipment e q u i p m e n t The T h e system s y s t e m specific s p e c i f i c TRs T R s may m a y put p u t additional a d d i t i o n a l requirements r e q u i r e m e n t s to t o management m a n a g e m e n t solution s o l u t i o n for f o r additional a d d i t i o n a l IACS I A C S internal i n t e r n a l networks. n e t w o r k s . SR-86589 S R - 8 6 5 8 9 - - The T h e high h i g h availability a v a i l a b i l i t y networks n e t w o r k s design d e s i g n shall s h a l l be b e limited l i m i t e d to t o use u s e the t h e following f o l l o w i n g network n e t w o r k protocols p r o t o c o l s in i n accordance a c c o r d a n c e with w i t h IEC I E C 62439: 6 2 4 3 9 : • • Parallel P a r a l l e l Redundancy R e d u n d a n c y Protocol P r o t o c o l (PRP) ( P R P ) when w h e n zero z e r o fail f a i l over o v e r time t i m e is i s required r e q u i r e d • • High-availability H i g h - a v a i l a b i l i t y Seamless S e a m l e s s Redundancy R e d u n d a n c y (HSR) ( H S R ) when w h e n zero z e r o fail f a i l over o v e r time t i m e is i s required r e q u i r e d • • Media M e d i a Redundancy R e d u n d a n c y Protocol P r o t o c o l (MRP) ( M R P ) SR-86756 S R - 8 6 7 5 6 - - RSTP R S T P shall s h a l l not n o t be b e used u s e d as a s a a network n e t w o r k redundancy r e d u n d a n c y protocol p r o t o c o l in i n high h i g h availability a v a i l a b i l i t y networks, n e t w o r k s , but b u t may m a y be b e used u s e d to t o add a d d redundancy r e d u n d a n c y to t o equipment e q u i p m e n t connection c o n n e c t i o n on o n edge e d g e switch s w i t c h ports. p o r t s . SR-92089 S R - 9 2 0 8 9 - - Network N e t w o r k edge e d g e switch s w i t c h ports p o r t s (where ( w h e r e Devices D e v i c e s or o r Computers C o m p u t e r s are a r e connected) c o n n e c t e d ) shall s h a l l have h a v e BPDU B P D U guard g u a r d enabled. e n a b l e d . SR-86588 S R - 8 6 5 8 8 - - The T h e networks n e t w o r k s shall s h a l l have h a v e a a high h i g h availability a v a i l a b i l i t y design d e s i g n when w h e n the t h e data d a t a communicated c o m m u n i c a t e d is i s critical c r i t i c a l for f o r safety s a f e t y or o r production, p r o d u c t i o n , or o r if i f the t h e connected c o n n e c t e d networked n e t w o r k e d component c o m p o n e n t requires r e q u i r e s a a high h i g h availability a v a i l a b i l i t y data d a t a link. l i n k . SR-86587 S R - 8 6 5 8 7 - - The T h e networks n e t w o r k s shall s h a l l have h a v e capacity c a p a c i t y to t o handle h a n d l e the t h e data d a t a load l o a d for f o r all a l l operational o p e r a t i o n a l modes. m o d e s . SR-77150 S R - 7 7 1 5 0 - - The T h e IACS I A C S networks n e t w o r k s shall s h a l l be b e scalable s c a l a b l e with w i t h respect r e s p e c t to t o capability c a p a b i l i t y and a n d capacity. c a p a c i t y . SR-77160 S R - 7 7 1 6 0 - - The T h e IACS I A C S networks n e t w o r k s shall s h a l l be b e based b a s e d on o n recognised r e c o g n i s e d open o p e n industry i n d u s t r y standards. s t a n d a r d s . SR-77459 S R - 7 7 4 5 9 - - The T h e IACS I A C S networks n e t w o r k s shall s h a l l support s u p p o r t Quality Q u a l i t y of o f Service S e r v i c e (QoS) ( Q o S ) functionality. f u n c t i o n a l i t y . SR-86585 S R - 8 6 5 8 5 - - The T h e networks n e t w o r k s shall s h a l l support s u p p o r t Virtual V i r t u a l Local L o c a l Area A r e a Network N e t w o r k (VLAN) ( V L A N ) functionality. f u n c t i o n a l i t y . SR-77669 S R - 7 7 6 6 9 - - The T h e IACS I A C S networks n e t w o r k s shall s h a l l prioritise p r i o r i t i s e IACS I A C S dependent d e p e n d e n t data d a t a traffic t r a f f i c over o v e r non-dependent n o n - d e p e n d e n t data d a t a traffic t r a f f i c if i f deployed d e p l o y e d on o n a a shared s h a r e d physical p h y s i c a l network n e t w o r k infrastructure. i n f r a s t r u c t u r e . SR-86586 S R - 8 6 5 8 6 - - The T h e IACS I A C S networks n e t w o r k s design d e s i g n shall s h a l l protect p r o t e c t the t h e networked n e t w o r k e d components c o m p o n e n t s from f r o m unwanted u n w a n t e d network n e t w o r k traffic t r a f f i c where w h e r e ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ relevant. r e l e v a n t . SR-77163 S R - 7 7 1 6 3 - - The T h e IACS I A C S networks n e t w o r k s shall s h a l l be b e able a b l e to t o distribute d i s t r i b u t e time t i m e to t o networked n e t w o r k e d components. c o m p o n e n t s . SR-77648 S R - 7 7 6 4 8 - - Time T i m e in i n redundant r e d u n d a n t network n e t w o r k configurations c o n f i g u r a t i o n s shall s h a l l be b e sourced s o u r c e d from f r o m redundant r e d u n d a n t Real R e a l Time T i m e Clocks. C l o c k s . SR-77133 S R - 7 7 1 3 3 - - The T h e IACS I A C S networks n e t w o r k s shall s h a l l support s u p p o r t end-to-end e n d - t o - e n d connectivity c o n n e c t i v i t y for f o r management m a n a g e m e n t data d a t a where w h e r e required. r e q u i r e d . Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Level L e v e l 3 3 Technical T e c h n i c a l network n e t w o r k management m a n a g e m e n t system. s y s t e m . Page P a g e 7 7 of o f 23 2 3 ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ 2 2 ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l SR-79218 S R - 7 9 2 1 8 - - The T h e network n e t w o r k IP I P plan p l a n shall s h a l l be b e pre-approved p r e - a p p r o v e d by b y Company. C o m p a n y . SR-78009 S R - 7 8 0 0 9 - - Computers, C o m p u t e r s , except e x c e p t server s e r v e r hardware h a r d w a r e used u s e d for f o r virtual v i r t u a l hosts, h o s t s , shall s h a l l not n o t be b e connected c o n n e c t e d to t o different d i f f e r e n t networks n e t w o r k s by- b y - passing p a s s i n g installed i n s t a l l e d firewalls. f i r e w a l l s . SR-91917 S R - 9 1 9 1 7 - - Server S e r v e r hardware h a r d w a r e used u s e d for f o r virtual v i r t u a l hosts h o s t s shall s h a l l not n o t be b e connected c o n n e c t e d across a c r o s s different d i f f e r e n t Purdue P u r d u e levels. l e v e l s . SR-86593 S R - 8 6 5 9 3 - - If I f encrypted e n c r y p t e d data d a t a links l i n k s are a r e used u s e d between b e t w e e n networks n e t w o r k s on o n different d i f f e r e n t levels, l e v e l s , the t h e traffic t r a f f i c shall s h a l l be b e decrypted d e c r y p t e d before b e f o r e entering e n t e r i n g end-point e n d - p o i n t firewalls f i r e w a l l s with w i t h DPI D P I and a n d IDS I D S enabled. e n a b l e d . SR-86697 S R - 8 6 6 9 7 - - The T h e IACS I A C S systems s y s t e m s shall s h a l l be b e designed d e s i g n e d so s o that t h a t the t h e use u s e of o f (Supplier) ( S u p p l i e r ) laptops l a p t o p s and a n d similar s i m i l a r portable p o r t a b l e computers c o m p u t e r s is i s not n o t required r e q u i r e d for f o r configuration, c o n f i g u r a t i o n , operation o p e r a t i o n or o r maintenance. m a i n t e n a n c e . SR-86696 S R - 8 6 6 9 6 - - Software S o f t w a r e applications a p p l i c a t i o n s necessary n e c e s s a r y for f o r maintenance, m a i n t e n a n c e , configuration c o n f i g u r a t i o n and a n d parameterisation p a r a m e t e r i s a t i o n of o f the t h e IACS I A C S systems s y s t e m s shall s h a l l be b e included i n c l u d e d and a n d installed i n s t a l l e d on o n Engineering E n g i n e e r i n g work w o r k stations. s t a t i o n s . 3.1.1 3 . 1 . 1 Criticality C r i t i c a l i t y assessment a s s e s s m e n t SR-76646 S R - 7 6 6 4 6 - - Data D a t a links l i n k s shall s h a l l be b e identified i d e n t i f i e d and a n d classified c l a s s i f i e d in i n accordance a c c o r d a n c e with w i t h its i t s consequence c o n s e q u e n c e for f o r facility f a c i l i t y safety, s a f e t y , information i n f o r m a t i o n security s e c u r i t y and a n d production. p r o d u c t i o n . The T h e framework f r a m e w o r k described d e s c r i b e d in i n NOG N O G 123 1 2 3 can c a n be b e used u s e d for f o r this t h i s assessment. a s s e s s m e n t . SR-77911 S R - 7 7 9 1 1 - - Cyber C y b e r Security S e c u r i t y Risk R i s k assessment a s s e s s m e n t for f o r the t h e System S y s t e m under u n d e r Consideration C o n s i d e r a t i o n (SuC, ( S u C , ref r e f TR1658) T R 1 6 5 8 ) shall s h a l l be b e done d o n e to t o identify i d e n t i f y the t h e network n e t w o r k infrastructure i n f r a s t r u c t u r e to t o be b e utilized. u t i l i z e d . 3.2 3 . 2 Level L e v e l 3 3 Technical T e c h n i c a l network n e t w o r k The T h e Level L e v e l 3 3 Technical T e c h n i c a l network n e t w o r k should s h o u l d be b e used u s e d for f o r systems s y s t e m s with w i t h facility f a c i l i t y functions f u n c t i o n s and a n d to t o provide p r o v i d e network n e t w o r k connection c o n n e c t i o n to t o off- o f f - premise p r e m i s e Company C o m p a n y IT I T solutions s o l u t i o n s through t h r o u g h the t h e Company C o m p a n y secure s e c u r e access a c c e s s solution. s o l u t i o n . SR-86613 S R - 8 6 6 1 3 - - Systems S y s t e m s critical c r i t i c a l for f o r facility f a c i l i t y safety s a f e t y or o r production p r o d u c t i o n shall s h a l l not n o t be b e dependent d e p e n d e n t of o f the t h e Level L e v e l 3 3 Technical T e c h n i c a l network n e t w o r k to t o execute e x e c u t e its i t s function. f u n c t i o n . SR-86612 S R - 8 6 6 1 2 - - The T h e Level L e v e l 3 3 Technical T e c h n i c a l core c o r e network n e t w o r k layer l a y e r shall s h a l l have h a v e a a fault f a u l t tolerant t o l e r a n t design. d e s i g n . A A Level L e v e l 3 3 Technical T e c h n i c a l distribution d i s t r i b u t i o n network n e t w o r k layer l a y e r should s h o u l d be b e used u s e d where w h e r e there t h e r e is i s a a need n e e d for f o r aggregating a g g r e g a t i n g network n e t w o r k layers l a y e r s and a n d provide p r o v i d e unique u n i q u e connectivity c o n n e c t i v i t y services s e r v i c e s within w i t h i n a a distribution d i s t r i b u t i o n network n e t w o r k segment. s e g m e n t . SR-86617 S R - 8 6 6 1 7 - - The T h e Level L e v e l 3 3 Technical T e c h n i c a l network n e t w o r k shall s h a l l provide p r o v i d e distribution, d i s t r i b u t i o n , policy p o l i c y control, c o n t r o l , and a n d isolation i s o l a t i o n points p o i n t s between b e t w e e n the t h e network n e t w o r k segment s e g m e n t and a n d the t h e rest r e s t of o f the t h e IACS I A C S networks. n e t w o r k s . SR-86616 S R - 8 6 6 1 6 - - The T h e Level L e v e l 3 3 Technical T e c h n i c a l network n e t w o r k shall s h a l l have h a v e a a fault f a u l t tolerant t o l e r a n t design d e s i g n towards t o w a r d s the t h e core c o r e or o r distribution d i s t r i b u t i o n network. n e t w o r k . SR-86615 S R - 8 6 6 1 5 - - The T h e Level L e v e l 3 3 Technical T e c h n i c a l network n e t w o r k shall s h a l l be b e connected c o n n e c t e d to t o a a high h i g h availability a v a i l a b i l i t y firewall f i r e w a l l solution s o l u t i o n in i n the t h e Company C o m p a n y secure s e c u r e access a c c e s s solution s o l u t i o n for f o r secure s e c u r e data d a t a traffic t r a f f i c within w i t h i n and a n d to/from t o / f r o m the t h e network. n e t w o r k . SR-77773 S R - 7 7 7 7 3 - - The T h e Level L e v e l 3 3 Technical T e c h n i c a l network n e t w o r k components c o m p o n e n t s shall s h a l l be b e compatible c o m p a t i b l e and a n d integrated i n t e g r a t e d with w i t h Company C o m p a n y centralised c e n t r a l i s e d ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} SR-86626 S R - 8 6 6 2 6 - - The T h e Level L e v e l 2 2 SAS S A S control c o n t r o l edge e d g e switches s w i t c h e s shall s h a l l have h a v e a a high h i g h availability a v a i l a b i l i t y design d e s i g n towards t o w a r d s the t h e core c o r e network. n e t w o r k . Page P a g e 8 8 of o f 23 2 3 ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ "ÿÿÿ " ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l 3.3 3 . 3 Level L e v e l 2 2 Technical T e c h n i c a l network n e t w o r k The T h e Level L e v e l 2 2 Technical T e c h n i c a l network n e t w o r k should s h o u l d be b e used u s e d for f o r operational o p e r a t i o n a l management m a n a g e m e n t solutions s o l u t i o n s in i n IACS I A C S other o t h e r than t h a n SAS S A S that t h a t is i s considered c o n s i d e r e d high h i g h critical c r i t i c a l based b a s e d on o n the t h e Cyber C y b e r Security S e c u r i t y risk r i s k assessment, a s s e s s m e n t , and a n d to t o provide p r o v i d e network n e t w o r k connection c o n n e c t i o n to t o solutions s o l u t i o n s in i n the t h e Level L e v e l 3 3 IACS I A C S network. n e t w o r k . SR-86620 S R - 8 6 6 2 0 - - Systems S y s t e m s critical c r i t i c a l for f o r facility f a c i l i t y safety s a f e t y or o r production p r o d u c t i o n shall s h a l l not n o t be b e dependent d e p e n d e n t of o f the t h e Level L e v e l 2 2 Technical T e c h n i c a l network n e t w o r k to t o execute e x e c u t e its i t s function. f u n c t i o n . SR-86619 S R - 8 6 6 1 9 - - The T h e Level L e v e l 2 2 Technical T e c h n i c a l core c o r e network n e t w o r k layer l a y e r shall s h a l l have h a v e a a fault f a u l t tolerant t o l e r a n t design. d e s i g n . A A Level L e v e l 2 2 Technical T e c h n i c a l distribution d i s t r i b u t i o n network n e t w o r k layer l a y e r should s h o u l d be b e used u s e d where w h e r e there t h e r e is i s a a need n e e d for f o r aggregating a g g r e g a t i n g network n e t w o r k layers l a y e r s and a n d provide p r o v i d e unique u n i q u e connectivity c o n n e c t i v i t y services s e r v i c e s within w i t h i n a a distribution d i s t r i b u t i o n network n e t w o r k segment. s e g m e n t . SR-86623 S R - 8 6 6 2 3 - - The T h e Level L e v e l 2 2 Technical T e c h n i c a l network n e t w o r k shall s h a l l have h a v e a a fault f a u l t tolerant t o l e r a n t design d e s i g n towards t o w a r d s the t h e core c o r e or o r distribution d i s t r i b u t i o n network. n e t w o r k . SR-86622 S R - 8 6 6 2 2 - - The T h e Level L e v e l 2 2 Technical T e c h n i c a l network n e t w o r k shall s h a l l have h a v e a a high h i g h availability a v a i l a b i l i t y firewall f i r e w a l l solution s o l u t i o n installed i n s t a l l e d to t o restrict r e s t r i c t data d a t a traffic t r a f f i c within w i t h i n and a n d to/from t o / f r o m the t h e network. n e t w o r k . 