ISO/IEC TR 27019:2013

Information technology — Security techniques — Information security management guidelines based on ISO/IEC 27002 for process control systems specific to the energy utility industry

Publication date:   Jul 17, 2013

Scope

ISO/IEC TR 27019:2013 provides guiding principles based on ISO/IEC 27002 for information security management applied to process control systems as used in the energy utility industry. The aim of ISO/IEC TR 27019:2013 is to extend the ISO/IEC 27000 set of standards to the domain of process control systems and automation technology, thus allowing the energy utility industry to implement a standardized information security management system (ISMS) in accordance with ISO/IEC 27001 that extends from the business to the process control level.
The scope of ISO/IEC TR 27019:2013 covers process control systems used by the energy utility industry for controlling and monitoring the generation, transmission, storage and distribution of electric power, gas and heat in combination with the control of supporting processes. This includes in particular the following systems, applications and components:

the overall IT-supported central and distributed process control, monitoring and automation technology as well as IT systems used for their operation, such as programming and parameterization devices;
digital controllers and automation components such as control and field devices or PLCs, including digital sensor and actuator elements;
all further supporting IT systems used in the process control domain, e.g. for supplementary data visualization tasks and for controlling, monitoring, data archiving and documentation purposes;
the overall communications technology used in the process control domain, e.g. networks, telemetry, telecontrol applications and remote control technology;
digital metering and measurement devices, e.g. for measuring energy consumption, generation or emission values;
digital protection and safety systems, e.g. protection relays or safety PLCs;
distributed components of future smart grid environments;
all software, firmware and applications installed on above mentioned systems.

Outside the scope of ISO/IEC TR 27019:2013 is the conventional or classic control equipment that is non-digital, i.e. purely electro-mechanical or electronic monitoring and process control systems. Furthermore, energy process control systems in private households and other, comparable residential building installations are outside the scope of ISO/IEC TR 27019:2013.
Telecommunication systems and components used in the process control environment are also not directly part of the scope of ISO/IEC TR 27019:2013. These are covered by ISO/IEC 27011:2008.