Establish OT security and safety authority
Define operating context and authority
3 person-daysCritical
Define the system under consideration
Define operating context and authority
4 person-daysCritical
Map critical physical functions and consequences
Define operating context and authority
4 person-days
Approve the OT risk and acceptance method
Define operating context and authority
4 person-days
Establish the authoritative OT inventory
Establish OT inventory and architecture
5 person-daysCritical
Partition the system into zones and conduits
Establish OT inventory and architecture
5 person-daysCritical
Approve target security levels and requirements
Establish OT inventory and architecture
5 person-daysCritical
Govern OT identity and remote access
Govern access and supplier operations
4 person-days
Set service-provider security profiles
Govern access and supplier operations
4 person-days
Approve legacy and maintenance constraints
Govern access and supplier operations
4 person-daysCritical
Implement zone and conduit security requirements
Protect and monitor OT safely
7 person-daysCritical
Control secure change and vulnerability treatment
Protect and monitor OT safely
5 person-daysCritical
Operate OT monitoring and detection
Protect and monitor OT safely
5 person-days
Prepare trusted OT restoration assets
Protect and monitor OT safely
5 person-daysCritical
Prepare OT incident response
Respond and recover safely
5 person-days
Approve degraded operation and safe-state strategies
Respond and recover safely
5 person-daysCritical
Demonstrate restoration and safety acceptance
Respond and recover safely
7 person-daysCritical
Exercise cyber-physical response and recovery
Exercise and accept operation
5 person-daysCritical
Close corrective actions and residual risk
Exercise and accept operation
4 person-daysCritical
Approve operation and periodic review
Exercise and accept operation
4 person-daysCritical