3.4 3 . 4 Level L e v e l 3 3 SAS S A S network n e t w o r k The T h e Level L e v e l 3 3 SAS S A S network n e t w o r k should s h o u l d be b e used u s e d for f o r operational o p e r a t i o n a l management m a n a g e m e n t solutions s o l u t i o n s in i n SAS S A S and a n d to t o provide p r o v i d e network n e t w o r k connection c o n n e c t i o n to t o solutions s o l u t i o n s in i n the t h e Level L e v e l 3 3 Technical T e c h n i c a l network. n e t w o r k . SR-86636 S R - 8 6 6 3 6 - - Systems S y s t e m s critical c r i t i c a l for f o r facility f a c i l i t y safety s a f e t y or o r production p r o d u c t i o n shall s h a l l not n o t be b e dependent d e p e n d e n t of o f the t h e Level L e v e l 3 3 SAS S A S network n e t w o r k to t o execute e x e c u t e its i t s function. f u n c t i o n . SR-86635 S R - 8 6 6 3 5 - - The T h e Level L e v e l 3 3 SAS S A S core c o r e network n e t w o r k layer l a y e r shall s h a l l have h a v e a a fault f a u l t tolerant t o l e r a n t design. d e s i g n . SR-86634 S R - 8 6 6 3 4 - - The T h e Level L e v e l 3 3 SAS S A S network n e t w o r k shall s h a l l provide p r o v i d e distribution, d i s t r i b u t i o n , policy p o l i c y control, c o n t r o l , and a n d isolation i s o l a t i o n points p o i n t s between b e t w e e n the t h e network n e t w o r k segment s e g m e n t and a n d the t h e rest r e s t of o f the t h e network. n e t w o r k . SR-86633 S R - 8 6 6 3 3 - - The T h e Level L e v e l 3 3 SAS S A S network n e t w o r k shall s h a l l have h a v e a a fault f a u l t tolerant t o l e r a n t design d e s i g n towards t o w a r d s the t h e core c o r e network. n e t w o r k . SR-86632 S R - 8 6 6 3 2 - - The T h e Level L e v e l 3 3 SAS S A S network n e t w o r k shall s h a l l have h a v e a a high h i g h availability a v a i l a b i l i t y firewall f i r e w a l l solution s o l u t i o n installed i n s t a l l e d for f o r secure s e c u r e data d a t a traffic t r a f f i c within w i t h i n and a n d to/from t o / f r o m the t h e network. n e t w o r k . 3.5 3 . 5 Level L e v e l 2 2 SAS S A S network n e t w o r k The T h e Level L e v e l 2 2 SAS S A S HMI H M I network n e t w o r k should s h o u l d be b e used u s e d for f o r the t h e HMI H M I system s y s t e m in i n SAS S A S and a n d to t o provide p r o v i d e connection c o n n e c t i o n to t o solutions s o l u t i o n s in i n the t h e Level L e v e l 3 3 and a n d 1 1 SAS S A S networks. n e t w o r k s . SR-86631 S R - 8 6 6 3 1 - - The T h e Level L e v e l 2 2 SAS S A S HMI H M I core c o r e network n e t w o r k layer l a y e r shall s h a l l have h a v e a a high h i g h availability a v a i l a b i l i t y design. d e s i g n . SR-86627 S R - 8 6 6 2 7 - - The T h e Level L e v e l 2 2 SAS S A S HMI H M I edge e d g e switches s w i t c h e s shall s h a l l have h a v e a a high h i g h availability a v a i l a b i l i t y design d e s i g n towards t o w a r d s the t h e core c o r e network. n e t w o r k . The T h e Level L e v e l 2 2 SAS S A S control c o n t r o l networks n e t w o r k s should s h o u l d be b e used u s e d for f o r controller c o n t r o l l e r to t o controller c o n t r o l l e r data d a t a traffic t r a f f i c and a n d to t o provide p r o v i d e network n e t w o r k connection c o n n e c t i o n to t o solutions s o l u t i o n s in i n the t h e Level L e v e l 2 2 SAS S A S network n e t w o r k and a n d Level L e v e l 1 1 SAS S A S field f i e l d networks. n e t w o r k s . SR-86625 S R - 8 6 6 2 5 - - The T h e Level L e v e l 2 2 SAS S A S control c o n t r o l core c o r e network n e t w o r k layer l a y e r shall s h a l l have h a v e a a high h i g h availability a v a i l a b i l i t y design. d e s i g n . ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} SR-77672 S R - 7 7 6 7 2 - - PRP P R P field f i e l d networks n e t w o r k s shall s h a l l have h a v e a a dual d u a l star s t a r design d e s i g n as a s indicated i n d i c a t e d in i n the t h e figure f i g u r e below. b e l o w . Page P a g e 9 9 of o f 23 2 3 ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l 3.6 3 . 6 Level L e v e l 1 1 SAS S A S field f i e l d network n e t w o r k 3.6.1 3 . 6 . 1 General G e n e r a l The T h e Level L e v e l 1 1 SAS S A S field f i e l d networks n e t w o r k s should s h o u l d be b e used u s e d for f o r data d a t a traffic t r a f f i c to/from t o / f r o m field f i e l d devices d e v i c e s and a n d to t o provide p r o v i d e network n e t w o r k connection c o n n e c t i o n to t o solutions s o l u t i o n s in i n the t h e Level L e v e l 2 2 SAS S A S control c o n t r o l networks. n e t w o r k s . SR-86639 S R - 8 6 6 3 9 - - The T h e Level L e v e l 1 1 SAS S A S field f i e l d networks n e t w o r k s layer l a y e r shall s h a l l have h a v e a a high h i g h availability a v a i l a b i l i t y design. d e s i g n . SR-86644 S R - 8 6 6 4 4 - - A A SAS S A S Level L e v e l 1 1 field f i e l d distribution d i s t r i b u t i o n network n e t w o r k layer l a y e r shall s h a l l be b e used u s e d where w h e r e there t h e r e is i s a a need n e e d for f o r aggregating a g g r e g a t i n g network n e t w o r k layers l a y e r s and a n d provide p r o v i d e unique u n i q u e connectivity c o n n e c t i v i t y services s e r v i c e s within w i t h i n a a distribution d i s t r i b u t i o n network n e t w o r k segment. s e g m e n t . SR-86643 S R - 8 6 6 4 3 - - Where W h e r e independent i n d e p e n d e n t A A and a n d B B cable c a b l e routing r o u t i n g is i s required, r e q u i r e d , separate s e p a r a t e Level L e v e l 1 1 SAS S A S core c o r e network n e t w o r k switches s w i t c h e s shall s h a l l be b e used. u s e d . SR-86642 S R - 8 6 6 4 2 - - The T h e Level L e v e l 1 1 SAS S A S PCS P C S field f i e l d networks n e t w o r k s shall s h a l l have h a v e a a redundant r e d u n d a n t firewall f i r e w a l l solution s o l u t i o n installed i n s t a l l e d for f o r enabling e n a b l i n g secure s e c u r e data d a t a links l i n k s between b e t w e e n the t h e field f i e l d devices d e v i c e s and a n d the t h e management m a n a g e m e n t solutions. s o l u t i o n s . SR-86687 S R - 8 6 6 8 7 -The - T h e level l e v e l 1 1 IEC I E C 61850 6 1 8 5 0 network n e t w o r k shall s h a l l use u s e PRP, P R P , specified s p e c i f i e d in i n Clause C l a u s e 4 4 of o f IEC I E C 62439-3:2012, 6 2 4 3 9 - 3 : 2 0 1 2 , both b o t h for f o r Station S t a t i o n Bus B u s and a n d (if ( i f implemented) i m p l e m e n t e d ) Process P r o c e s s Bus. B u s . 3.6.2 3 . 6 . 2 Field F i e l d Network N e t w o r k traffic t r a f f i c segregation s e g r e g a t i o n SR-86683 S R - 8 6 6 8 3 - - Each E a c h SAS S A S logic l o g i c solver s o l v e r shall s h a l l have h a v e a a separate s e p a r a t e VLAN V L A N for f o r field f i e l d network n e t w o r k communication. c o m m u n i c a t i o n . Such S u c h VLAN V L A N may m a y be b e shared s h a r e d for f o r PROFINET P R O F I N E T and a n d Modbus M o d b u s TPC T P C if i f a a common c o m m o n port p o r t is i s used. u s e d . VLAN V L A N may m a y be b e shared s h a r e d between b e t w e e n controllers c o n t r o l l e r s required r e q u i r e d to t o communicate c o m m u n i c a t e with w i t h the t h e same s a m e devices. d e v i c e s . SR-78573 S R - 7 8 5 7 3 - - Non-SAS N o n - S A S logic l o g i c solvers s o l v e r s in i n Class C l a s s 2 2 packages, p a c k a g e s , which w h i c h use u s e the t h e field f i e l d network n e t w o r k to t o communicate c o m m u n i c a t e to t o e.g. e . g . MCCs, M C C s , shall s h a l l have h a v e separate s e p a r a t e VLANs V L A N s for f o r this t h i s purpose. p u r p o s e . SR-78572 S R - 7 8 5 7 2 - - Level L e v e l 2 2 Technical T e c h n i c a l network n e t w o r k traffic t r a f f i c shall s h a l l be b e in i n separate s e p a r a t e VLANs V L A N s to t o the t h e SAS S A S VLANs, V L A N s , where w h e r e the t h e device d e v i c e supports s u p p o r t s this. t h i s . 3.6.3 3 . 6 . 3 PRP P R P field f i e l d networks n e t w o r k s ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ PRP P R P ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Edge E d g e PRP P R P A A Hub H u b PRP P R P B B Dist D i s t ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Dual D u a l Star S t a r Figure F i g u r e 2 2 Diagram D i a g r a m showing s h o w i n g principle p r i n c i p l e of o f locating l o c a t i n g the t h e two t w o PRP P R P hubs h u b s physically p h y s i c a l l y separate s e p a r a t e SR-78496 S R - 7 8 4 9 6 - - Devices D e v i c e s and a n d computers c o m p u t e r s which w h i c h does d o e s not n o t support s u p p o r t PRP P R P shall s h a l l be b e connected c o n n e c t e d using u s i n g a a redbox. r e d b o x . SR-78494 S R - 7 8 4 9 4 - - Devices D e v i c e s and a n d computers c o m p u t e r s shall s h a l l be b e connected c o n n e c t e d to t o a a port p o r t on o n a a switch. s w i t c h . SR-78553 S R - 7 8 5 5 3 - - If I f the t h e SAS S A S logic l o g i c solver s o l v e r does d o e s not n o t support s u p p o r t PRP, P R P , one o n e redbox r e d b o x shall s h a l l be b e used u s e d for f o r connecting c o n n e c t i n g PRP P R P A A and a n d PRP P R P B B to t o the t h e SAS S A S A A network, n e t w o r k , and a n d another a n o t h e r redbox r e d b o x shall s h a l l be b e used u s e d for f o r similar s i m i l a r connection c o n n e c t i o n to t o the t h e SAS S A S B B network. n e t w o r k . SR-78551 S R - 7 8 5 5 1 - - Communication C o m m u n i c a t i o n to t o Level L e v e l 2 2 Technical T e c h n i c a l network n e t w o r k shall s h a l l be b e done d o n e through t h r o u g h a a separate s e p a r a t e redbox. r e d b o x . Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 Edge E d g e PRP P R P B B Dist D i s t Edge E d g e granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} 61850 6 1 8 5 0 network n e t w o r k should s h o u l d be b e implemented i m p l e m e n t e d with w i t h PRP. P R P . ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l 3.6.3.1 3 . 6 . 3 . 1 Non-IEC N o n - I E C 61850 6 1 8 5 0 PRP P R P field f i e l d network n e t w o r k topology t o p o l o g y In I n order o r d e r to t o implement i m p l e m e n t shared s h a r e d network n e t w o r k infrastructure i n f r a s t r u c t u r e for f o r the t h e field f i e l d ne n e works w o r k s (IEC ( I E C 61850 6 1 8 5 0 and a n d non-IEC n o n - I E C 61850) 6 1 8 5 0 ) the t h e non-IEC n o n - I E C ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ Control C o n t r o l system s y s t e m Control C o n t r o l system s y s t e m Level L e v e l 3 3 Technical T e c h n i c a l network n e t w o r k Multicore M u l t i c o r e Fiber F i b e r Copper C o p p e r or o r Fiber F i b e r PRP P R P A A net n e t Redbox R e d b o x B B Engineering E n g i n e e r i n g PRP P R P B B net n e t Workstation W o r k s t a t i o n Time T i m e A A Time T i m e B B SAN S A N device d e v i c e Firewall F i r e w a l l for f o r NTP N T P traffic t r a f f i c Level L e v e l 2 2 SAS S A S A A net n e t Technical T e c h n i c a l PRP P R P A A PRP P R P B B Network N e t w o r k SAS S A S B B net n e t Firewall F i r e w a l l CORE C O R E CORE C O R E Service S e r v i c e net n e t FO F O pp p p Redbox R e d b o x C C Redbox R e d b o x D D FO F O FO F O FO F O pp p p PP P P PP P P Level L e v e l 2 2 Technical T e c h n i c a l Network N e t w o r k Redbox R e d b o x Switch S w i t c h Fiber F i b e r Optic O p t i c Patch P a t c h Panel P a n e l Multicore M u l t i c o r e Fibers F i b e r s ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ MCC M C C MCC M C C MCC M C C MCC M C C MCC M C C MCC M C C MCC M C C MCC M C C MCC M C C VSD V S D VSD V S D VSD V S D Motor M o t o r Starter S t a r t e r Cubicle C u b i c l e Logic L o g i c Solver S o l v e r Motor M o t o r Starter S t a r t e r Cubicle C u b i c l e Motor M o t o r Starter S t a r t e r Cubicle C u b i c l e One O n e or o r more m o r e VSDs V S D s Example E x a m p l e Class C l a s s 2 2 Single S i n g l e VSD V S D cubicle c u b i c l e Figure F i g u r e 3 3 Principle P r i n c i p l e drawing d r a w i n g for f o r non-IEC n o n - I E C 61850 6 1 8 5 0 field f i e l d network n e t w o r k based b a s e d on o n PRP, P R P , typically t y p i c a l l y used u s e d for f o r PROFINET P R O F I N E T and a n d Modbus M o d b u s TCP. T C P . VSD V S D Vibration V i b r a t i o n Rack R a c k Vibration V i b r a t i o n Racks R a c k s Individual I n d i v i d u a l Class C l a s s 2 2 packages p a c k a g e s with w i t h dedicated d e d i c a t e d SAS S A S logic l o g i c solvers s o l v e r s may m a y have h a v e individual i n d i v i d u a l links l i n k s to t o e.g. e . g . a a VSD, V S D , but b u t communicate c o m m u n i c a t e via v i a the t h e PCS P C S field f i e l d network n e t w o r k to t o equipment e q u i p m e n t from f r o m other o t h e r packages p a c k a g e s (e.g. ( e . g . MCCs M C C s in i n electro e l e c t r o packages). p a c k a g e s ) . 3.6.3.2 3 . 6 . 3 . 