IEC 62443 Requirements

This is a list of all ISA/IEC 62443 requirements and mapped CWEs from Mitre.

Part 2-4

Req ID	BR/RE	Functional area	Topic	Subtopic	Mapped CWE(s)
SP.01.01	BR	Solution staffing	Training	Security requirements - IEC 62443-2-4
SP.01.01	RE(1)	Solution staffing	Training	Security requirements - IEC 62443-2-4
SP.01.02	BR	Solution staffing	Training	Security requirements - asset owner
SP.01.02	RE(1)	Solution staffing	Training	Security requirements - asset owner
SP.01.03	BR	Solution staffing	Training	Sensitive data
SP.01.03	RE(1)	Solution staffing	Training	Sensitive data
SP.01.04	BR	Solution staffing	Background checks	Service provider
SP.01.04	RE(1)	Solution staffing	Background checks	Subcontractor
SP.01.05	BR	Solution staffing	Personnel assignments	Security contact
SP.01.06	BR	Solution staffing	Personnel assignments	Security lead
SP.01.07	BR	Solution staffing	Personnel assignments	Change
SP.02.01	BR	Assurance	Solution components	Verification
SP.02.02	BR	Assurance	Security tools and software	Technical description
SP.02.02	RE(1)	Assurance	Security tools and software	Approval
SP.02.02	RE(2)	Assurance	Security tools and software	Detection
SP.02.02	RE(3)	Assurance	Security tools and software	Robustness
SP.02.03	BR	Assurance	Hardening guidelines	Technical description	CWE-1059: Insufficient Technical Documentation
SP.02.03	RE(1)	Assurance	Hardening guidelines	Verification	CWE-1059: Insufficient Technical Documentation
SP.03.01	BR	Architecture	Risk assessment	Perform
SP.03.01	RE(1)	Architecture	Risk assessment	Reporting
SP.03.01	RE(2)	Architecture	Risk assessment	Verification
SP.03.02	BR	Architecture	Network design	Connectivity
SP.03.02	RE(1)	Architecture	Network design	Connectivity	CWE-1357: Reliance on Insufficiently Trustworthy Component
SP.03.02	RE(2)	Architecture	Network design	Connectivity	CWE-1357: Reliance on Insufficiently Trustworthy Component
SP.03.03	BR	Architecture	Solution components	Vulnerabilities
SP.03.03	RE(1)	Architecture	Network design	Vulnerabilities	CWE-1059: Insufficient Technical Documentation CWE-353: Missing Support for Integrity Check
SP.03.04	BR	Architecture	Network design	Network time
SP.03.05	BR	Architecture	Devices - All	Least functionality	CWE-250: Execution with Unnecessary Privileges
SP.03.05	RE(1)	Architecture	Devices - All	Least functionality
SP.03.06	BR	Architecture	Devices - Workstations	Session lock
SP.03.07	BR	Architecture	Devices - Workstations	Access control
SP.03.07	RE(1)	Architecture	Devices - Workstations	Access control
SP.03.08	BR	Architecture	Devices - Network	Least functionality	CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management
SP.03.08	RE(1)	Architecture	Devices - Network	Access control	CWE-250: Execution with Unnecessary Privileges
SP.03.08	RE(2)	Architecture	Devices - Network	Cryptography
SP.03.08	RE(3)	Architecture	Devices - Network	Access control
SP.03.09	BR	Architecture	Data protection	Communications
SP.03.10	BR	Architecture	Data protection	Sensitive data
SP.03.10	RE(1)	Architecture	Data protection	Sensitive data	CWE-321: Use of Hard-coded Cryptographic Key
SP.03.10	RE(2)	Architecture	Data protection	Data/event retention
SP.03.10	RE(3)	Architecture	Data protection	Cryptography	CWE-321: Use of Hard-coded Cryptographic Key
SP.03.10	RE(4)	Architecture	Data protection	Sanitizing
SP.04.01	BR	Wireless	Network design	Technical description
SP.04.02	BR	Wireless	Network design	Access control
SP.04.02	RE(1)	Wireless	Network design	Communications	CWE-353: Missing Support for Integrity Check
SP.04.03	BR	Wireless	Network design	Communications
SP.04.03	RE(1)	Wireless	Network design	Wireless network identifiers
