IT/OT security frameworks

Cybersecurity frameworks cover different areas: governance, risk analysis, organizational controls and technical safeguards. The guide below provides an overview of these references.

To use one in an assessment, define the scope, assets and evidence needed, then map the relevant requirements to observations. In industrial systems, maintenance windows, availability requirements and equipment lifecycles affect how controls can be tested or changed.

A listed control still needs evidence that it is configured and operating as intended. Check the applicable editions and requirements for each engagement.