Standards Reference: Establish an OT/ICS Cybersecurity Program

Control / Question

Establish an OT/ICS cybersecurity program. The program should be formal, documented, maintained, governed, and accountable. It should include defined roles and responsibilities, policies and procedures, oversight, sponsorship, and decision rights appropriate for OT/ICS risk.

C2M2 PROGRAM-1a (MIL1) NIST CSF 2.0 GV.PO NIST SP 800-53 PM-1 NIST SP 800-82r3 §3.3.1

DOE C2M2 v2.1

PROGRAM-1a — Cybersecurity Program Strategy

Section 6.10, Cybersecurity Program Management (PROGRAM), Objective 1

Relevant requirement: “The organization has a cybersecurity program strategy, which may be developed and managed in an ad hoc manner.”

Use this as the maturity-model basis for proving the organization has at least a starting cybersecurity program strategy and can mature it into a documented, governed, and sponsored program.

Open section Open document

NIST Cybersecurity Framework 2.0

GV.PO — Policy

Appendix A, CSF Core, Govern Function

Relevant requirement: Organizational cybersecurity policy is established, communicated, and enforced. GV.PO-01 covers establishing policy based on organizational context, strategy, and priorities; GV.PO-02 covers review, update, communication, and enforcement.

Use this as the governance/policy anchor: the OT/ICS program must not be only technical activity; it needs communicated, enforced, and maintained policy.

Open section NIST landing page

NIST SP 800-53 Rev. 5

PM-1 — Information Security Program Plan

Program Management control family

Relevant requirement: Develop and disseminate an organization-wide information security program plan that describes program requirements, program management controls, roles, responsibilities, management commitment, coordination, and compliance; review/update it; and protect it from unauthorized disclosure or modification.

Use this as the formal documentation requirement for the program plan and the source for roles, responsibilities, management commitment, coordination, and update expectations.

Open PM-1 NIST landing page

NIST SP 800-82 Rev. 3

§3.3.1 — Establish OT Cybersecurity Governance

Guide to Operational Technology (OT) Security

Relevant requirement: OT governance should include policies, procedures, and processes for managing regulatory, legal, risk, environmental, and operational requirements. It should ensure policies, procedures, and processes are understood by managers and users and implemented in OT operations.

Use this as the OT/ICS-specific governance reference. It bridges general cybersecurity program expectations to the realities of operational technology environments.

Open §3.3.1 NIST landing page

What evidence should satisfy this question?

Approved OT/ICS cybersecurity program charter or strategy.
Documented program plan with scope, objectives, governance, decision rights, ownership, and update cadence.
Defined roles and responsibilities for OT, IT, security, engineering, operations, vendors, and leadership.
Policies and procedures specific to OT/ICS risk, including exceptions/deviations where IT controls are not directly applicable.
Evidence of senior management sponsorship, resource allocation, and recurring review.