What is EN ISO 31248:2018

EN ISO 31248:2018 is a technical standard that provides guidelines for the development and implementation of information security controls within the context of Non-Integrated Safety Systems (NISS). This standard aims to enhance the overall security posture of organizations by providing a systematic approach to identify, assess, and address information security risks associated with NISS.

Understanding NISS

Non-Integrated Safety Systems (NISS) refer to systems that are not directly linked or integrated into an organization's Information Technology (IT) infrastructure. These systems often govern critical operational functions and have unique security requirements separate from traditional IT systems. NISS commonly include industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems, and other specialized equipment used in sectors such as manufacturing, energy, and transportation.

The Importance of EN ISO 31248:2018

EN ISO 31248:2018 plays a crucial role in ensuring the security of NISS by focusing on the specific risks faced by these systems. This standard helps organizations establish a comprehensive framework for assessing their information security needs and implementing appropriate controls. By adhering to EN ISO 31248:2018, organizations can minimize security vulnerabilities and protect against potential cyber threats that could compromise the integrity, availability, and confidentiality of NISS.

Key Elements of EN ISO 31248:2018

The standard outlines several key elements that organizations should consider when implementing information security controls for NISS:

1. Risk Assessment: Organizations must perform a thorough evaluation of the risks associated with their NISS environment. This includes identifying potential threats, vulnerabilities, and impacts on safety, operations, and data confidentiality.

2. Security Controls: EN ISO 31248:2018 provides a set of recommended security controls that organizations can implement to mitigate identified risks. These controls cover various aspects, such as access control, incident response, system hardening, and security awareness training.

3. Security Management: The standard emphasizes the importance of establishing a robust security management system for NISS. This involves defining clear roles and responsibilities, conducting regular audits, and continuously monitoring and improving the security posture of NISS.

By following these guidelines, organizations can enhance the overall resilience of their NISS systems and ensure the safe and secure operation of critical infrastructure.