2 IEC I E C 61850 6 1 8 5 0 PRP P R P network n e t w o r k Page P a g e 10 1 0 of o f 23 2 3 ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Control C o n t r o l system s y s t e m Control C o n t r o l system s y s t e m Note: N o t e : both b o t h PRP P R P A A and a n d B B (orange ( o r a n g e and a n d green) g r e e n ) and a n d redundant r e d u n d a n t A A and a n d B B (red ( r e d and a n d blue) b l u e ) are a r e available a v a i l a b l e to t o suit s u i t the t h e control c o n t r o l system. s y s t e m . Level L e v e l 3 3 Technical T e c h n i c a l network n e t w o r k Fiber F i b e r Copper C o p p e r or o r Fiber F i b e r Redbox R e d b o x Time T i m e A A Time T i m e B B PRP P R P A A CORE C O R E PRP P R P B B Technical T e c h n i c a l CORE C O R E network n e t w o r k Firewall F i r e w a l l Engineering E n g i n e e r i n g Workstation W o r k s t a t i o n PRP P R P A A net n e t PRP P R P B B net n e t SAS S A S A A net n e t SAS S A S B B net n e t Service S e r v i c e net n e t Redbox R e d b o x Switch S w i t c h FO F O PP P P FO F O PP P P FO F O PP P P Redbox R e d b o x C C FO F O PP P P Fiber F i b e r Optic O p t i c Patch P a t c h Panel P a n e l SR-78030 S R - 7 8 0 3 0 - - Software S o f t w a r e licenses l i c e n s e s shall s h a l l be b e registered r e g i s t e r e d to t o Company C o m p a n y and a n d activated a c t i v a t e d before b e f o r e project p r o j e c t handover h a n d o v e r to t o operation. o p e r a t i o n . Page P a g e 11 1 1 of o f 23 2 3 ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ A A B B IED I E D A A B B IED I E D HV H V Switchboard S w i t c h b o a r d A A HV H V Switchboard S w i t c h b o a r d B B MV M V Switchboards S w i t c h b o a r d s A A MV M V Switchboards S w i t c h b o a r d s B B LV L V Switchboard S w i t c h b o a r d A A LV L V Switchboard S w i t c h b o a r d B B Figure F i g u r e 4 4 Principle P r i n c i p l e drawing d r a w i n g for f o r IEC61850 I E C 6 1 8 5 0 station s t a t i o n bus b u s network n e t w o r k topology t o p o l o g y using u s i n g PRP P R P lEDs l E D s should s h o u l d connect c o n n e c t to t o the t h e network n e t w o r k using u s i n g PRP, P R P , without w i t h o u t the t h e use u s e of o f a a redbox. r e d b o x . SR-78543 S R - 7 8 5 4 3 - - Switches S w i t c h e s used u s e d in i n IEC I E C 61850 6 1 8 5 0 networks n e t w o r k s shall s h a l l not n o t enable e n a b l e write w r i t e MMS M M S support. s u p p o r t . SR-78542 S R - 7 8 5 4 2 - - Where W h e r e PTP P T P is i s required, r e q u i r e d , switches s w i t c h e s used u s e d in i n IEC I E C 61850 6 1 8 5 0 networks n e t w o r k s shall s h a l l support s u p p o r t PTP. P T P . 4 4 Software S o f t w a r e 4.1 4 . 1 General G e n e r a l SR-83694 S R - 8 3 6 9 4 - - The T h e project p r o j e c t shall s h a l l in i n due d u e time t i m e get g e t a a final f i n a l acceptance a c c e p t a n c e from f r o m Company C o m p a n y on o n the t h e software s o f t w a r e products p r o d u c t s chosen. c h o s e n . SR-83693 S R - 8 3 6 9 3 - - The T h e agreed a g r e e d official o f f i c i a l software s o f t w a r e version v e r s i o n for f o r all a l l software s o f t w a r e components c o m p o n e n t s shall s h a l l be b e available a v a i l a b l e for f o r installation i n s t a l l a t i o n before b e f o r e project p r o j e c t handover h a n d o v e r to t o operation. o p e r a t i o n . SR-83695 S R - 8 3 6 9 5 - - All A l l agreed a g r e e d official o f f i c i a l software s o f t w a r e patches p a t c h e s shall s h a l l be b e installed i n s t a l l e d before b e f o r e project p r o j e c t handover h a n d o v e r to t o operation. o p e r a t i o n . SR-83692 S R - 8 3 6 9 2 - - The T h e operating o p e r a t i n g system s y s t e m shall s h a l l be b e of o f Long-term L o n g - t e r m Support S u p p o r t (LTS) ( L T S ) version v e r s i o n where w h e r e available. a v a i l a b l e . ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Page P a g e 12 1 2 of o f 23 2 3 ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ. ÿ ÿ ÿ . ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l 4.2 4 . 2 Equipment E q u i p m e n t message m e s s a g e logging l o g g i n g SR-78483 S R - 7 8 4 8 3 - - The T h e network n e t w o r k equipment e q u i p m e n t and a n d networked n e t w o r k e d devices d e v i c e s message m e s s a g e logs l o g s shall s h a l l be b e based b a s e d on o n recognised r e c o g n i s e d open o p e n standards. s t a n d a r d s . The T h e message m e s s a g e logs l o g s shall s h a l l also a l s o cover c o v e r security s e c u r i t y related r e l a t e d alarms a l a r m s and a n d events, e v e n t s , including i n c l u d i n g remote r e m o t e desktop d e s k t o p protocol p r o t o c o l usage. u s a g e . For F o r network n e t w o r k equipment e q u i p m e n t Syslog S y s l o g (RFC ( R F C 5424) 5 4 2 4 ) or o r SNMP S N M P traps t r a p s are a r e examples e x a m p l e s of o f such s u c h standards s t a n d a r d s For F o r clients c l i e n t s and a n d servers s e r v e r s running r u n n i n g Microsoft M i c r o s o f t Windows W i n d o w s operating o p e r a t i n g system, s y s t e m , the t h e Default D e f a u l t Audit A u d i t logging l o g g i n g must m u s t enable e n a b l e Success/Failure S u c c e s s / F a i l u r e on o n account a c c o u n t logon l o g o n events, e v e n t s , account a c c o u n t management, m a n a g e m e n t , logon l o g o n events, e v e n t s , object o b j e c t access, a c c e s s , policy p o l i c y change, c h a n g e , system s y s t e m events. e v e n t s . SR-78482 S R - 7 8 4 8 2 - - The T h e network n e t w o r k and a n d networked n e t w o r k e d equipment e q u i p m e n t shall s h a l l provide p r o v i d e data d a t a for f o r inventory, i n v e n t o r y , backup b a c k u p status, s t a t u s , health h e a l t h and a n d performance. p e r f o r m a n c e . Use U s e of o f staging s t a g i n g should s h o u l d be b e considered c o n s i d e r e d to t o avoid a v o i d unnecessary u n n e c e s s a r y exposure e x p o s u r e to t o external e x t e r n a l networks. n e t w o r k s . 4.3 4 . 3 Message M e s s a g e log l o g monitoring m o n i t o r i n g software s o f t w a r e SR-81821 S R - 8 1 8 2 1 - - The T h e message m e s s a g e log l o g monitoring m o n i t o r i n g software s o f t w a r e and a n d protocols p r o t o c o l s shall s h a l l be b e based b a s e d on o n recognised r e c o g n i s e d open o p e n standards. s t a n d a r d s . SR-78484 S R - 7 8 4 8 4 - - The T h e facility f a c i l i t y shall s h a l l have h a v e a a message m e s s a g e log l o g monitoring m o n i t o r i n g solution s o l u t i o n for f o r capture c a p t u r e and a n d storage s t o r a g e of o f message m e s s a g e logs l o g s from f r o m all a l l networked n e t w o r k e d IACS. I A C S . SR-78477 S R - 7 8 4 7 7 - - The T h e message m e s s a g e log l o g monitoring m o n i t o r i n g solution s o l u t i o n shall s h a l l provide p r o v i d e a a secure s e c u r e interface i n t e r f a c e for f o r communicating c o m m u n i c a t i n g message m e s s a g e log l o g data d a t a to t o other o t h e r Company C o m p a n y systems. s y s t e m s . SR-78478 S R - 7 8 4 7 8 - - The T h e message m e s s a g e log l o g monitoring m o n i t o r i n g solution s o l u t i o n shall s h a l l be b e able a b l e to t o save s a v e all a l l messages m e s s a g e s to t o files f i l e s on o n a a Company C o m p a n y file f i l e share. s h a r e . SR-78464 S R - 7 8 4 6 4 - - The T h e message m e s s a g e log l o g monitoring m o n i t o r i n g solution s o l u t i o n shall s h a l l include i n c l u d e a a historian h i s t o r i a n module m o d u l e for f o r capturing c a p t u r i n g and a n d storing s t o r i n g time t i m e stamped s t a m p e d equipment e q u i p m e n t data. d a t a . SR-78470 S R - 7 8 4 7 0 - - The T h e message m e s s a g e log l o g monitoring m o n i t o r i n g solution s o l u t i o n shall s h a l l as a s a a minimum m i n i m u m provide p r o v i d e the t h e following f o l l o w i n g information: i n f o r m a t i o n : 1. 1 . Equipment E q u i p m e n t capacity c a p a c i t y and a n d performance p e r f o r m a n c e 2. 2 . Equipment E q u i p m e n t health h e a l t h condition c o n d i t i o n 3. 3 . Equipment E q u i p m e n t hardware h a r d w a r e and a n d software s o f t w a r e inventory i n v e n t o r y 4. 4 . Network N e t w o r k infrastructure i n f r a s t r u c t u r e topology t o p o l o g y 5. 5 . Backup B a c k u p status s t a t u s 6. 6 . Cyber C y b e r security s e c u r i t y related r e l a t e d alarms a l a r m s and a n d events, e v e n t s , including i n c l u d i n g remote r e m o t e desktop d e s k t o p protocol p r o t o c o l usage u s a g e 4.4 4 . 4 Management M a n a g e m e n t software s o f t w a r e The T h e management m a n a g e m e n t software s o f t w a r e covers c o v e r s configuration c o n f i g u r a t i o n management m a n a g e m e n t of o f network n e t w o r k equipment e q u i p m e n t and a n d client/server c l i e n t / s e r v e r equipment. e q u i p m e n t . The T h e management m a n a g e m e n t software s o f t w a r e should s h o u l d be b e based b a s e d on o n recognised r e c o g n i s e d open o p e n standards. s t a n d a r d s . SR-86597 S R - 8 6 5 9 7 - - The T h e management m a n a g e m e n t software s o f t w a r e communication c o m m u n i c a t i o n with w i t h equipment e q u i p m e n t in i n scope s c o p e shall s h a l l utilise u t i l i s e secure s e c u r e protocols. p r o t o c o l s . SR-81833 S R - 8 1 8 3 3 - - The T h e management m a n a g e m e n t software s o f t w a r e shall s h a l l support s u p p o r t the t h e life-cycle l i f e - c y c l e of o f services s e r v i c e s needed n e e d e d to t o install, i n s t a l l , configure, c o n f i g u r e , troubleshoot, t r o u b l e s h o o t , ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ repair r e p a i r and a n d maintain m a i n t a i n equipment e q u i p m e n t throughout t h r o u g h o u t the t h e life l i f e of o f the t h e facility. f a c i l i t y . SR-81838 S R - 8 1 8 3 8 - - The T h e management m a n a g e m e n t software s o f t w a r e shall s h a l l include i n c l u d e a a module m o d u l e for f o r capturing c a p t u r i n g changes c h a n g e s to t o the t h e hardware h a r d w a r e configuration, c o n f i g u r a t i o n , back- b a c k - up u p the t h e configurations c o n f i g u r a t i o n s and a n d ability a b i l i t y to t o load l o a d them t h e m to t o the t h e hardware h a r d w a r e component. c o m p o n e n t . SR-81837 S R - 8 1 8 3 7 - - It I t shall s h a l l be b e possible p o s s i b l e to t o recover r e c o v e r configuration c o n f i g u r a t i o n data d a t a on o n the t h e management m a n a g e m e n t software s o f t w a r e from f r o m backups. b a c k u p s . Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Page P a g e 13 1 3 of o f 23 2 3 ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l 4.5 4 . 5 Identity I d e n t i t y and a n d access a c c e s s management m a n a g e m e n t software s o f t w a r e The T h e Identity I d e n t i t y and a n d access a c c e s s management m a n a g e m e n t software s o f t w a r e covers c o v e r s user u s e r access a c c e s s management m a n a g e m e n t and a n d security s e c u r i t y management m a n a g e m e n t of o f network n e t w o r k equipment e q u i p m e n t and a n d client/server c l i e n t / s e r v e r equipment. e q u i p m e n t . SR-86601 S R - 8 6 6 0 1 - - The T h e system s y s t e m shall s h a l l support s u p p o r t different d i f f e r e n t levels l e v e l s of o f user u s e r access a c c e s s rights r i g h t s to t o prevent p r e v e n t unauthorised u n a u t h o r i s e d access a c c e s s to t o system s y s t e m and a n d application a p p l i c a t i o n software. s o f t w a r e . SR-86600 S R - 8 6 6 0 0 - - The T h e system s y s t e m shall s h a l l have h a v e a a role-based r o l e - b a s e d access a c c e s s allowing a l l o w i n g assignment a s s i g n m e n t of o f users/user u s e r s / u s e r groups g r o u p s to t o roles. r o l e s . SR-86599 S R - 8 6 5 9 9 - - It I t shall s h a l l be b e possible p o s s i b l e to t o configure c o n f i g u r e the t h e access a c c e s s roles r o l e s to t o limited l i m i t e d parts p a r t s of o f the t h e system s y s t e m and/or a n d / o r limited l i m i t e d parts p a r t s of o f the t h e application a p p l i c a t i o n software. s o f t w a r e . SR-86598 S R - 8 6 5 9 8 - - The T h e identity i d e n t i t y and a n d access a c c e s s management m a n a g e m e n t software s o f t w a r e shall s h a l l include i n c l u d e functionality f u n c t i o n a l i t y for f o r cyber c y b e r security s e c u r i t y controls c o n t r o l s including i n c l u d i n g audit a u d i t controls. c o n t r o l s . As A s a a minimum m i n i m u m the t h e following f o l l o w i n g are a r e to t o be b e included: i n c l u d e d : 1. 1 . Identity I d e n t i t y management: m a n a g e m e n t : Manage M a n a g e identities i d e n t i t i e s for f o r accessing a c c e s s i n g the t h e network n e t w o r k management, m a n a g e m e n t , manage m a n a g e external e x t e r n a l account a c c o u n t service s e r v i c e connection. c o n n e c t i o n . 2. 2 . Access A c c e s s management: m a n a g e m e n t : Manage M a n a g e accesses, a c c e s s e s , roles, r o l e s , privileges p r i v i l e g e s for f o r roles, r o l e s , mapping m a p p i n g to t o identities i d e n t i t i e s 3. 3 . Accounts: A c c o u n t s : Manage M a n a g e accounts a c c o u n t s that t h a t access a c c e s s the t h e system s y s t e m management m a n a g e m e n t server s e r v e r resources r e s o u r c e s 4. 4 . Credentials C r e d e n t i a l s Management; M a n a g e m e n t ; Manage M a n a g e identity i d e n t i t y proof p r o o f levels, l e v e l s , interactions i n t e r a c t i o n s with w i t h Identity/account I d e n t i t y / a c c o u n t service s e r v i c e 5. 5 . Certificates; C e r t i f i c a t e s ; Certificate C e r t i f i c a t e Authority A u t h o r i t y 6. 6 . Access A c c e s s Management; M a n a g e m e n t ; Manage M a n a g e role-based r o l e - b a s e d privileges p r i v i l e g e s 5 5 Components C o m p o n e n t s 5.1 5 . 