SP.04.03	RE(2)	Wireless	Network design	Connectivity
SP.05.01	BR	SIS	Risk assessment	Verification
SP.05.02	BR	SIS	Network design	Communications
SP.05.03	BR	SIS	Network design	Communications
SP.05.04	BR	SIS	Network design	Communications
SP.05.05	BR	SIS	Devices - Workstations	Communications
SP.05.05	RE(1)	SIS	Devices - Workstations	Communications
SP.05.06	BR	SIS	Devices - Workstations	Connectivity
SP.05.07	BR	SIS	Devices - Workstations	Least functionality	CWE-250: Execution with Unnecessary Privileges
SP.05.08	BR	SIS	Devices - Wireless	Connectivity
SP.05.09	BR	SIS	User interface	Configuration mode
SP.05.09	RE(1)	SIS	User interface	Configuration mode
SP.05.09	RE(2)	SIS	User interface	Configuration mode
SP.06.01	BR	Configuration management	Network design	Connectivity
SP.06.01	RE(1)	Configuration management	Network design	Connectivity
SP.06.02	BR	Configuration management	Devices - All	Inventory register
SP.06.03	BR	Configuration management	Devices - Control and instrumentation	Verification
SP.07.01	BR	Remote access	Security tools and software	Connectivity
SP.07.02	BR	Remote access	Security tools and software	Technical description
SP.07.03	BR	Remote access	Security tools and software	Technical description
SP.07.04	BR	Remote access	Security tools and software	Approval
SP.07.04	RE(1)	Remote access	Data protection	Cryptography
SP.08.01	BR	Event management	Events - Security compromises	Responding
SP.08.01	RE(1)	Event management	Events - Security compromises	Reporting
SP.08.02	BR	Event management	Events - Security-related	Logging
SP.08.02	RE(1)	Event management	Events - Security-related	Reporting
SP.08.02	RE(2)	Event management	Events - Security-related	Logging
SP.08.03	BR	Event management	Events - Alarms & Events	Logging
SP.08.03	RE(1)	Event management	Events - Alarms & Events	Reporting
SP.08.04	BR	Event management	Events - Alarms & Events	Robustness
SP.09.01	BR	Account management	Accounts - User and service accounts	Administration
SP.09.02	BR	Account management	Accounts - User and service accounts	Administration
SP.09.02	RE(1)	Account management	Accounts - User and service accounts	Technical description	CWE-1391: Use of Weak Credentials
SP.09.02	RE(2)	Account management	Accounts - User and service accounts	Administration
SP.09.02	RE(3)	Account management	Accounts - User and service accounts	Expiration
SP.09.02	RE(4)	Account management	Accounts - Administrator	Least functionality	CWE-250: Execution with Unnecessary Privileges
SP.09.03	BR	Account management	Accounts - Default	Least functionality	CWE-250: Execution with Unnecessary Privileges
SP.09.04	BR	Account management	Accounts - User	Least functionality	CWE-250: Execution with Unnecessary Privileges
SP.09.04	RE(1)	Account management	Accounts - User	Logging
SP.09.05	BR	Account management	Passwords	Composition
SP.09.06	BR	Account management	Passwords	Expiration
SP.09.06	RE(1)	Account management	Passwords	Expiration
SP.09.07	BR	Account management	Passwords	Change
SP.09.08	BR	Account management	Passwords	Reuse
SP.09.08	RE(1)	Account management	Passwords	Change
SP.09.09	BR	Account management	Passwords	Shared
SP.09.09	RE(1)	Account management	Passwords	Shared
SP.10.01	BR	Malware protection	Manual process	Malware protection mechanism
SP.10.02	BR	Malware protection	Security tools and software	Installation
SP.10.02	RE(1)	Malware protection	Security tools and software	Installation
SP.10.03	BR	Malware protection	Security tools and software	Detection
SP.10.04	BR	Malware protection	Manual process	Malware definition files
SP.10.05	BR	Malware protection	Devices - All	Sanitizing
SP.10.05	RE(1)	Malware protection	Portable media	Usage
