Technology Planning: SCADA Security

Conducting a gap analysis is a critical first step to improving risk management.

• Measure your SCADA security practices against the NIST SP 800-82 cybersecurity framework.

• Identify gaps in compliance in key areas such as access control, password change management and physical security.

• Prioritize vulnerabilities based on a clear understanding of your environment.

Develop a mitigation strategy to remediate the weaknesses identified through the gap analysis.

• Properly document all risks.

• Develop comprehensive policies and procedures to strengthen security.

• Create playbooks to ensure consistent compliance with established security standards and in cyberattack responses.

• Optimize existing security tools or acquire new ones as needed, such as automated vulnerability assessment and reporting, password management and network access control.

Continually reevaluate your security tools and risks to protect against cyberthreats and determine how to maximize resource allocation.

• Conduct regular penetration testing to track emerging vulnerabilities.

• Install all security patches on a timely basis.

• Provide security training to all employees on a consistent basis.

• Repeat a gap analysis/review on an annual basis.