1 General G e n e r a l SR-86605 S R - 8 6 6 0 5 - - The T h e project p r o j e c t shall s h a l l in i n due d u e time t i m e get g e t a a final f i n a l acceptance a c c e p t a n c e from f r o m Company C o m p a n y on o n the t h e network n e t w o r k equipment e q u i p m e n t and a n d computer c o m p u t e r hardware h a r d w a r e standardisation s t a n d a r d i s a t i o n chosen. c h o s e n . SR-79188 S R - 7 9 1 8 8 - - Replacement R e p l a c e m e n t of o f redundant r e d u n d a n t hardware h a r d w a r e components c o m p o n e n t s shall s h a l l be b e possible p o s s i b l e during d u r i n g normal n o r m a l operation, o p e r a t i o n , without w i t h o u t any a n y loss l o s s of o f functionality f u n c t i o n a l i t y or o r production. p r o d u c t i o n . SR-86604 S R - 8 6 6 0 4 - - The T h e network n e t w o r k equipment e q u i p m e n t and a n d networked n e t w o r k e d computers c o m p u t e r s shall s h a l l be b e able a b l e to t o export e x p o r t message m e s s a g e logs l o g s including i n c l u d i n g alarm a l a r m and a n d events e v e n t s (security ( s e c u r i t y events e v e n t s included). i n c l u d e d ) . SR-86603 S R - 8 6 6 0 3 - - The T h e networked n e t w o r k e d components c o m p o n e n t s shall s h a l l support s u p p o r t connectivity c o n n e c t i v i t y without w i t h o u t need n e e d of o f extensive e x t e n s i v e manual m a n u a l integration i n t e g r a t i o n services. s e r v i c e s . SR-86608 S R - 8 6 6 0 8 - - The T h e networked n e t w o r k e d components c o m p o n e n t s shall s h a l l communicate c o m m u n i c a t e by b y the t h e use u s e of o f Ethernet. E t h e r n e t . SR-86607 S R - 8 6 6 0 7 - - All A l l unused u n u s e d communication c o m m u n i c a t i o n ports p o r t s on o n network n e t w o r k equipment e q u i p m e n t and a n d networked n e t w o r k e d components c o m p o n e n t s shall s h a l l be b e locked, l o c k e d , disabled d i s a b l e d or o r protected p r o t e c t e d by b y software s o f t w a r e means. m e a n s . If I f not n o t possible p o s s i b l e through t h r o u g h software, s o f t w a r e , a a physical p h y s i c a l port p o r t lock l o c k product p r o d u c t shall s h a l l be b e used. u s e d . SR-86606 S R - 8 6 6 0 6 - - The T h e network n e t w o r k equipment e q u i p m e n t and a n d networked n e t w o r k e d components c o m p o n e n t s shall s h a l l handle h a n d l e wire-speed w i r e - s p e e d network n e t w o r k storms s t o r m s gracefully, g r a c e f u l l y , i.e. i . e . network n e t w o r k port p o r t may m a y be b e shut s h u t down d o w n temporarily t e m p o r a r i l y but b u t shall s h a l l automatically a u t o m a t i c a l l y be b e re-enabled r e - e n a b l e d when w h e n the t h e storm s t o r m has h a s ended. e n d e d . ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ SR-86699 S R - 8 6 6 9 9 - - Devices D e v i c e s with w i t h a a Ethernet E t h e r n e t service s e r v i c e port; p o r t ; these t h e s e shall s h a l l be b e connected c o n n e c t e d to t o the t h e network. n e t w o r k . SR-78500 S R - 7 8 5 0 0 - - Devices D e v i c e s with w i t h a a serial/USB s e r i a l / U S B service s e r v i c e port; p o r t ; these t h e s e shall s h a l l be b e connected c o n n e c t e d to t o the t h e network n e t w o r k using u s i n g a a serial/IP s e r i a l / I P server. s e r v e r . It I t is i s not n o t necessary n e c e s s a r y to t o connect c o n n e c t multiple m u l t i p l e service s e r v i c e ports p o r t s if i f the t h e functionality f u n c t i o n a l i t y is i s already a l r e a d y taken t a k e n care c a r e of o f for f o r the t h e device. d e v i c e . SR-78501 S R - 7 8 5 0 1 - - Devices D e v i c e s with w i t h only o n l y one o n e network n e t w o r k interface i n t e r f a c e shall s h a l l support s u p p o r t both b o t h control c o n t r o l and a n d service s e r v i c e traffic. t r a f f i c . Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} solution, s o l u t i o n , including i n c l u d i n g a a HMI H M I panel p a n e l from f r o m the t h e user's u s e r ' s work w o r k desk, d e s k , for f o r open/close o p e n / c l o s e of o f predefined p r e d e f i n e d firewall f i r e w a l l rulesets. r u l e s e t s . Page P a g e 14 1 4 of o f 23 2 3 ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l 5.2 5 . 2 Standardisation S t a n d a r d i s a t i o n The T h e network n e t w o r k equipment e q u i p m e n t for f o r use u s e in i n protected p r o t e c t e d area a r e a should s h o u l d be b e from f r o m one o n e manufacturer m a n u f a c t u r e r and a n d of o f the t h e same s a m e product p r o d u c t family. f a m i l y . The T h e network n e t w o r k equipment e q u i p m e n t for f o r use u s e outside o u t s i d e protected p r o t e c t e d area a r e a should s h o u l d be b e from f r o m one o n e manufacturer m a n u f a c t u r e r and a n d of o f the t h e same s a m e product p r o d u c t family. f a m i l y . SR-79191 S R - 7 9 1 9 1 - - The T h e client c l i e n t hardware h a r d w a r e shall s h a l l be b e from f r o m one o n e manufacturer m a n u f a c t u r e r and a n d of o f the t h e same s a m e product p r o d u c t family f a m i l y within w i t h i n a a system. s y s t e m . SR-79186 S R - 7 9 1 8 6 - - The T h e server s e r v e r hardware h a r d w a r e shall s h a l l be b e from f r o m one o n e manufacturer m a n u f a c t u r e r and a n d of o f the t h e same s a m e product p r o d u c t family f a m i l y within w i t h i n a a system. s y s t e m . SR-86610 S R - 8 6 6 1 0 - - The T h e network n e t w o r k equipment e q u i p m e n t and a n d computer c o m p u t e r hardware h a r d w a r e shall s h a l l be b e commercial c o m m e r c i a l of o f the t h e shelf s h e l f products p r o d u c t s that t h a t are a r e suitable s u i t a b l e for f o r its i t s intended i n t e n d e d use. u s e . 5.3 5 . 3 Network N e t w o r k equipment e q u i p m e n t SR-86611 S R - 8 6 6 1 1 - - The T h e network n e t w o r k equipment e q u i p m e n t shall s h a l l support s u p p o r t the t h e communication c o m m u n i c a t i o n protocol p r o t o c o l used. u s e d . SR-79202 S R - 7 9 2 0 2 - - The T h e network n e t w o r k equipment e q u i p m e n t shall s h a l l have h a v e rack r a c k or o r DIN D I N rail r a i l mount. m o u n t . SR-79200 S R - 7 9 2 0 0 - - The T h e network n e t w o r k equipment e q u i p m e n t shall s h a l l have h a v e minimum m i n i m u m 2 2 up-link u p - l i n k ports. p o r t s . SR-79199 S R - 7 9 1 9 9 - - The T h e internal i n t e r n a l power p o w e r supplies s u p p l i e s in i n the t h e network n e t w o r k equipment e q u i p m e n t shall s h a l l be b e active a c t i v e redundant. r e d u n d a n t . SR-79208 S R - 7 9 2 0 8 - - The T h e network n e t w o r k equipment e q u i p m e n t for f o r use u s e outside o u t s i d e protected p r o t e c t e d area a r e a shall s h a l l be b e fan-less. f a n - l e s s . SR-79207 S R - 7 9 2 0 7 - - The T h e network n e t w o r k equipment e q u i p m e n t used u s e d in i n the t h e core c o r e or o r distribution d i s t r i b u t i o n networks n e t w o r k s shall s h a l l have h a v e minimum m i n i m u m 1 1 Gigabit/s G i g a b i t / s bandwidth b a n d w i d t h on o n uplinks u p l i n k s and a n d edge e d g e ports. p o r t s . SR-79210 S R - 7 9 2 1 0 - - The T h e network n e t w o r k equipment e q u i p m e n t shall s h a l l be b e able a b l e to t o be b e managed m a n a g e d from f r o m the t h e management m a n a g e m e n t software. s o f t w a r e . SR-79212 S R - 7 9 2 1 2 - - The T h e network n e t w o r k equipment e q u i p m e n t shall s h a l l do d o automatic a u t o m a t i c startup s t a r t u p with w i t h correct c o r r e c t configuration c o n f i g u r a t i o n without w i t h o u t any a n y user u s e r intervention i n t e r v e n t i o n after a f t e r loss l o s s of o f power. p o w e r . SR-79209 S R - 7 9 2 0 9 - - The T h e network n e t w o r k equipment’s e q u i p m e n t ’ s configuration c o n f i g u r a t i o n shall s h a l l be b e available a v a i l a b l e for f o r online o n l i n e or o r offline o f f l i n e upload u p l o a d after a f t e r replacement r e p l a c e m e n t of o f component. c o m p o n e n t . SR-81377 S R - 8 1 3 7 7 - - Where W h e r e redbox r e d b o x functionality f u n c t i o n a l i t y is i s needed; n e e d e d ; the t h e edge e d g e switch s w i t c h shall s h a l l support s u p p o r t redbox r e d b o x functionality. f u n c t i o n a l i t y . 5.3.1 5 . 3 . 1 Firewalls F i r e w a l l s SR-78016 S R - 7 8 0 1 6 - - Firewalls F i r e w a l l s shall s h a l l deny d e n y data d a t a flow f l o w by b y default. d e f a u l t . SR-78015 S R - 7 8 0 1 5 - - All A l l data d a t a flows f l o w s shall s h a l l explicitly e x p l i c i t l y be b e configured c o n f i g u r e d in i n the t h e firewall f i r e w a l l rulesets. r u l e s e t s . SR-78021 S R - 7 8 0 2 1 - - The T h e main m a i n firewall f i r e w a l l solutions s o l u t i o n s at a t Level L e v e l 3 3 Technical T e c h n i c a l network, n e t w o r k , Level L e v e l 3 3 SAS S A S Technical T e c h n i c a l network n e t w o r k and a n d Level L e v e l 2 2 Technical T e c h n i c a l network n e t w o r k shall s h a l l be b e redundant r e d u n d a n t firewall f i r e w a l l cluster c l u s t e r solutions s o l u t i o n s with w i t h state s t a t e synchronisation s y n c h r o n i s a t i o n that t h a t support s u p p o r t Deep D e e p Package P a c k a g e Inspection I n s p e c t i o n (DPI) ( D P I ) and a n d Intrusion I n t r u s i o n Detection D e t e c t i o n System S y s t e m (IDS). ( I D S ) . SR-84565 S R - 8 4 5 6 5 - - The T h e management m a n a g e m e n t interface i n t e r f a c e of o f the t h e firewalls f i r e w a l l s shall s h a l l be b e protected. p r o t e c t e d . SR-86649 S R - 8 6 6 4 9 - - The T h e main m a i n firewall f i r e w a l l at a t Level L e v e l 2 2 Technical T e c h n i c a l network n e t w o r k shall s h a l l be b e integrated i n t e g r a t e d with w i t h an a n independent i n d e p e n d e n t managed m a n a g e d barrier b a r r i e r ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} SR-92429 S R - 9 2 4 2 9 - - Virtual V i r t u a l hardware h a r d w a r e allocation a l l o c a t i o n shall s h a l l be b e in i n accordance a c c o r d a n c e to t o actual a c t u a l needs n e e d s and a n d have h a v e the t h e capacity c a p a c i t y to t o handle h a n d l e predicted p r e d i c t e d Page P a g e 15 1 5 of o f 23 2 3 ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l 5.4 5 . 4 Computers C o m p u t e r s 5.4.1 5 . 4 . 1 Servers S e r v e r s SR-77781 S R - 7 7 7 8 1 - - Server S e r v e r hardware h a r d w a r e with w i t h server s e r v e r operating o p e r a t i n g system s y s t e m shall s h a l l be b e used u s e d as a s run-time r u n - t i m e environment e n v i r o n m e n t when w h e n Level L e v e l 2 2 or o r Level L e v e l 3 3 application a p p l i c a t i o n software s o f t w a r e demands d e m a n d s for f o r 24x7 2 4 x 7 operation. o p e r a t i o n . SR-77780 S R - 7 7 7 8 0 - - Server S e r v e r hardware h a r d w a r e shall s h a l l run r u n a a virtualisation v i r t u a l i s a t i o n environment. e n v i r o n m e n t . SR-78010 S R - 7 8 0 1 0 - - Server S e r v e r hardware h a r d w a r e shall s h a l l include i n c l u d e a a dedicated d e d i c a t e d out-of-band o u t - o f - b a n d management m a n a g e m e n t interface. i n t e r f a c e . SR-79217 S R - 7 9 2 1 7 - - The T h e server s e r v e r hardware h a r d w a r e shall s h a l l have h a v e rack r a c k or o r DIN D I N rail r a i l mount. m o u n t . SR-79216 S R - 7 9 2 1 6 - - The T h e server s e r v e r hardware h a r d w a r e shall s h a l l be b e fault f a u l t tolerant t o l e r a n t against a g a i n s t disk d i s k failures f a i l u r e s and a n d with w i t h automatic a u t o m a t i c online o n l i n e recovery r e c o v e r y when w h e n replacing r e p l a c i n g a a disk. d i s k . SR-79215 S R - 7 9 2 1 5 - - The T h e internal i n t e r n a l power p o w e r supplies s u p p l i e s and a n d fans f a n s in i n the t h e server s e r v e r hardware h a r d w a r e shall s h a l l be b e active a c t i v e redundant. r e d u n d a n t . SR-78032 S R - 7 8 0 3 2 - - All A l l application a p p l i c a t i o n software s o f t w a r e with w i t h a a demand d e m a n d for f o r 24x7 2 4 x 7 operation o p e r a t i o n installed i n s t a l l e d in i n the t h e server s e r v e r shall s h a l l run r u n as a s a a service s e r v i c e in i n the t h e background, b a c k g r o u n d , independently i n d e p e n d e n t l y whether w h e t h e r interface i n t e r f a c e user u s e r is i s logged l o g g e d in i n or o r out o u t to t o the t h e applications. a p p l i c a t i o n s . 5.4.2 5 . 4 . 2 Clients C l i e n t s SR-77779 S R - 7 7 7 7 9 - - Client C l i e n t hardware h a r d w a r e with w i t h end e n d user u s e r operating o p e r a t i n g system s y s t e m shall s h a l l be b e used u s e d when w h e n functionality f u n c t i o n a l i t y is i s to t o provide p r o v i d e HMI H M I to t o users u s e r s working w o r k i n g in i n protected p r o t e c t e d area. a r e a . Some S o m e HMIs H M I s may m a y be b e delivered d e l i v e r e d as a s built-in b u i l t - i n panels, p a n e l s , included i n c l u d e d as a s part p a r t of o f PLCs P L C s etc, e t c , thereby t h e r e b y not n o t using u s i n g standard s t a n d a r d client c l i e n t hardware. h a r d w a r e . SR-77782 S R - 7 7 7 8 2 - - Clients C l i e n t s shall s h a l l run r u n as a s bare b a r e metal m e t a l installation, i n s t a l l a t i o n , no n o virtualisation v i r t u a l i s a t i o n required. r e q u i r e d . The T h e client c l i e n t hardware h a r d w a r e may m a y be b e removed r e m o v e d if i f the t h e system s y s t e m solves s o l v e s the t h e same s a m e with w i t h a a virtual v i r t u a l computer c o m p u t e r as a s part p a r t of o f a a Server S e r v e r hardware. h a r d w a r e . 5.4.3 5 . 4 . 3 Virtual V i r t u a l computers c o m p u t e r s SR-86609 S R - 8 6 6 0 9 - - Virtual V i r t u a l machines m a c h i n e s shall s h a l l run r u n on o n a a server s e r v e r hardware. h a r d w a r e . SR-78012 S R - 7 8 0 1 2 - - A A dedicated d e d i c a t e d physical p h y s i c a l network n e t w o r k port p o r t shall s h a l l be b e used u s e d in i n the t h e server s e r v e r hardware h a r d w a r e for f o r connecting c o n n e c t i n g the t h e Hypervisor H y p e r v i s o r management m a n a g e m e n t interface i n t e r f a c e to t o the t h e relevant r e l e v a n t management m a n a g e m e n t system. s y s t e m . SR-92430 S R - 9 2 4 3 0 - - If I f a a Hypervisor H y p e r v i s o r cluster c l u s t e r is i s installed i n s t a l l e d for f o r redundancy, r e d u n d a n c y , redundancy r e d u n d a n c y on o n management m a n a g e m e n t shall s h a l l be b e implemented i m p l e m e n t e d according a c c o r d i n g to t o best b e s t practice p r a c t i c e from f r o m the t h e applicable a p p l i c a b l e Hypervisor H y p e r v i s o r vendor. v e n d o r . SR-78008 S R - 7 8 0 0 8 - - Virtual V i r t u a l machines m a c h i n e s shall s h a l l be b e supplied s u p p l i e d in i n Open O p e n Virtualization V i r t u a l i z a t i o n Format F o r m a t (OVF) ( O V F ) if i f the t h e virtual v i r t u a l machine m a c h i n e is i s to t o be b e implemented i m p l e m e n t e d on o n a a Hypervisor H y p e r v i s o r from f r o m another a n o t h e r delivery. d e l i v e r y . SR-78007 S R - 7 8 0 0 7 - - All A l l virtual v i r t u a l disks d i s k s shall s h a l l be b e thick t h i c k provisioned p r o v i s i o n e d Lazy L a z y zeroed. z e r o e d . Thick T h i c k provisioned p r o v i s i o n e d Eager E a g e r zeroed z e r o e d virtual v i r t u a l disks d i s k s may m a y be b e used u s e d if i f vendor v e n d o r application a p p l i c a t i o n requires r e q u i r e s it. i t . growth. g r o w t h . ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} procedure p r o c e d u r e for f o r update u p d a t e and a n d scanning s c a n n i n g shall s h a l l be b e made m a d e and a n d executed. e x e c u t e d . Page P a g e 16 1 6 of o f 23 2 3 ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l 5.5 5 . 5 Provisioning P r o v i s i o n i n g of o f new n e w devices d e v i c e s / / replacement r e p l a c e m e n t of o f devices d e v i c e s SR-78024 S R - 7 8 0 2 4 - - Supplier S u p p l i e r shall s h a l l provide p r o v i d e a a procedure, p r o c e d u r e , and a n d necessary n e c e s s a r y hardware h a r d w a r e and a n d software s o f t w a r e (e.g. ( e . g . cables, c a b l e s , converters, c o n v e r t e r s , drivers), d r i v e r s ) , used u s e d for f o r initial i n i t i a l provisioning p r o v i s i o n i n g of o f replacement r e p l a c e m e n t parts p a r t s (i.e. ( i . e . a a new n e w out-of-the-box o u t - o f - t h e - b o x device). d e v i c e ) . SR-78023 S R - 7 8 0 2 3 - - The T h e provisioning p r o v i s i o n i n g of o f the t h e new n e w device d e v i c e shall s h a l l be b e done d o n e using u s i n g applications a p p l i c a t i o n s on o n the t h e EWS. E W S . SR-78027 S R - 7 8 0 2 7 - - The T h e provisioning p r o v i s i o n i n g procedure p r o c e d u r e shall s h a l l include i n c l u d e enabling e n a b l i n g of o f ports, p o r t s , configuring c o n f i g u r i n g IP I P addresses a d d r e s s e s and a n d other o t h e r details d e t a i l s necessary n e c e s s a r y for f o r the t h e new n e w device d e v i c e to t o be b e inserted i n s e r t e d into i n t o the t h e network n e t w o r k and a n d receive r e c e i v e its i t s main m a i n configuration c o n f i g u r a t i o n from f r o m the t h e EWS. E W S . SR-78026 S R - 7 8 0 2 6 - - Initial I n i t i a l configuration c o n f i g u r a t i o n using u s i n g a a network n e t w o r k cable c a b l e shall s h a l l be b e preferred p r e f e r r e d over o v e r USB. U S B . 6 6 Backup B a c k u p and a n d recovery r e c o v e r y SR-78034 S R - 7 8 0 3 4 - - The T h e facility f a c i l i t y shall s h a l l provide p r o v i d e for f o r shared s h a r e d backup b a c k u p solution s o l u t i o n for f o r the t h e network n e t w o r k connected c o n n e c t e d systems. s y s t e m s . SR-78033 S R - 7 8 0 3 3 - - Larger L a r g e r infrastructures i n f r a s t r u c t u r e s (e.g. ( e . g . SAS) S A S ) shall s h a l l provide p r o v i d e their t h e i r own o w n internal i n t e r n a l backup b a c k u p solution s o l u t i o n which w h i c h may m a y utilize u t i l i z e the t h e shared s h a r e d facility f a c i l i t y solution s o l u t i o n for f o r offline o f f l i n e backup. b a c k u p . SR-78036 S R - 7 8 0 3 6 - - To T o reduce r e d u c e the t h e amount a m o u n t of o f data d a t a being b e i n g synchronized s y n c h r o n i z e d to t o onshore o n s h o r e centralized c e n t r a l i z e d storage s t o r a g e for f o r offsite o f f s i t e backup, b a c k u p , systems s y s t e m s shall s h a l l use u s e block b l o c k level l e v e l backup b a c k u p rotation r o t a t i o n when w h e n offline o f f l i n e backup b a c k u p is i s copied c o p i e d to t o the t h e shared s h a r e d facility f a c i l i t y solution. s o l u t i o n . SR-79219 S R - 7 9 2 1 9 - - The T h e components c o m p o n e n t s configuration c o n f i g u r a t i o n shall s h a l l be b e available a v a i l a b l e for f o r online o n l i n e or o r offline o f f l i n e upload u p l o a d after a f t e r replacement r e p l a c e m e n t of o f equipment. e q u i p m e n t . 7 7 Testing T e s t i n g 7.1 7 . 1 Test T e s t during d u r i n g implementation i m p l e m e n t a t i o n SR-78784 S R - 7 8 7 8 4 - - During D u r i n g the t h e implementation i m p l e m e n t a t i o n of o f a a system s y s t e m it i t shall s h a l l be b e planned p l a n n e d for f o r a a Cyber C y b e r Security S e c u r i t y and a n d Network N e t w o r k test. t e s t . SR-78788 S R - 7 8 7 8 8 - - It I t is i s required r e q u i r e d that t h a t supplier s u p p l i e r tests t e s t s specifications s p e c i f i c a t i o n s are a r e extended e x t e n d e d to t o include i n c l u d e test t e s t procedure p r o c e d u r e and a n d expected e x p e c t e d results. r e s u l t s . 7.2 7 . 2 Test T e s t during d u r i n g commissioning c o m m i s s i o n i n g SR-78787 S R - 7 8 7 8 7 - - When W h e n the t h e system s y s t e m is i s delivered d e l i v e r e d and a n d to t o be b e powered p o w e r e d up u p for f o r commissioning c o m m i s s i o n i n g activities a c t i v i t i e s it i t shall s h a l l be b e planned p l a n n e d for f o r necessary n e c e s s a r y activities a c t i v i t i e s to t o ensure e n s u r e remaining r e m a i n i n g interface i n t e r f a c e and a n d communication c o m m u n i c a t i o n connections c o n n e c t i o n s are a r e done. d o n e . SR-78786 S R - 7 8 7 8 6 - - To T o ensure e n s u r e the t h e integrity i n t e g r i t y of o f the t h e delivered d e l i v e r e d system s y s t e m before b e f o r e connecting c o n n e c t i n g it i t to t o the t h e network n e t w o r k a a Cyber C y b e r Security S e c u r i t y ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ 8 8 Additional A d d i t i o n a l information i n f o r m a t i o n ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ 8.1 8 . 1 Definition D e f i n i t i o n and a n d abbreviations a b b r e v i a t i o n s 8.1.1 8 . 1 . 1 Definitions D e f i n i t i o n s Application A p p l i c a t i o n In I n this t h i s document, d o c u m e n t , this t h i s word w o r d refers r e f e r s to t o software s o f t w a r e applications a p p l i c a t i o n s which w h i c h are a r e installed i n s t a l l e d on o n a a general-purpose g e n e r a l - p u r p o s e Operating O p e r a t i n g System. S y s t e m . ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Application A p p l i c a t i o n software s o f t w a r e Production P r o d u c t i o n facility f a c i l i t y specific s p e c i f i c run-time r u n - t i m e applications a p p l i c a t i o n s I I configuration c o n f i g u r a t i o n Availability A v a i l a b i l i t y Property P r o p e r t y of o f ensuring e n s u r i n g timely t i m e l y and a n d reliable r e l i a b l e access a c c e s s to t o and a n d use u s e of o f control c o n t r o l system s y s t e m information i n f o r m a t i o n and a n d functionality. f u n c t i o n a l i t y . (Source: ( S o u r c e : IEC I E C Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Page P a g e 17 1 7 of o f 23 2 3 ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l 62443-1-1:2007) 6 2 4 4 3 - 1 - 1 : 2 0 0 7 ) Block B l o c k level l e v e l backup b a c k u p In I n block-level b l o c k - l e v e l incremental i n c r e m e n t a l backups, b a c k u p s , the t h e backup b a c k u p software s o f t w a r e identifies i d e n t i f i e s the t h e data d a t a blocks b l o c k s that t h a t have h a v e been b e e n changed c h a n g e d since s i n c e the t h e most m o s t recent r e c e n t backup b a c k u p job j o b and a n d copies c o p i e s them t h e m to t o the t h e backup b a c k u p repository. r e p o s i t o r y . Block-level B l o c k - l e v e l tracking t r a c k i n g allows a l l o w s a a more m o r e granular g r a n u l a r approach a p p r o a c h compared c o m p a r e d to t o backing b a c k i n g up u p entire e n t i r e files, f i l e s , as a s in i n file-level f i l e - l e v e l incremental i n c r e m e n t a l backup. b a c k u p . BPDU B P D U guard g u a r d PortFast P o r t F a s t BPDU B P D U guard g u a r d prevents p r e v e n t s loops l o o p s by b y moving m o v i n g a a non-trunking n o n - t r u n k i n g port p o r t into i n t o an a n "errdisable " e r r d i s a b l e state" s t a t e " when w h e n a a BPDU B P D U is i s received r e c e i v e d on o n that t h a t port. p o r t . When W h e n you y o u enable e n a b l e BPDU B P D U guard g u a r d on o n the t h e switch, s w i t c h , spanning s p a n n i n g tree t r e e shuts s h u t s down d o w n PortFast-configured P o r t F a s t - c o n f i g u r e d interfaces i n t e r f a c e s that t h a t receive r e c e i v e BPDUs B P D U s instead i n s t e a d of o f putting p u t t i n g them t h e m into i n t o the t h e spanning s p a n n i n g tree t r e e blocking b l o c k i n g state. s t a t e . Can C a n Statements S t a t e m e n t s of o f possibility p o s s i b i l i t y and a n d capability, c a p a b i l i t y , whether w h e t h e r material, m a t e r i a l , physical p h y s i c a l or o r causal. c a u s a l . (Source: ( S o u r c e : Company C o m p a n y Management M a n a g e m e n t system) s y s t e m ) Client C l i e n t When W h e n preceding p r e c e d i n g the t h e word w o r d “Computer”, “ C o m p u t e r ” , a a “Client “ C l i e n t Computer” C o m p u t e r ” means m e a n s a a computer c o m p u t e r which w h i c h is i s typically t y p i c a l l y used u s e d to t o access a c c e s s other o t h e r Components, C o m p o n e n t s , for f o r operation o p e r a t i o n or o r maintenance m a i n t e n a n c e tasks t a s k s such s u c h as a s troubleshooting, t r o u b l e s h o o t i n g , diagnostics d i a g n o s t i c s or o r configuration. c o n f i g u r a t i o n . A A Client C l i e n t Computer C o m p u t e r does d o e s not n o t need n e e d to t o run r u n 24/7, 2 4 / 7 , and a n d applications a p p l i c a t i o n s can c a n depend d e p e n d on o n a a user u s e r session s e s s i o n (i.e. ( i . e . a a human h u m a n user u s e r logged l o g g e d in) i n ) to t o be b e started. s t a r t e d . The T h e word w o r d “Client” “ C l i e n t ” may m a y also a l s o be b e used u s e d about a b o u t one o n e of o f the t h e two t w o roles r o l e s (“Client” ( “ C l i e n t ” or o r “Server”) “ S e r v e r ” ) in i n a a network n e t w o r k protocol p r o t o c o l connection, c o n n e c t i o n , such s u c h as a s “SSH “ S S H Client”. C l i e n t ” . In I n this t h i s meaning, m e a n i n g , the t h e protocol p r o t o c o l name n a m e is i s always a l w a y s preceding p r e c e d i n g the t h e word w o r d “Client”. “ C l i e n t ” . The T h e term t e r m “Client “ C l i e n t Application” A p p l i c a t i o n ” may m a y also a l s o be b e used. u s e d . This T h i s means m e a n s that t h a t the t h e application a p p l i c a t i o n has h a s a a Client C l i e n t I I Server S e r v e r architecture, a r c h i t e c t u r e , and a n d the t h e “Client “ C l i e n t Application” A p p l i c a t i o n ” refers r e f e r s to t o one o n e of o f the t h e two t w o peers p e e r s of o f this t h i s application a p p l i c a t i o n architecture. a r c h i t e c t u r e . Company C o m p a n y Equinor E q u i n o r Components C o m p o n e n t s A A common c o m m o n term t e r m for f o r Computers, C o m p u t e r s , Devices D e v i c e s and a n d Network N e t w o r k Equipment. E q u i p m e n t . Computer C o m p u t e r A A Commercial-Off-The-Shelf C o m m e r c i a l - O f f - T h e - S h e l f (COTS) ( C O T S ) computer c o m p u t e r running r u n n i n g a a general-purpose g e n e r a l - p u r p o s e operating o p e r a t i n g system s y s t e m like l i k e Windows W i n d o w s Server, S e r v e r , Windows W i n d o w s LTSC L T S C or o r Linux L i n u x based b a s e d operating o p e r a t i n g systems s y s t e m s such s u c h as a s (but ( b u t not n o t limited l i m i t e d to) t o ) Ubuntu U b u n t u Server, S e r v e r , RedHat R e d H a t Server S e r v e r etc. e t c . The T h e word w o r d “Computer” “ C o m p u t e r ” reflects r e f l e c t s an a n instance i n s t a n c e of o f an a n operating o p e r a t i n g system, s y s t e m , and a n d this t h i s can c a n be b e installed i n s t a l l e d either e i t h e r on o n a a dedicated, d e d i c a t e d , physical p h y s i c a l computer, c o m p u t e r , or o r on o n a a virtual v i r t u a l computer c o m p u t e r (also ( a l s o referred r e f e r r e d to t o as a s a a “Virtual “ V i r t u a l Machine”). M a c h i n e ” ) . Note N o t e that t h a t a a rugged r u g g e d / / industrial i n d u s t r i a l computer c o m p u t e r built b u i l t on o n the t h e Intel I n t e l / / AMD A M D CPU C P U architecture, a r c h i t e c t u r e , and a n d running r u n n i n g the t h e Operating O p e r a t i n g Systems S y s t e m s mentioned m e n t i o n e d above, a b o v e , are a r e also a l s o considered c o n s i d e r e d a a “Computer”. “ C o m p u t e r ” . Conduit C o n d u i t A A conduit c o n d u i t regulates r e g u l a t e s communication c o m m u n i c a t i o n between b e t w e e n one o n e or o r more m o r e devices d e v i c e s in i n the t h e same s a m e security s e c u r i t y zone z o n e or o r different d i f f e r e n t security s e c u r i t y zones. z o n e s . A A conduit c o n d u i t within w i t h i n a a security s e c u r i t y zone z o n e could c o u l d be b e the t h e control c o n t r o l center c e n t e r LAN. L A N . A A conduit c o n d u i t between b e t w e e n two t w o zones z o n e s could c o u l d be b e the t h e WAN W A N connection c o n n e c t i o n between b e t w e e n the t h e primary p r i m a r y and a n d backup b a c k u p control c o n t r o l centers. c e n t e r s . Conduits C o n d u i t s can c a n be b e trusted t r u s t e d or o r untrusted. u n t r u s t e d . Each E a c h conduit c o n d u i t is i s assigned a s s i g n e d a a security s e c u r i t y level. l e v e l . ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ From F r o m IEC62443-1-1 I E C 6 2 4 4 3 - 1 - 1 (chap ( c h a p 10.2.3): 1 0 . 2 . 3 ) : Information I n f o r m a t i o n must m u s t flow f l o w into, i n t o , out o u t of, o f , and a n d within w i t h i n a a security s e c u r i t y zone. z o n e . Even E v e n in i n a a non-networked n o n - n e t w o r k e d system, s y s t e m , some s o m e communication c o m m u n i c a t i o n exists e x i s t s (e.g., ( e . g . , intermittent i n t e r m i t t e n t connection c o n n e c t i o n of o f programming p r o g r a m m i n g devices d e v i c e s to t o create c r e a t e and a n d maintain m a i n t a i n the t h e systems). s y s t e m s ) . To T o cover c o v e r the t h e security s e c u r i t y aspects a s p e c t s of o f communication c o m m u n i c a t i o n and a n d to t o provide p r o v i d e a a construct c o n s t r u c t to t o encompass e n c o m p a s s the t h e unique u n i q u e requirements r e q u i r e m e n t s of o f communications, c o m m u n i c a t i o n s , this t h i s standard s t a n d a r d is i s defining d e f i n i n g a a special s p e c i a l type t y p e of o f security s e c u r i t y zone: z o n e : a a communications c o m m u n i c a t i o n s conduit. c o n d u i t . Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Page P a g e 18 1 8 of o f 23 2 3 ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l A A conduit c o n d u i t can c a n be b e a a single s i n g l e service s e r v i c e (i.e., ( i . e . , a a single s i n g l e Ethernet E t h e r n e t network) n e t w o r k ) or o r can c a n be b e made m a d e up u p of o f multiple m u l t i p l e data d a t a carriers c a r r i e r s (multiple ( m u l t i p l e network n e t w o r k cables c a b l e s and a n d direct d i r e c t physical p h y s i c a l accesses). a c c e s s e s ) . As A s with w i t h zones, z o n e s , it i t can c a n be b e made m a d e of o f both b o t h physical p h y s i c a l and a n d logical l o g i c a l constructs. c o n s t r u c t s . Conduits C o n d u i t s may m a y connect c o n n e c t entities e n t i t i e s within w i t h i n a a zone z o n e or o r may m a y connect c o n n e c t different d i f f e r e n t zones. z o n e s . As A s with w i t h zones, z o n e s , conduits c o n d u i t s may m a y be b e either e i t h e r trusted t r u s t e d or o r untrusted. u n t r u s t e d . Conduits C o n d u i t s that t h a t do d o not n o t cross c r o s s zone z o n e boundaries b o u n d a r i e s are a r e typically t y p i c a l l y trusted t r u s t e d by b y the t h e communicating c o m m u n i c a t i n g processes p r o c e s s e s within w i t h i n the t h e zone. z o n e . Trusted T r u s t e d conduits c o n d u i t s crossing c r o s s i n g zone z o n e boundaries b o u n d a r i e s must m u s t use u s e an a n end-to- e n d - t o - end e n d secure s e c u r e process. p r o c e s s . Untrusted U n t r u s t e d conduits c o n d u i t s are a r e those t h o s e that t h a t are a r e not n o t at a t the t h e same s a m e level l e v e l of o f security s e c u r i t y as a s the t h e zone z o n e endpoint. e n d p o i n t . In I n this t h i s case c a s e the t h e security s e c u r i t y of o f the t h e communication c o m m u n i c a t i o n becomes b e c o m e s the t h e responsibility r e s p o n s i b i l i t y of o f the t h e individual i n d i v i d u a l channel. c h a n n e l . Further F u r t h e r information i n f o r m a t i o n on o n this t h i s scenario s c e n a r i o is i s available a v a i l a b l e in i n the t h e Annex. A n n e x . A A conduit c o n d u i t regulates r e g u l a t e s communication c o m m u n i c a t i o n between b e t w e e n one o n e or o r more m o r e devices d e v i c e s in i n the t h e same s a m e security s e c u r i t y zone z o n e or o r different d i f f e r e n t security s e c u r i t y zones. z o n e s . A A conduit c o n d u i t within w i t h i n a a security s e c u r i t y zone z o n e could c o u l d be b e the t h e control c o n t r o l center c e n t e r LAN. L A N . A A conduit c o n d u i t between b e t w e e n two t w o zones z o n e s could c o u l d be b e the t h e WAN W A N connection c o n n e c t i o n between b e t w e e n the t h e primary p r i m a r y and a n d backup b a c k u p control c o n t r o l centers. c e n t e r s . Conduits C o n d u i t s can c a n be b e trusted t r u s t e d or o r untrusted. u n t r u s t e d . Each E a c h conduit c o n d u i t is i s assigned a s s i g n e d a a security s e c u r i t y level. l e v e l . Data D a t a Representation R e p r e s e n t a t i o n of o f facts, f a c t s , concepts, c o n c e p t s , or o r instructions i n s t r u c t i o n s in i n a a manner m a n n e r suitable s u i t a b l e for f o r communication, c o m m u n i c a t i o n , interpretation, i n t e r p r e t a t i o n , or o r processing p r o c e s s i n g by b y humans h u m a n s or o r by b y automatic a u t o m a t i c means. m e a n s . (Source: ( S o u r c e : ISO/IEC/IEEE I S O / I E C / I E E E 24765:2017). 2 4 7 6 5 : 2 0 1 7 ) . Data D a t a link l i n k Means M e a n s of o f connecting c o n n e c t i n g one o n e networked n e t w o r k e d device d e v i c e to t o another a n o t h e r for f o r the t h e purpose p u r p o s e of o f transmitting t r a n s m i t t i n g and a n d receiving r e c e i v i n g digital d i g i t a l information. i n f o r m a t i o n . Devices D e v i c e s Devices, D e v i c e s , also a l s o referred r e f e r r e d to t o as a s “Embedded “ E m b e d d e d Devices”, D e v i c e s ” , are a r e components c o m p o n e n t s such s u c h as a s (but ( b u t not n o t limited l i m i t e d to) t o ) PLCs, P L C s , VSD V S D controllers, c o n t r o l l e r s , Motor M o t o r starters, s t a r t e r s , Thyristor T h y r i s t o r controllers, c o n t r o l l e r s , Flow F l o w computers, c o m p u t e r s , lEDs, l E D s , Serial S e r i a l servers, s e r v e r s , Communication C o m m u n i c a t i o n devices, d e v i c e s , Advanced A d v a n c e d analysers a n a l y s e r s etc. e t c . A A “Device” “ D e v i c e ” is i s basically b a s i c a l l y any a n y configurable c o n f i g u r a b l e I I programmable p r o g r a m m a b l e Component C o m p o n e n t which w h i c h is i s not n o t considered c o n s i d e r e d a a “Computer” “ C o m p u t e r ” or o r “Network “ N e t w o r k Equipment”. E q u i p m e n t ” . Note N o t e that t h a t Windows W i n d o w s CE C E (Compact ( C o m p a c t Embedded), E m b e d d e d ) , or o r Windows W i n d o w s loT l o T Core, C o r e , are a r e not n o t considered c o n s i d e r e d general-purpose g e n e r a l - p u r p o s e Operating O p e r a t i n g Systems. S y s t e m s . Components C o m p o n e n t s running r u n n i n g these t h e s e operating o p e r a t i n g systems s y s t e m s (typically ( t y p i c a l l y local l o c a l HMI H M I Panels) P a n e l s ) are a r e considered c o n s i d e r e d “Devices”. “ D e v i c e s ” . Distribution D i s t r i b u t i o n network n e t w o r k layer l a y e r The T h e distribution d i s t r i b u t i o n layer l a y e r aggregates a g g r e g a t e s the t h e uplinks u p l i n k s from f r o m the t h e edge e d g e (also ( a l s o called c a l l e d access) a c c e s s ) layer l a y e r to t o the t h e core c o r e network n e t w o r k layer. l a y e r . See S e e "Network " N e t w o r k distribution d i s t r i b u t i o n switch". s w i t c h " . End E n d user u s e r In I n product p r o d u c t development, d e v e l o p m e n t , an a n end e n d user u s e r (sometimes ( s o m e t i m e s end-user) e n d - u s e r ) is i s a a person p e r s o n who w h o ultimately u l t i m a t e l y uses u s e s or o r is i s intended i n t e n d e d to t o ultimately u l t i m a t e l y use u s e a a product. p r o d u c t . The T h e end e n d user u s e r stands s t a n d s in i n contrast c o n t r a s t to t o users u s e r s who w h o support s u p p o r t or o r maintain m a i n t a i n the t h e product. p r o d u c t . Engineering E n g i n e e r i n g Work W o r k Station S t a t i o n The T h e maintenance m a i n t e n a n c e stations s t a t i o n s for f o r industrial i n d u s t r i a l control c o n t r o l systems s y s t e m s where w h e r e system s y s t e m management m a n a g e m e n t and a n d application a p p l i c a t i o n software s o f t w a r e engineering, e n g i n e e r i n g , ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ configuration, c o n f i g u r a t i o n , testing t e s t i n g and a n d surveillance s u r v e i l l a n c e are a r e performed. p e r f o r m e d . Firewall F i r e w a l l A A network n e t w o r k security s e c u r i t y system s y s t e m that t h a t monitors m o n i t o r s and a n d controls c o n t r o l s incoming i n c o m i n g and a n d outgoing o u t g o i n g network n e t w o r k traffic t r a f f i c based b a s e d on o n predetermined p r e d e t e r m i n e d security s e c u r i t y rules. r u l e s . A A firewall f i r e w a l l typically t y p i c a l l y establishes e s t a b l i s h e s a a barrier b a r r i e r between b e t w e e n a a trusted t r u s t e d internal i n t e r n a l network n e t w o r k and a n d untrusted u n t r u s t e d external e x t e r n a l network. n e t w o r k . (Source; ( S o u r c e ; Wikipedia) W i k i p e d i a ) Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Page P a g e 19 1 9 of o f 23 2 3 ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l High H i g h Availability A v a i l a b i l i t y A A characteristic c h a r a c t e r i s t i c of o f a a system, s y s t e m , which w h i c h aims a i m s to t o ensure e n s u r e an a n agreed a g r e e d level l e v e l of o f operational o p e r a t i o n a l performance, p e r f o r m a n c e , usually u s u a l l y uptime, u p t i m e , for f o r a a higher h i g h e r than t h a n normal n o r m a l period. p e r i o d . (Source; ( S o u r c e ; Wikipedia) W i k i p e d i a ) Human-Machine H u m a n - M a c h i n e Interface I n t e r f a c e (HMI) ( H M I ) Provides P r o v i d e s the t h e physical p h y s i c a l interface i n t e r f a c e between b e t w e e n technical t e c h n i c a l systems s y s t e m s and a n d the t h e personnel p e r s o n n e l operating o p e r a t i n g and a n d maintaining m a i n t a i n i n g the t h e production p r o d u c t i o n facility, f a c i l i t y , e.g. e . g . operator o p e r a t o r stations, s t a t i o n s , large l a r g e screen s c r e e n displays, d i s p l a y s , critical c r i t i c a l action a c t i o n panels p a n e l s present p r e s e n t in i n control c o n t r o l rooms, r o o m s , local l o c a l control c o n t r o l panels p a n e l s and a n d engineering e n g i n e e r i n g work w o r k stations. s t a t i o n s . Hypervisor H y p e r v i s o r A A hypervisor h y p e r v i s o r is i s a a computer c o m p u t e r software, s o f t w a r e , firmware f i r m w a r e or o r hardware h a r d w a r e that t h a t creates c r e a t e s and a n d runs r u n s virtual v i r t u a l machines. m a c h i n e s . A A computer c o m p u t e r on o n which w h i c h a a hypervisor h y p e r v i s o r runs r u n s one o n e or o r more m o r e virtual v i r t u a l machines m a c h i n e s is i s called c a l l e d a a host h o s t machine, m a c h i n e , and a n d each e a c h virtual v i r t u a l machine m a c h i n e is i s called c a l l e d a a guest g u e s t machine. m a c h i n e . The T h e hypervisor h y p e r v i s o r presents p r e s e n t s the t h e guest g u e s t operating o p e r a t i n g systems s y s t e m s with w i t h a a virtual v i r t u a l operating o p e r a t i n g platform p l a t f o r m and a n d manages m a n a g e s the t h e execution e x e c u t i o n of o f the t h e guest g u e s t operating o p e r a t i n g systems. s y s t e m s . Multiple M u l t i p l e instances i n s t a n c e s of o f a a variety v a r i e t y of o f operating o p e r a t i n g systems s y s t e m s may m a y share s h a r e the t h e virtualized v i r t u a l i z e d hardware h a r d w a r e resources. r e s o u r c e s . (Source; ( S o u r c e ; Wikipedia) W i k i p e d i a ) Intelligent I n t e l l i g e n t electronic e l e c t r o n i c device d e v i c e (IED) ( I E D ) Microprocessor-based M i c r o p r o c e s s o r - b a s e d controllers c o n t r o l l e r s of o f power p o w e r system s y s t e m equipment, e q u i p m e n t , such s u c h as a s circuit c i r c u i t breakers, b r e a k e r s , transformers t r a n s f o r m e r s and a n d capacitor c a p a c i t o r banks. b a n k s . lEDs l E D s receive r e c e i v e data d a t a from f r o m sensors s e n s o r s and a n d power p o w e r equipment e q u i p m e n t and a n d can c a n issue i s s u e control c o n t r o l commands, c o m m a n d s , such s u c h as a s tripping t r i p p i n g circuit c i r c u i t breakers b r e a k e r s if i f they t h e y sense s e n s e voltage, v o l t a g e , current, c u r r e n t , or o r frequency f r e q u e n c y anomalies, a n o m a l i e s , or o r raise/lower r a i s e / l o w e r voltage v o l t a g e levels l e v e l s in i n order o r d e r to t o maintain m a i n t a i n the t h e desired d e s i r e d level. l e v e l . May M a y Indicates I n d i c a t e s a a course c o u r s e of o f action a c t i o n permissible p e r m i s s i b l e within w i t h i n the t h e limits l i m i t s of o f the t h e document. d o c u m e n t . (Source: ( S o u r c e : Company C o m p a n y Management M a n a g e m e n t system) s y s t e m ) Network N e t w o r k equipment e q u i p m e n t Electronic E l e c t r o n i c devices d e v i c e s which w h i c h are a r e required r e q u i r e d for f o r communication c o m m u n i c a t i o n and a n d interaction i n t e r a c t i o n between b e t w e e n devices d e v i c e s on o n a a computer c o m p u t e r network, n e t w o r k , also a l s o known k n o w n as a s Networking N e t w o r k i n g hardware, h a r d w a r e , e.g. e . g . switches, s w i t c h e s , firewalls, f i r e w a l l s , routers, r o u t e r s , etc. e t c . (Source; ( S o u r c e ; Wikipedia) W i k i p e d i a ) Network N e t w o r k equipment e q u i p m e n t management m a n a g e m e n t Services S e r v i c e s provided p r o v i d e d include i n c l u d e fault f a u l t analysis, a n a l y s i s , performance p e r f o r m a n c e management, m a n a g e m e n t , provisioning p r o v i s i o n i n g of o f networks/network n e t w o r k s / n e t w o r k equipment e q u i p m e n t and a n d maintaining m a i n t a i n i n g quality q u a l i t y of o f service. s e r v i c e . Network N e t w o r k core c o r e switch s w i t c h A A core c o r e switch s w i t c h is i s a a high-capacity h i g h - c a p a c i t