SP.10.05	RE(2)	Malware protection	Portable media	Sanitizing
SP.11.01	BR	Patch management	Manual process	Patch qualification
SP.11.01	RE(1)	Patch management	Manual process	Patch qualification
SP.11.02	BR	Patch management	Patch list	Patch qualification
SP.11.02	RE(1)	Patch management	Patch list	Patch qualification
SP.11.02	RE(2)	Patch management	Patch list	Approval
SP.11.03	BR	Patch management	Security patch	Delivery
SP.11.04	BR	Patch management	Security patch	Installation
SP.11.05	BR	Patch management	Security patch	Approval
SP.11.06	BR	Patch management	Security patch	Installation
SP.11.06	RE(1)	Patch management	Security patch	Installation
SP.11.06	RE(2)	Patch management	Security patch	Installation	CWE-353: Missing Support for Integrity Check
SP.11.06	RE(3)	Patch management	Security patch	Installation
SP.12.01	BR	Backup/Restore	Manual process	Technical description
SP.12.02	BR	Backup/Restore	Restore	Technical description
SP.12.03	BR	Backup/Restore	Portable media	Technical description
SP.12.04	BR	Backup/Restore	Backup	Verification
SP.12.05	BR	Backup/Restore	Restore	Verification
SP.12.06	BR	Backup/Restore	Backup	Perform
SP.12.07	BR	Backup/Restore	Backup	Robustness
SP.12.08	BR	Backup/Restore	Manual process	Logging
SP.12.09	BR	Backup/Restore	Manual process	Disaster recovery

---

Part 3-3

BR-RE	Requirement	SL1	SL2	SL3	SL4	Mapped CWE(s)
SR 1.1	Human user identification and authentication	x	x	x	x	CWE-250: Execution with Unnecessary Privileges CWE-287: Improper Authentication
SR 1.1 RE 1	Unique identification and authentification		x	x	x
SR 1.1 RE 2	Multifactor authentification for non trusted interfaces			x	x
SR 1.1 RE 3	Multifactor authentification for all interfaces				x
SR 1.2	Software process and device identification and authentication		x	x	x	CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management CWE-287: Improper Authentication
SR 1.2 RE 1	Unique identification and authentification			x	x
SR 1.3	Account management	x	x	x	x
SR 1.3 RE 1	Uniform account management			x	x
SR 1.4	Identifier management	x	x	x	x
SR 1.5	Authenticator management	x	x	x	x	CWE-256: Plaintext Storage of a Password CWE-321: Use of Hard-coded Cryptographic Key CWE-798: Use of Hard-coded Credentials
SR 1.5 RE 1	Hardware security for authenticators			x	x
SR 1.6	Wireless access management	x	x	x	x
SR 1.6 RE 1	Unique identification and authentification		x	x	x
SR 1.7	Strength of password-based authentication	x	x	x	x
SR 1.7 RE 1	Password generation and lifetime restrictions for human users			x	x
SR 1.7 RE 2	Password lifetime restriction for all users (human, software process or device)				x
SR 1.8	Public key infrastructure certificates		x	x	x
SR 1.9	Strength of public key-based authentication		x	x	x	CWE-347: Improper Verification of Cryptographic Signature
SR 1.9 RE 1	Hardware security for public key authentication			x	x
SR 1.10	Authenticator feedback	x	x	x	x
SR 1.11	Unsuccessful login attempts	x	x	x	x
SR 1.12	System use notification	x	x	x	x
SR 1.13	Access via untrusted networks	x	x	x	x	CWE-1357: Reliance on Insufficiently Trustworthy Component
SR 1.13 RE 1	Explicit acces request approval			x	x
SR 1.14	Strength of symmetric key-based authentication		x	x	x
SR 1.14 RE 1	Hardware security for symmetric key authentication			x	x
SR 2.1	Authorization enforcement	x	x	x	x	CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management CWE-862: Missing Authorization CWE-863: Incorrect Authorization
SR 2.1 RE 1	Authorization enforcement for all users (human, software process and all devices)		x	x	x	CWE-250: Execution with Unnecessary Privileges
SR 2.1 RE 2	Permission mapping to roles		x	x	x
