Overview and Practical Application of the ISA S99 Standard

摘要

Physical and Cyber Security standards for the SCADA, DCS, and process control systems operating in the oil and gas and petrochemical industry are still emerging. Unlike the electrical sector, which is now mandated by law to comply with the NERC CIP security standards, the petrochemical industry is still allowed to implement whatever security controls they feel is appropriate to the risk level. The only difference is if the facility is storing or producing hazardous chemicals that are in the appendix A of the DHS CFATS (Chemical Facilities Anti-Terrorism) requirements, then there are specific physical and cyber security requirements placed on the systems that control access to the chemicals.Four years ago, a cross group of vendors, end users, system integrators, and consultants from all around the world began working on a new standard for industrial control systems, and selected the ISA (International Society of Automation) to provide the framework for this new standard. It started as the proposed standard - ISA SP99, and now has been ratified and approved, and is now titled ISA S99. This paper will first provide an overview of this standard, then a practical implementation of the some of the requirements specified in the standard.