y switch s w i t c h generally g e n e r a l l y positioned p o s i t i o n e d within w i t h i n the t h e backbone b a c k b o n e or o r physical p h y s i c a l core c o r e of o f a a network. n e t w o r k . Core C o r e switches s w i t c h e s provide p r o v i d e the t h e final f i n a l aggregation a g g r e g a t i o n point p o i n t for f o r the t h e network n e t w o r k and a n d allow a l l o w multiple m u l t i p l e aggregation a g g r e g a t i o n modules m o d u l e s to t o work w o r k together. t o g e t h e r . The T h e core c o r e is i s designed d e s i g n e d to t o be b e highly h i g h l y reliable r e l i a b l e and a n d stable s t a b l e to t o aggregate a g g r e g a t e all a l l the t h e elements e l e m e n t s in i n the t h e operational o p e r a t i o n a l facility, f a c i l i t y , typically t y p i c a l l y Layer L a y e r 3 3 (ISO/IEC ( I S O / I E C 7498) 7 4 9 8 ) devices, d e v i c e s , with w i t h high h i g h speed s p e e d connectivity, c o n n e c t i v i t y , redundant r e d u n d a n t links, l i n k s , and a n d redundant r e d u n d a n t hardware. h a r d w a r e . Network N e t w o r k distribution d i s t r i b u t i o n switch s w i t c h The T h e distribution d i s t r i b u t i o n layer l a y e r in i n provides p r o v i d e s policy-based p o l i c y - b a s e d connectivity c o n n e c t i v i t y and a n d demarcation d e m a r c a t i o n between b e t w e e n the t h e access a c c e s s layer l a y e r and a n d the t h e core c o r e layer. l a y e r . In I n small-to-medium s m a l l - t o - m e d i u m size s i z e networks, n e t w o r k s , it i t is i s possible p o s s i b l e to t o collapse c o l l a p s e the t h e core c o r e into i n t o the t h e distribution d i s t r i b u t i o n switches. s w i t c h e s . Network N e t w o r k edge e d g e switch s w i t c h The T h e edge e d g e switch s w i t c h (also ( a l s o called c a l l e d access a c c e s s switch) s w i t c h ) provides p r o v i d e s the t h e demarcation d e m a r c a t i o n between b e t w e e n the t h e network n e t w o r k infrastructure i n f r a s t r u c t u r e and a n d the t h e devices d e v i c e s ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ that t h a t leverage l e v e r a g e that t h a t infrastructure. i n f r a s t r u c t u r e . As A s such, s u c h , it i t provides p r o v i d e s a a security, s e c u r i t y , QoS, Q o S , and a n d policy p o l i c y trust t r u s t boundary. b o u n d a r y . When W h e n looking l o o k i n g at a t the t h e overall o v e r a l l IACS I A C S network n e t w o r k design, d e s i g n , the t h e edge e d g e switch s w i t c h provides p r o v i d e s the t h e majority m a j o r i t y of o f these t h e s e access a c c e s s layer l a y e r services s e r v i c e s and a n d is i s a a key k e y element e l e m e n t in i n enabling e n a b l i n g multiple m u l t i p l e IACS I A C S network n e t w o r k services. s e r v i c e s . Network N e t w o r k message m e s s a g e log l o g server s e r v e r In I n computing, c o m p u t i n g , a a log l o g file f i l e is i s a a file f i l e that t h a t records r e c o r d s either e i t h e r events e v e n t s that t h a t occur o c c u r in i n an a n operating o p e r a t i n g system s y s t e m or o r other o t h e r software s o f t w a r e runs, r u n s , or o r Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Page P a g e 20 2 0 of o f 23 2 3 ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l messages m e s s a g e s between b e t w e e n different d i f f e r e n t users u s e r s of o f a a communication c o m m u n i c a t i o n software. s o f t w a r e . Logging L o g g i n g is i s the t h e act a c t of o f keeping k e e p i n g a a log. l o g . In I n the t h e simplest s i m p l e s t case, c a s e , messages m e s s a g e s are a r e written w r i t t e n to t o a a single s i n g l e log l o g file. f i l e . Many M a n y operating o p e r a t i n g systems, s y s t e m s , software s o f t w a r e frameworks f r a m e w o r k s and a n d programs p r o g r a m s include i n c l u d e a a logging l o g g i n g system. s y s t e m . A A widely w i d e l y used u s e d logging l o g g i n g standard s t a n d a r d is i s syslog. s y s l o g . The T h e Network N e t w o r k message m e s s a g e log l o g server s e r v e r provides p r o v i d e s storage s t o r a g e of o f syslog s y s l o g messages m e s s a g e s I I SNMP S N M P traps t r a p s with w i t h functionality f u n c t i o n a l i t y like l i k e forwarding, f o r w a r d i n g , filtering, f i l t e r i n g , analysis a n a l y s i s etc. e t c . Network N e t w o r k Time T i m e Protocol P r o t o c o l (NTP) ( N T P ) Protocol P r o t o c o l used u s e d to t o synchronize s y n c h r o n i z e clocks c l o c k s throughout t h r o u g h o u t a a computer c o m p u t e r network, n e t w o r k , defined d e f i n e d in i n RFC R F C documents. d o c u m e n t s . The T h e current c u r r e n t protocol p r o t o c o l is i s version v e r s i o n 4 4 (NTPv4), ( N T P v 4 ) , which w h i c h is i s a a proposed p r o p o s e d standard s t a n d a r d as a s documented d o c u m e n t e d in i n RFC R F C 5905. 5 9 0 5 . It I t is i s backward b a c k w a r d compatible c o m p a t i b l e with w i t h version v e r s i o n 3, 3 , specified s p e c i f i e d in i n RFC R F C 1305. 1 3 0 5 . Operator O p e r a t o r station s t a t i o n HMI H M I equipment e q u i p m e n t where w h e r e the t h e operator o p e r a t o r can c a n perform p e r f o r m control c o n t r o l and a n d monitoring. m o n i t o r i n g . One O n e or o r more m o r e operator o p e r a t o r stations s t a t i o n s will w i l l form f o r m an a n operator o p e r a t o r workplace. w o r k p l a c e . Protected P r o t e c t e d area a r e a This T h i s term t e r m is i s used u s e d to t o address a d d r e s s location l o c a t i o n of o f non-explosion n o n - e x p l o s i o n protected p r o t e c t e d safety s a f e t y critical c r i t i c a l equipment e q u i p m e n t such s u c h that t h a t the t h e probability p r o b a b i l i t y of o f gas g a s exposure e x p o s u r e to t o ignition i g n i t i o n sources s o u r c e s or o r damage d a m a g e is i s as a s low l o w as a s reasonably r e a s o n a b l y practicable. p r a c t i c a b l e . Such S u c h equipment e q u i p m e n t will w i l l be b e protected p r o t e c t e d long l o n g enough e n o u g h to t o carry c a r r y out o u t safety s a f e t y functions. f u n c t i o n s . Such S u c h locations l o c a t i o n s should s h o u l d be b e in i n the t h e accommodation a c c o m m o d a t i o n or o r in i n utility u t i l i t y area a r e a close c l o s e to t o the t h e accommodation a c c o m m o d a t i o n area. a r e a . Probability P r o b a b i l i t y for f o r exposure e x p o s u r e of o f equipment e q u i p m e n t within w i t h i n the t h e enclosure e n c l o s u r e to t o gas g a s releases r e l e a s e s at a t 20% 2 0 % LEL, L E L , typically t y p i c a l l y 10-4 1 0 - 4 per p e r year y e a r or o r less. l e s s . Special S p e c i a l provisions, p r o v i s i o n s , e.g. e . g . gas g a s detection d e t e c t i o n and a n d means m e a n s for f o r isolating i s o l a t i n g ignition i g n i t i o n sources, s o u r c e s , may m a y be b e required. r e q u i r e d . (Source: ( S o u r c e : TR1055 T R 1 0 5 5 v9.0) v 9 . 0 ) Precision P r e c i s i o n Time T i m e Protocol P r o t o c o l (PTP) ( P T P ) Protocol P r o t o c o l used u s e d to t o synchronize s y n c h r o n i z e clocks c l o c k s throughout t h r o u g h o u t a a computer c o m p u t e r network, n e t w o r k , defined d e f i n e d in i n IEEE I E E E 1588 1 5 8 8 v2. v 2 . Quality Q u a l i t y of o f Service S e r v i c e (QoS) ( Q o S ) QoS Q o S refers r e f e r s to t o traffic t r a f f i c prioritization p r i o r i t i z a t i o n and a n d resource r e s o u r c e reservation r e s e r v a t i o n control c o n t r o l mechanisms m e c h a n i s m s rather r a t h e r than t h a n the t h e achieved a c h i e v e d service s e r v i c e quality. q u a l i t y . QoS Q o S is i s the t h e ability a b i l i t y to t o provide p r o v i d e different d i f f e r e n t priority p r i o r i t y to t o different d i f f e r e n t applications, a p p l i c a t i o n s , users, u s e r s , or o r data d a t a flows, f l o w s , or o r to t o guarantee g u a r a n t e e a a certain c e r t a i n level l e v e l Redbox R e d b o x ÿÿÿÿ ÿ ÿ ÿ ÿ of o f performance p e r f o r m a n c e to t o a a data d a t a flow. f l o w . (Source; ( S o u r c e ; Wikipedia) W i k i p e d i a ) Short S h o r t form f o r m for f o r Redundant R e d u n d a n t Box. B o x . A A network n e t w o r k switch s w i t c h with w i t h PRP P R P functionality, f u n c t i o n a l i t y , used u s e d in i n IEC I E C 61850 6 1 8 5 0 networks, n e t w o r k s , for f o r connecting c o n n e c t i n g single s i n g l e attached a t t a c h e d devices d e v i c e s to t o a a PRP P R P network. n e t w o r k . Redundancy R e d u n d a n c y The T h e presence p r e s e n c e of o f auxiliary a u x i l i a r y equipment e q u i p m e n t in i n a a system s y s t e m to t o perform p e r f o r m the t h e same s a m e or o r similar s i m i l a r functions f u n c t i o n s as a s other o t h e r elements e l e m e n t s for f o r the t h e purpose p u r p o s e of o f preventing p r e v e n t i n g or o r recovering r e c o v e r i n g from f r o m failures. f a i l u r e s . (Source: ( S o u r c e : ISO/IEC/IEEE I S O / I E C / I E E E 24765:2017) 2 4 7 6 5 : 2 0 1 7 ) Real R e a l Time T i m e Clock C l o c k (RTC) ( R T C ) A A computer c o m p u t e r clock c l o c k (most ( m o s t often o f t e n in i n the t h e form f o r m of o f an a n integrated i n t e g r a t e d circuit) c i r c u i t ) that t h a t keeps k e e p s track t r a c k of o f the t h e current c u r r e n t time. t i m e . (Soruce; ( S o r u c e ; Wikipedia) W i k i p e d i a ) SAS S A S Control C o n t r o l class c l a s s 2 2 Control C o n t r o l and/or a n d / o r monitoring m o n i t o r i n g functions f u n c t i o n s are a r e partially p a r t i a l l y integrated i n t e g r a t e d into i n t o SAS. S A S . Non-SAS N o n - S A S control c o n t r o l equipment e q u i p m e n t are a r e either e i t h e r directly d i r e c t l y connected c o n n e c t e d to t o SAS S A S network n e t w o r k or o r interfaced i n t e r f a c e d to t o other o t h e r SAS S A S equipment e q u i p m e n t via v i a communication c o m m u n i c a t i o n link. l i n k . Systems S y s t e m s and a n d equipment e q u i p m e n t under u n d e r control c o n t r o l are a r e operated o p e r a t e d and a n d monitored m o n i t o r e d through t h r o u g h SAS S A S HMI H M I following f o l l o w i n g SAS S A S HMI H M I standard s t a n d a r d for f o r uniform u n i f o r m operation. o p e r a t i o n . SAS S A S Control C o n t r o l class c l a s s 3 3 Control C o n t r o l and a n d monitoring m o n i t o r i n g functions f u n c t i o n s are a r e not n o t integrated i n t e g r a t e d in i n SAS. S A S . No N o interface i n t e r f a c e to t o SAS S A S is i s required, r e q u i r e d , however h o w e v e r supervisory s u p e r v i s o r y control c o n t r o l ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ or o r monitoring m o n i t o r i n g from f r o m SAS S A S HMI H M I could c o u l d be b e applied. a p p l i e d . Systems S y s t e m s and a n d equipment e q u i p m e n t under u n d e r control c o n t r o l are a r e operated o p e r a t e d and a n d monitored m o n i t o r e d through t h r o u g h stand-alone s t a n d - a l o n e HMI. H M I . Scalability S c a l a b i l i t y The T h e degree d e g r e e to t o which w h i c h a a system s y s t e m can c a n have h a v e its i t s capacities c a p a c i t i e s adjusted a d j u s t e d to t o meet m e e t system s y s t e m requirements. r e q u i r e m e n t s . (Source: ( S o u r c e : O-PAS™ O - P A S ™ Standard S t a n d a r d - - Glossary G l o s s a r y and a n d Abbreviations:2019) A b b r e v i a t i o n s : 2 0 1 9 ) Security S e c u r i t y Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Page P a g e 21 2 1 of o f 23 2 3 ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l 1. 1 . measures m e a s u r e s taken t a k e n to t o protect p r o t e c t a a system s y s t e m 2. 2 . condition c o n d i t i o n of o f a a system s y s t e m that t h a t results r e s u l t s from f r o m the t h e establishment e s t a b l i s h m e n t and a n d maintenance m a i n t e n a n c e of o f measures m e a s u r e s to t o protect p r o t e c t a a system s y s t e m 3. 3 . condition c o n d i t i o n of o f a a system s y s t e m resources r e s o u r c e s being b e i n g free f r e e from f r o m unauthorized u n a u t h o r i z e d access a c c e s s and a n d from f r o m unauthorized u n a u t h o r i z e d or o r accidental a c c i d e n t a l change, c h a n g e , destruction d e s t r u c t i o n or o r loss l o s s 4. 4 . capability c a p a b i l i t y of o f a a computer-based c o m p u t e r - b a s e d system s y s t e m to t o provide p r o v i d e adequate a d e q u a t e confidence c o n f i d e n c e that t h a t unauthorized u n a u t h o r i z e d persons p e r s o n s and a n d systems s y s t e m s can c a n neither n e i t h e r modify m o d i f y the t h e software s o f t w a r e and a n d its i t s data d a t a nor n o r gain g a i n access a c c e s s to t o the t h e system s y s t e m functions, f u n c t i o n s , and a n d yet y e t ensure e n s u r e that t h a t this t h i s is i s not n o t denied d e n i e d to t o authorized a u t h o r i z e d persons p e r s o n s and a n d systems s y s t e m s 5. 