SR 2.1 RE 3	Supervisor override			x	x
SR 2.1 RE 4	Dual approval				x
SR 2.2	Wireless use control	x	x	x	x	CWE-863: Incorrect Authorization
SR 2.2 RE 1	Identify and report unauthorized wireless devices			x	x
SR 2.3	Use control for portable and mobile devices	x	x	x	x
SR 2.3 RE 1	Enforcement of security status of portable and mobile devices			x	x
SR 2.4	Mobile code	x	x	x	x
SR 2.4 RE 1	Mobile code integrity check			x	x
SR 2.5	Session lock	x	x	x	x
SR 2.6	Remote session termination		x	x	x
SR 2.7	Concurrent session control			x	x	CWE-770: Allocation of Resources Without Limits or Throttling
SR 2.8	Auditable events	x	x	x	x
SR 2.8 RE 1	Centrally managed, system-wide audit trail			x	x
SR 2.9	Audit storage capacity	x	x	x	x
SR 2.9 RE 1	Warn when audit log recorded capacity threashold reached			x	x
SR 2.10	Rationale and supplemental guidance	x	x	x	x
SR 2.11	Timestamps	x	x	x	x
SR 2.11 RE 1	Time synchronization		x	x	x
SR 2.11 RE 2	Protection of time source integrity				x
SR 2.12	Non-repudiation	x	x	x	x
SR 2.12 RE 1	Non-repudiation for all users				x
SR 3.1	Communication integrity	x	x	x	x	CWE-353: Missing Support for Integrity Check CWE-354: Improper Validation of Integrity Check Value
SR 3.1 RE 1	Communication authentication		x	x	x
SR 3.2	Protection from malicious code	x	x	x	x
SR 3.2 RE 1	Malicious code protection on entry and exit points		x	x	x
SR 3.2 RE 2	Central management and reporting for malicious code			x	x
SR 3.3	Security functionality verification	x	x	x	x
SR 3.3 RE 1	Automated mechanisms for security functionality verification			x	x
SR 3.3 RE 2	Security functionality verification during normal operation				x
SR 3.4	Software and information integrity	x	x	x	x
SR 3.4 RE 1	Automated notification of integrity violations			x	x
SR 3.5	Input validation	x	x	x	x	CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write CWE-94: Improper Control of Generation of Code ('Code Injection')
SR 3.6	Deterministic output	x	x	x	x
SR 3.7	Error handling	x	x	x	x
SR 3.8	Session integrity		x	x	x
SR 3.8 RE 1	Invalidation of session IDs after session termination			x	x
SR 3.8 RE 2	Unique session ID generation			x	x
SR 3.8 RE 3	Randomness of session IDS				x
SR 3.9	Protection of audit information		x	x	x
SR 3.9 RE 1	Audit records on write once media				x
SR 4.1	Information confidentiality	x	x	x	x	CWE-311: Missing Encryption of Sensitive Data CWE-312: Cleartext Storage of Sensitive Information CWE-319: Cleartext Transmission of Sensitive Information
SR 4.1 RE 1	Protection of confidentiality at rest or in transit via untrusted networks		x	x	x
SR 4.1 RE 2	Protection of confidentiality across zone boundaries				x
SR 4.2	Information persistence		x	x	x
SR 4.2 RE 1	Erase of shared memory resources			x	x
SR 4.3	Use of cryptography	x	x	x	x	CWE-311: Missing Encryption of Sensitive Data CWE-321: Use of Hard-coded Cryptographic Key CWE-327: Use of a Broken or Risky Cryptographic Algorithm
SR 5.1	Network segmentation	x	x	x	x
SR 5.1 RE 1	Physical network segmentation		x	x	x
SR 5.1 RE 2	Independence from non-control system networks			x	x
SR 5.1 RE 3	Logical and physical isolation of critical networks				x
SR 5.2	Zone boundary protection	x	x	x	x
SR 5.2 RE 1	Deny by default, allow by exception		x	x	x
SR 5.2 RE 2	Island mode			x	x
SR 5.2 RE 3	Fail close			x	x
SR 5.3	General purpose person-to-person communication restrictions	x	x	x	x
SR 5.3 RE 1	Prohibit all general purpose person-to-person communications			x	x
SR 5.4	Application partitioning	x	x	x	x
SR 6.1	Audit log accessibility	x	x	x	x
SR 6.1 RE 1	Programmatic acces to audit logs			x	x
SR 6.2	Continuous monitoring		x	x	x	CWE-920: Improper Restriction of Power Consumption