5 . prevention p r e v e n t i o n of o f illegal i l l e g a l or o r unwanted u n w a n t e d penetration p e n e t r a t i o n of, o f , or o r interference i n t e r f e r e n c e with w i t h the t h e proper p r o p e r and a n d intended i n t e n d e d operation o p e r a t i o n of o f an a n industrial i n d u s t r i a l automation a u t o m a t i o n ad a d control c o n t r o l system s y s t e m Note: N o t e : Measures M e a s u r e s can c a n be b e controls c o n t r o l s related r e l a t e d to t o physical p h y s i c a l security s e c u r i t y (controlling ( c o n t r o l l i n g physical p h y s i c a l access a c c e s s to t o computing c o m p u t i n g assets) a s s e t s ) or o r logical l o g i c a l security s e c u r i t y (capability ( c a p a b i l i t y to t o login l o g i n to t o a a given g i v e n system s y s t e m and a n d application). a p p l i c a t i o n ) . (Source: ( S o u r c e : IEC I E C 62443-1-1:2009) 6 2 4 4 3 - 1 - 1 : 2 0 0 9 ) Server S e r v e r When W h e n used u s e d as a s a a standalone s t a n d a l o n e word, w o r d , this t h i s means m e a n s a a computer c o m p u t e r with w i t h an a n operating o p e r a t i n g system s y s t e m like l i k e Windows W i n d o w s Server, S e r v e r , Ubuntu U b u n t u Server, S e r v e r , RedHat R e d H a t Server S e r v e r etc. e t c . A A computer c o m p u t e r that t h a t shall s h a l l run r u n 24/7, 2 4 / 7 , and a n d that t h a t runs r u n s applications a p p l i c a t i o n s as a s services s e r v i c e s I I daemons d a e m o n s which w h i c h do d o not n o t depend d e p e n d on o n any a n y human h u m a n user u s e r session s e s s i o n (i.e. ( i . e . a a user u s e r logged l o g g e d in) i n ) to t o run. r u n . A A Server S e r v e r can c a n be b e either e i t h e r a a dedicated, d e d i c a t e d , physical p h y s i c a l server, s e r v e r , or o r a a virtual v i r t u a l machine. m a c h i n e . The T h e word w o r d “Server” “ S e r v e r ” may m a y also a l s o be b e used u s e d about a b o u t one o n e of o f the t h e two t w o roles r o l e s (“Client” ( “ C l i e n t ” or o r “Server”) “ S e r v e r ” ) in i n a a network n e t w o r k protocol p r o t o c o l connection, c o n n e c t i o n , such s u c h as a s “SSH “ S S H Server”. S e r v e r ” . In I n this t h i s meaning, m e a n i n g , the t h e protocol p r o t o c o l name n a m e is i s always a l w a y s preceding p r e c e d i n g the t h e word w o r d “Server”. “ S e r v e r ” . The T h e term t e r m “Server “ S e r v e r Application” A p p l i c a t i o n ” may m a y also a l s o be b e used. u s e d . This T h i s means m e a n s that t h a t the t h e application a p p l i c a t i o n has h a s a a Client C l i e n t / / Server S e r v e r architecture, a r c h i t e c t u r e , and a n d the t h e “Server “ S e r v e r Application” A p p l i c a t i o n ” refers r e f e r s to t o one o n e of o f the t h e two t w o peers p e e r s of o f this t h i s application a p p l i c a t i o n architecture. a r c h i t e c t u r e . Service S e r v i c e port p o r t An A n interface i n t e r f a c e on o n a a component c o m p o n e n t which w h i c h is i s used u s e d for f o r configuration, c o n f i g u r a t i o n , troubleshooting, t r o u b l e s h o o t i n g , diagnostics d i a g n o s t i c s or o r other o t h e r maintenance m a i n t e n a n c e needs. n e e d s . It I t may m a y also a l s o be b e used u s e d for f o r monitoring, m o n i t o r i n g , time t i m e synchronization s y n c h r o n i z a t i o n etc. e t c . Shall S h a l l (requirement) ( r e q u i r e m e n t ) Requirement R e q u i r e m e n t strictly s t r i c t l y to t o be b e followed f o l l o w e d in i n order o r d e r to t o conform c o n f o r m to t o the t h e document d o c u m e n t and a n d from f r o m which w h i c h no n o deviation d e v i a t i o n is i s permitted, p e r m i t t e d , unless u n l e s s a a deviation d e v i a t i o n permit p e r m i t is i s approved. a p p r o v e d . (Source: ( S o u r c e : Company C o m p a n y Management M a n a g e m e n t system) s y s t e m ) Should S h o u l d (recommendation) ( r e c o m m e n d a t i o n ) Indicates I n d i c a t e s that t h a t among a m o n g several s e v e r a l possibilities p o s s i b i l i t i e s one o n e is i s recommended r e c o m m e n d e d as a s particularly p a r t i c u l a r l y suitable, s u i t a b l e , without w i t h o u t mentioning m e n t i o n i n g or o r excluding e x c l u d i n g others, o t h e r s , or o r that t h a t a a certain c e r t a i n course c o u r s e of o f action a c t i o n is i s preferred p r e f e r r e d but b u t not n o t necessarily n e c e s s a r i l y required, r e q u i r e d , or o r that t h a t (in ( i n the t h e negative n e g a t i v e form) f o r m ) possibility p o s s i b i l i t y or o r course c o u r s e of o f action a c t i o n is i s deprecated d e p r e c a t e d but b u t not n o t prohibited. p r o h i b i t e d . (Source: ( S o u r c e : Company C o m p a n y Management M a n a g e m e n t system) s y s t e m ) Simple S i m p l e Network N e t w o r k Management M a n a g e m e n t Protocol P r o t o c o l (SNMP) ( S N M P ) An A n Internet I n t e r n e t Standard S t a n d a r d protocol p r o t o c o l for f o r collecting c o l l e c t i n g and a n d organizing o r g a n i z i n g information i n f o r m a t i o n about a b o u t managed m a n a g e d devices d e v i c e s on o n IP I P networks n e t w o r k s and a n d for f o r modifying m o d i f y i n g that t h a t information i n f o r m a t i o n to t o change c h a n g e device d e v i c e behavior. b e h a v i o r . Devices D e v i c e s that t h a t typically t y p i c a l l y support s u p p o r t SNMP S N M P include i n c l u d e cable c a b l e modems, m o d e m s , routers, r o u t e r s , switches, s w i t c h e s , servers, s e r v e r s , work w o r k stations, s t a t i o n s , printers, p r i n t e r s , and a n d more. m o r e . Software S o f t w a r e components c o m p o n e n t s Computer C o m p u t e r programs p r o g r a m s having h a v i n g a a defined d e f i n e d function f u n c t i o n required r e q u i r e d to t o have h a v e a a computing c o m p u t i n g device d e v i c e working w o r k i n g properly, p r o p e r l y , e.g. e . g . hardware h a r d w a r e ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ managing m a n a g i n g software s o f t w a r e (e.g. ( e . g . device d e v i c e drivers, d r i v e r s , firmware, f i r m w a r e , operating o p e r a t i n g system, s y s t e m , etc), e t c ) , application a p p l i c a t i o n framework f r a m e w o r k software s o f t w a r e (e.g. ( e . g . supplier's s u p p l i e r ' s product p r o d u c t software s o f t w a r e platform), p l a t f o r m ) , application a p p l i c a t i o n software s o f t w a r e (e.g. ( e . g . production p r o d u c t i o n facility f a c i l i t y specific s p e c i f i c run-time r u n - t i m e applications a p p l i c a t i o n s I I configuration) c o n f i g u r a t i o n ) Syslog S y s l o g A A standard s t a n d a r d for f o r message m e s s a g e logging, l o g g i n g , defined d e f i n e d in i n Internet I n t e r n e t Engineering E n g i n e e r i n g Task T a s k Force F o r c e (IETF) ( I E T F ) RFC R F C 5424. 5 4 2 4 . It I t allows a l l o w s separation s e p a r a t i o n of o f the t h e software s o f t w a r e that t h a t generates g e n e r a t e s messages, m e s s a g e s , the t h e system s y s t e m that t h a t stores s t o r e s them, t h e m , and a n d the t h e software s o f t w a r e that t h a t reports r e p o r t s and a n d analyzes a n a l y z e s them. t h e m . Each E a c h Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Page P a g e 22 2 2 of o f 23 2 3 ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l message m e s s a g e is i s labeled l a b e l e d with w i t h a a facility f a c i l i t y code, c o d e , indicating i n d i c a t i n g the t h e software s o f t w a r e type t y p e generating g e n e r a t i n g the t h e message, m e s s a g e , and a n d assigned a s s i g n e d a a severity s e v e r i t y level. l e v e l . May M a y be b e uses u s e s for f o r system s y s t e m management m a n a g e m e n t and a n d security s e c u r i t y auditing a u d i t i n g as a s well w e l l as a s general g e n e r a l informational, i n f o r m a t i o n a l , analysis, a n a l y s i s , and a n d debugging d e b u g g i n g messages. m e s s a g e s . System S y s t e m A A set s e t of o f elements e l e m e n t s and a n d of o f relations r e l a t i o n s between b e t w e e n the t h e elements e l e m e n t s such s u c h that t h a t the t h e set s e t may m a y be b e looked l o o k e d at a t as a s a a whole. w h o l e . (Source: ( S o u r c e : ISO I S O 5127/1) 5 1 2 7 / 1 ) System S y s t e m under u n d e r Consideration C o n s i d e r a t i o n (SuC) ( S u C ) System S y s t e m Under U n d e r Consideration. C o n s i d e r a t i o n . IEC62443 I E C 6 2 4 4 3 term. t e r m . Thick T h i c k provisioning p r o v i s i o n i n g In I n virtual v i r t u a l storage, s t o r a g e , thick t h i c k provisioning p r o v i s i o n i n g is i s a a type t y p e of o f storage s t o r a g e allocation a l l o c a t i o n in i n which w h i c h the t h e amount a m o u n t of o f storage s t o r a g e capacity c a p a c i t y on o n a a disk d i s k is i s pre-allocated p r e - a l l o c a t e d on o n physical p h y s i c a l storage s t o r a g e at a t the t h e time t i m e the t h e disk d i s k is i s created. c r e a t e d . Variabel V a r i a b e l Speed S p e e d Drive D r i v e (VSD) ( V S D ) A A type t y p e of o f adjustable-speed a d j u s t a b l e - s p e e d drive d r i v e used u s e d in i n electro-mechanical e l e c t r o - m e c h a n i c a l drive d r i v e systems s y s t e m s to t o control c o n t r o l AC A C motor m o t o r speed s p e e d and a n d torque t o r q u e by b y varying v a r y i n g motor m o t o r input i n p u t frequency f r e q u e n c y and a n d voltage. v o l t a g e . (Source; ( S o u r c e ; Wikipedia) W i k i p e d i a ) Zone Z o n e A A security s e c u r i t y zone z o n e is i s a a logical l o g i c a l grouping g r o u p i n g of o f physical, p h y s i c a l , informational, i n f o r m a t i o n a l , and a n d application a p p l i c a t i o n assets a s s e t s sharing s h a r i n g common c o m m o n security s e c u r i t y requirements. r e q u i r e m e n t s . ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ A A security s e c u r i t y zone z o n e has h a s a a border, b o r d e r , which w h i c h is i s the t h e boundary b o u n d a r y between b e t w e e n included i n c l u d e d and a n d excluded e x c l u d e d elements. e l e m e n t s . Zones Z o n e s may m a y be b e considered c o n s i d e r e d to t o be b e trusted t r u s t e d or o r untrusted. u n t r u s t e d . The T h e standard s t a n d a r d requires r e q u i r e s a a minimum m i n i m u m of o f three t h r e e security s e c u r i t y levels l e v e l s for f o r security s e c u r i t y zones: z o n e s : high, h i g h , medium m e d i u m and a n d low. l o w . Other O t h e r Parts P a r t s of o f the t h e IEC62443 I E C 6 2 4 4 3 standard s t a n d a r d will w i l l define d e f i n e administrative a d m i n i s t r a t i v e and a n d technical t e c h n i c a l requirements r e q u i r e m e n t s for f o r these t h e s e security s e c u r i t y levels. l e v e l s . 8.1.2 8 . 1 . 2 Abbreviations A b b r e v i a t i o n s cc c c Control C o n t r o l Class C l a s s CPU C P U Central C e n t r a l Processing P r o c e s s i n g Unit U n i t EmG E m G Emergency E m e r g e n c y Generator G e n e r a t o r EPU E P U Equipment E q u i p m e n t Package P a c k a g e Unit U n i t EWS E W S Engineering E n g i n e e r i n g Work W o r k Station S t a t i o n FW F W Firewall F i r e w a l l FWP F W P Firewater F i r e w a t e r Pump P u m p HMI H M I Human H u m a n Machine M a c h i n e Interface I n t e r f a c e IACS I A C S Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l System S y s t e m IED I E D Intelligent I n t e l l i g e n t Electronic E l e c t r o n i c Device D e v i c e IP I P Internet I n t e r n e t Protocol P r o t o c o l MMS M M S Manufacturing M a n u f a c t u r i n g Message M e s s a g e Specification S p e c i f i c a t i o n NTP N T P Network N e t w o r k Time T i m e Protocol P r o t o c o l PCS P C S Process P r o c e s s Control C o n t r o l System S y s t e m PRP P R P Parallel P a r a l l e l Redundancy R e d u n d a n c y Protocol P r o t o c o l PTP P T P Precision P r e c i s i o n Time T i m e Protocol P r o t o c o l QoS Q o S Quality Q u a l i t y of o f Service S e r v i c e RTC R T C Real R e a l Time T i m e Clock C l o c k SAS S A S Safety S a f e t y and a n d Automation A u t o m a t i o n System S y s t e m Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿ ÿ ÿ ÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ ÿÿÿÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ ÿ ÿ Requirements: R e q u i r e m e n t s : Industrial I n d u s t r i a l Automation A u t o m a t i o n and a n d Control C o n t r o l Systems S y s t e m s Network N e t w o r k VLAN V L A N Virtual V i r t u a l Local L o c a l Area A r e a Network N e t w o r k VSD V S D Variabel V a r i a b e l Speed S p e e d Drive D r i v e 8.2 8 . 2 Changes C h a n g e s from f r o m previous p r e v i o u s version v e r s i o n NA N A 8.3 8 . 3 References R e f e r e n c e s Company C o m p a n y TR0002 T R 0 0 0 2 Management M a n a g e m e n t system s y s t e m principles p r i n c i p l e s TR1658 T R 1 6 5 8 Information I n f o r m a t i o n Security S e c u r i t y of o f Automation A u t o m a t i o n Systems S y s t e m s TR2258 T R 2 2 5 8 Information I n f o r m a t i o n Management M a n a g e m e n t System S y s t e m TR3030 T R 3 0 3 0 Automation, A u t o m a t i o n , Technical T e c h n i c a l requirements r e q u i r e m e n t s and a n d standards s t a n d a r d s TR3034 T R 3 0 3 4 Safety S a f e t y and a n d Automation A u t o m a t i o n System S y s t e m TR3043 T R 3 0 4 3 Telecommunication T e l e c o m m u n i c a t i o n systems s y s t e m s GL0628 G L 0 6 2 8 Maintenance M a i n t e n a n c e Engineering E n g i n e e r i n g in i n Projects P r o j e c t s International I n t e r n a t i o n a l standards s t a n d a r d s IEC I E C 60300 6 0 3 0 0 Dependability D e p e n d a b i l i t y Management M a n a g e m e n t IEC I E C 61850 6 1 8 5 0 Communication C o m m u n i c a t i o n networks n e t w o r k s and a n d systems s y s t e m s for f o r power p o w e r utility u t i l i t y automation a u t o m a t i o n IEC I E C 62264 6 2 2 6 4 Enterprise-control E n t e r p r i s e - c o n t r o l system s y s t e m integration i n t e g r a t i o n IEC I E C 62439 6 2 4 3 9 High H i g h availability a v a i l a b i l i t y automation a u t o m a t i o n networks n e t w o r k s IEC I E C 62443 6 2 4 4 3 Industrial I n d u s t r i a l communication c o m m u n i c a t i o n networks n e t w o r k s - - Network N e t w o r k and a n d system s y s t e m security s e c u r i t y Classification: C l a s s i f i c a t i o n : Internal I n t e r n a l Page P a g e 23 2 3 of o f 23 2 3 ÿÿÿÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ Project P r o j e c t development, d e v e l o p m e n t , Requirements, R e q u i r e m e n t s , TR3033, T R 3 0 3 3 , Version V e r s i o n 1.0 1 . 0 0.00 0.00 0.00 0.50 0.50 0.50 0.00 0.06 0.45 0.69 0.29 0.20 0.27 0.25 0.11 0.11 0.34 0.16 0.07 0.83 0.10 0.11 0.84 0.06 0.07