SR 7.1	Denial of service protection	x	x	x	x	CWE-400: Uncontrolled Resource Consumption
SR 7.1 RE 1	Manage communication load from component		x	x	x
SR 7.1 RE 2	Limit DoS effects to other systems or networks				x
SR 7.2	Resource management	x	x	x	x	CWE-190: Integer Overflow or Wraparound CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling CWE-771: Missing Reference to Active Allocated Resource CWE-779: Logging of Excessive Data
SR 7.3	Control system backup	x	x	x	x
SR 7.3 RE 1	Backup integrity veification		x	x	x
SR 7.3 RE 2	Backup automation			x	x
SR 7.4	Control system recovery and reconstitution	x	x	x	x
SR 7.5	Emergency power	x	x	x	x
SR 7.6	Network and security configuration settings	x	x	x	x
SR 7.6 RE 1	Machine-readable reporting of current security settings			x	x
SR 7.7	Least functionality	x	x	x	x
SR 7.8	Control system component inventory		x	x	x

---

Part 4-1

SM-1	Development Process	Mapped CWE(s)
SM-2	Identification of responsibilities
SM-3	Identification of applicability
SM-4	Security expertiese
SM-5	Process scoping
SM-6	File integrity	CWE-1357: Reliance on Insufficiently Trustworthy Component CWE-347: Improper Verification of Cryptographic Signature
SM-7	Development environment security
SM-8	Controls for private keys
SM-9	Security requirement for externaly provided components	CWE-1357: Reliance on Insufficiently Trustworthy Component CWE-1395: Dependency on Vulnerable Third-Party Component
SM-10	Custom developed components from third-party suppliers	CWE-1357: Reliance on Insufficiently Trustworthy Component CWE-1395: Dependency on Vulnerable Third-Party Component
SM-11	Assessing and addressing of security-releated issues
SM-12	Process verification
SM-13	Continuous improvement
SR-1	Product security context
SR-2	Threat model	CWE-1395: Dependency on Vulnerable Third-Party Component CWE-190: Integer Overflow or Wraparound CWE-306: Missing Authentication for Critical Function CWE-346: Origin Validation Error
SR-3	Product security requirements
SR-4	Product security requirements content
SR-5	Security requirements review
SD-1	Secure design prinziple	CWE-321: Use of Hard-coded Cryptographic Key CWE-346: Origin Validation Error CWE-353: Missing Support for Integrity Check CWE-779: Logging of Excessive Data CWE-863: Incorrect Authorization
SD-2	Defense in depth design
SD-3	Security design review	CWE-269: Improper Privilege Management CWE-654: Reliance on a Single Factor in a Security Decision CWE-657: Violation of Secure Design Principles
SD-4	Secure design best practices	CWE-1242: Inclusion of Undocumented Features or Chicken Bits CWE-1246: Improper Write Handling in Limited-write Non-Volatile Memories CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management CWE-654: Reliance on a Single Factor in a Security Decision CWE-655: Insufficient Psychological Acceptability CWE-657: Violation of Secure Design Principles CWE-863: Incorrect Authorization CWE-920: Improper Restriction of Power Consumption
SI-1	Security implementation review	CWE-122: Heap-based Buffer Overflow CWE-1246: Improper Write Handling in Limited-write Non-Volatile Memories CWE-269: Improper Privilege Management CWE-400: Uncontrolled Resource Consumption CWE-416: Use After Free CWE-654: Reliance on a Single Factor in a Security Decision CWE-657: Violation of Secure Design Principles CWE-770: Allocation of Resources Without Limits or Throttling CWE-787: Out-of-bounds Write
SI-2	Secure coding standards	CWE-122: Heap-based Buffer Overflow CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations CWE-190: Integer Overflow or Wraparound CWE-770: Allocation of Resources Without Limits or Throttling CWE-787: Out-of-bounds Write
SVV-1	Security requirements testing	CWE-122: Heap-based Buffer Overflow CWE-1395: Dependency on Vulnerable Third-Party Component CWE-190: Integer Overflow or Wraparound CWE-346: Origin Validation Error CWE-771: Missing Reference to Active Allocated Resource CWE-787: Out-of-bounds Write CWE-863: Incorrect Authorization CWE-94: Improper Control of Generation of Code ('Code Injection')
SVV-2	Threat mitigation testing
SVV-3	Vulnerability testing	CWE-122: Heap-based Buffer Overflow CWE-1242: Inclusion of Undocumented Features or Chicken Bits CWE-1246: Improper Write Handling in Limited-write Non-Volatile Memories CWE-1395: Dependency on Vulnerable Third-Party Component CWE-190: Integer Overflow or Wraparound CWE-306: Missing Authentication for Critical Function CWE-400: Uncontrolled Resource Consumption CWE-779: Logging of Excessive Data CWE-787: Out-of-bounds Write CWE-94: Improper Control of Generation of Code ('Code Injection')
SVV-4	Penetration testing	CWE-863: Incorrect Authorization
SVV-5	Independence of testers
DM-1	Receiving notifications of security-releated issues	CWE-1395: Dependency on Vulnerable Third-Party Component
DM-2	Reviewing security-related issues
DM-3	Assessing security-related issues	CWE-1395: Dependency on Vulnerable Third-Party Component
DM-4	Adressing security-related issues	CWE-1395: Dependency on Vulnerable Third-Party Component
DM-5	Disclosing security-related issues
DM-6	Periodic review of security defect management practice
SG-1	Product defense in depth	CWE-1059: Insufficient Technical Documentation
SG-2	Defense in depth measures expected in the environment	CWE-1059: Insufficient Technical Documentation
SG-3	Security hardening guidelines	CWE-1059: Insufficient Technical Documentation
SG-4	Security disposal guidelines	CWE-1059: Insufficient Technical Documentation
SG-5	Security operational guidelines	CWE-1059: Insufficient Technical Documentation
SG-6	Account management guidelines	CWE-1059: Insufficient Technical Documentation
SG-7	Documentation review	CWE-1059: Insufficient Technical Documentation

---

Part 4-2

BR-RE	Requirement	SL1	SL2	SL3	SL4	Mapped CWE(s)
CR 1.1	Human user identification and authentication	x	x	x	x	CWE-1391: Use of Weak Credentials CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management CWE-287: Improper Authentication CWE-306: Missing Authentication for Critical Function
CR 1.1 RE 1	Unique identification and authentification		x	x	x
CR 1.1 RE 2	Multifactor authentification for all interfaces			x	x
CR 1.2	Software process and device identification and authentication		x	x	x	CWE-1391: Use of Weak Credentials CWE-287: Improper Authentication CWE-306: Missing Authentication for Critical Function
CR 1.2 RE 1	Unique identification and authentification			x	x
CR 1.3	Account management	x	x	x	x
CR 1.4	Identifier management	x	x	x	x
CR 1.5	Authenticator management	x	x	x	x	CWE-1391: Use of Weak Credentials CWE-256: Plaintext Storage of a Password CWE-311: Missing Encryption of Sensitive Data CWE-798: Use of Hard-coded Credentials
CR 1.5 RE 1	Hardware security for authenticators			x	x
NDR 1.6	Wireless access management	x	x	x	x
NDR 1.6 RE 1	Unique identification and authentification		x	x	x
CR 1.7	Strength of password-based authentication	x	x	x	x	CWE-1391: Use of Weak Credentials
CR 1.7 RE 1	Password generation and lifetime restrictions for human users			x	x
CR 1.7 RE 2	Password lifetime restriction for all users (human, software process or device)				x
CR 1.8	Public key infrastructure certificates		x	x	x	CWE-1391: Use of Weak Credentials
CR 1.9	Strength of public key-based authentication		x	x	x	CWE-1391: Use of Weak Credentials
CR 1.9 RE 1	Hardware security for public key authentication			x	x
CR 1.10	Authenticator feedback	x	x	x	x
CR 1.11	Unsuccessful login attempts	x	x	x	x
CR 1.12	System use notification	x	x	x	x
NDR 1.13	Access via untrusted networks	x	x	x	x
NDR 1.13 RE 1	Explicit acces request approval			x	x
CR 1.14	Strength of symmetric key-based authentication		x	x	x	CWE-1391: Use of Weak Credentials
CR 1.14 RE 1	Hardware security for symmetric key authentication			x	x
CR 2.1	Authorization enforcement	x	x	x	x	CWE-1391: Use of Weak Credentials CWE-269: Improper Privilege Management CWE-276: Incorrect Default Permissions CWE-306: Missing Authentication for Critical Function CWE-862: Missing Authorization CWE-863: Incorrect Authorization
CR 2.1 RE 1	Authorization enforcement for all users (human, software process and all devices)		x	x	x
CR 2.1 RE 2	Permission mapping to roles		x	x	x
CR 2.1 RE 3	Supervisor override			x	x
CR 2.1 RE 4	Dual approval				x
CR 2.2	Wireless use control	x	x	x	x	CWE-863: Incorrect Authorization
CR 2.3	Use control for portable and mobile devices	x	x	x	x
SAR 2.4	Mobile code	x	x	x	x
HDR 2.4	Mobile code	x	x	x	x
NDR 2.4	Mobile code	x	x	x	x
EDR 2.4	Mobile code	x	x	x	x
SAR 2.4 RE 1	Mobile code integrity check		x	x	x
HDR 2.4 RE 1	Mobile code		x	x	x
NDR 2.4 RE 1	Mobile code		x	x	x
EDR 2.4 RE 1	Mobile code		x	x	x
CR 2.5	Session lock	x	x	x	x
CR 2.6	Remote session termination		x	x	x
CR 2.7	Concurrent session control			x	x	CWE-770: Allocation of Resources Without Limits or Throttling
CR 2.8	Auditable events	x	x	x	x
CR 2.9	Audit storage capacity	x	x	x	x
CR 2.9 RE 1	Warn when audit log recorded capacity threashold reached			x	x
CR 2.10	Rationale and supplemental guidance	x	x	x	x
CR 2.11	Timestamps	x	x	x	x
CR 2.11 RE 1	Time synchronization		x	x	x
CR 2.11 RE 2	Protection of time source integrity				x
CR 2.12	Non-repudiation	x	x	x	x	CWE-1242: Inclusion of Undocumented Features or Chicken Bits
CR 2.12 RE 1	Non-repudiation for all users				x
HDR 2.13	Use of physical diagnostic and test interfaces	x	x	x	x
NDR 2.13	Use of physical diagnostic and test interfaces	x	x	x	x
EDR 2.13	Use of physical diagnostic and test interfaces	x	x	x	x
HDR 2.13 RE 1	Active monitoring			x	x
NDR 2.13 RE 1	Active monitoring			x	x
EDR 2.13 RE 1	Active monitoring			x	x
CR 3.1	Communication integrity	x	x	x	x	CWE-353: Missing Support for Integrity Check
CR 3.1 RE 1	Communication authentication		x	x	x
SAR 3.2	Protection from malicious code	x	x	x	x
EDR 3.2	Protection from malicious code	x	x	x	x
HDR 3.2	Protection from malicious code	x	x	x	x
HDR 3.2 RE 1	Report version of code protection		x	x	x
NDR 3.2	Protection from malicious code	x	x	x	x
CR 3.3	Security functionality verification	x	x	x	x
CR 3.3 RE 1	Security functionality verification during normal operation				x
CR 3.4	Software and information integrity	x	x	x	x
CR 3.4 RE 1	Authenticity of software and information		x	x	x
CR 3.4 RE 2	Automated notification of integrity violations			x	x
CR 3.5	Input validation	x	x	x	x	CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound CWE-754: Improper Check for Unusual or Exceptional Conditions CWE-787: Out-of-bounds Write CWE-94: Improper Control of Generation of Code ('Code Injection')
CR 3.6	Deterministic output	x	x	x	x
CR 3.7	Error handling	x	x	x	x	CWE-754: Improper Check for Unusual or Exceptional Conditions
CR 3.8	Session integrity		x	x	x
CR 3.9	Protection of audit information		x	x	x
CR 3.9 RE 1	Audit records on write once media				x
HDR 3.10	Support for update	x	x	x	x
NDR 3.10	Support for update	x	x	x	x
EDR 3.10	Support for update	x	x	x	x
HDR 3.10 RE 1	Update authenticity and integrity		x	x	x
NDR 3.10 RE 1	Update authenticity and integrity		x	x	x
EDR 3.10 RE 1	Update authenticity and integrity		x	x	x
HDR 3.11	Physical tamper resistance and detection		x	x	x
NDR 3.11	Physical tamper resistance and detection		x	x	x
EDR 3.11	Physical tamper resistance and detection		x	x	x
HDR 3.11 RE 1	Notification of tampering attempt			x	x
NDR 3.11 RE 1	Notification of tampering attempt			x	x
EDR 3.11 RE 1	Notification of tampering attempt			x	x
HDR 3.12	Provisioning product supplier roots of trust		x	x	x	CWE-1357: Reliance on Insufficiently Trustworthy Component CWE-347: Improper Verification of Cryptographic Signature
NDR 3.12	Provisioning product supplier roots of trust		x	x	x	CWE-1357: Reliance on Insufficiently Trustworthy Component CWE-347: Improper Verification of Cryptographic Signature
EDR 3.12	Provisioning product supplier roots of trust		x	x	x	CWE-1357: Reliance on Insufficiently Trustworthy Component CWE-347: Improper Verification of Cryptographic Signature
HDR 3.13	Provisioning asset owner roots of trust		x	x	x	CWE-1357: Reliance on Insufficiently Trustworthy Component
NDR 3.13	Provisioning asset owner roots of trust		x	x	x	CWE-1357: Reliance on Insufficiently Trustworthy Component
EDR 3.13	Provisioning asset owner roots of trust		x	x	x	CWE-1357: Reliance on Insufficiently Trustworthy Component
HDR 3.14	Integrity of the boot process	x	x	x	x
NDR 3.14	Integrity of the boot process	x	x	x	x
EDR 3.14	Integrity of the boot process	x	x	x	x
HDR 3.14 RE 1	Integrity of the boot chain		x	x	x
NDR 3.14 RE 1	Integrity of the boot chain		x	x	x
EDR 3.14 RE 1	Integrity of the boot chain		x	x	x
HDR 3.14 RE 2	Authenticity of the boot process		x	x	x
NDR 3.14 RE 2	Authenticity of the boot process		x	x	x
EDR 3.14 RE 2	Authenticity of the boot process		x	x	x
CR 4.1	Information confidentiality	x	x	x	x	CWE-311: Missing Encryption of Sensitive Data
CR 4.2	Information persistence		x	x	x
CR 4.2 RE 1	Erase of shared memory resources			x	x
CR 4.2 RE 2	Erase verification			x	x
CR 4.3	Use of cryptography	x	x	x	x	CWE-1391: Use of Weak Credentials CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CR 5.1	Network segmentation	x	x	x	x
NDR 5.2	Zone boundary protection	x	x	x	x
NDR 5.2 RE 1	Deny all, permit by exception		x	x	x
NDR 5.2 RE 2	Island mode			x	x
NDR 5.2 RE 3	Fail close			x	x
NDR 5.3	General-purpose person-to-person communication restrictions	x	x	x	x
CR 5.4	Application partitioning	x	x	x	x
CR 6.1	Audit log accessibility	x	x	x	x
CR 6.1 RE 1	Programmatic acces to audit logs			x	x
CR 6.2	Continuous monitoring		x	x	x	CWE-1395: Dependency on Vulnerable Third-Party Component CWE-920: Improper Restriction of Power Consumption
CR 7.1	Denial of service protection	x	x	x	x	CWE-400: Uncontrolled Resource Consumption
CR 7.1 RE 1	Manage communication load from component		x	x	x
CR 7.2	Resource management	x	x	x	x	CWE-1395: Dependency on Vulnerable Third-Party Component CWE-190: Integer Overflow or Wraparound CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling CWE-771: Missing Reference to Active Allocated Resource CWE-779: Logging of Excessive Data
CR 7.3	Control system backup	x	x	x	x	CWE-311: Missing Encryption of Sensitive Data CWE-321: Use of Hard-coded Cryptographic Key
CR 7.3 RE 1	Backup integrity veification		x	x	x
CR 7.4	Control system recovery and reconstitution	x	x	x	x
CR 7.5	Emergency power	x	x	x	x	CWE-1391: Use of Weak Credentials
CR 7.6	Network and security configuration settings	x	x	x	x
CR 7.6 RE 1	Machine-readable reporting of current security settings			x	x
CR 7.7	Least functionality	x	x	x	x
CR 7.8	Control system component inventory		x	x	x