CISA Industrial Control Systems (ICS) Security Guidance
CISA, through its Industrial Control Systems Cyber Emergency Response Team (ICS‑CERT), publishes a continuous set of security resources for operational technology. This includes ICS‑CERT Advisories (vulnerability disclosures), Recommended Practices (RP‑1, RP‑2, etc.), Vulnerability Reports, Technical Documents, and Security Alerts, all aimed at improving the security of industrial control and SCADA systems.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (2)
CISA ICS: Defense-in-Depth Recommended Practice
| Code | Title |
|---|---|
| CISA-ICS-DID-21 | Risk Management for ICS |
| CISA-ICS-DID-22 | Asset Inventory and Risk Characterization |
| CISA-ICS-DID-23 | Physical Security |
| CISA-ICS-DID-24 | ICS Network Architecture |
| CISA-ICS-DID-25 | Security Architecture (Perimeter, Firewalls, Diodes, Access) |
| CISA-ICS-DID-26 | Host Security (Patch, Field Devices, Virtual Machines) |
| CISA-ICS-DID-27 | Security Monitoring (IDS/IPS, Logging, SIEM) |
| CISA-ICS-DID-28 | Vendor Management and Supply Chain Security |
| CISA-ICS-DID-29 | The Human Element (Awareness and Training) |
CISA ICS: Seven Steps to Effectively Defend ICS
| Code | Title |
|---|---|
| CISA-ICS-7S-1 | Implement Application Allowlisting (Whitelisting) |
| CISA-ICS-7S-2 | Ensure Proper Configuration and Patch Management |
| CISA-ICS-7S-3 | Reduce Your Attack Surface Area |
| CISA-ICS-7S-4 | Build a Defendable Environment |
| CISA-ICS-7S-5 | Manage Authentication |
| CISA-ICS-7S-6 | Implement Secure Remote Access |
| CISA-ICS-7S-7 | Monitor and Respond |
Your Compliance Coverage
If you comply with CISA Industrial Control Systems (ICS) Security Guidance, you already cover:
Maps to 4 other frameworks
Frequently Asked Questions
What is CISA Industrial Control Systems (ICS) Security Guidance?
CISA Industrial Control Systems (ICS) Security Guidance is a compliance framework from United States (CISA) with 2 domains and 16 controls. CISA, through its Industrial Control Systems Cyber Emergency Response Team (ICS‑CERT), publishes a continuous set of security resources for operational technology. This includes ICS‑CERT Advisories (vulnerability disclosures), Recommended Practices (RP‑1, RP‑2, etc.), Vulnerability Reports, Technical Documents, and Security Alerts, all aimed at improving the security of industrial control and SCADA systems. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
How many controls does CISA Industrial Control Systems (ICS) Security Guidance have?
CISA Industrial Control Systems (ICS) Security Guidance has 16 controls organised across 2 domains. The largest domains are CISA ICS: Defense-in-Depth Recommended Practice (9 controls), CISA ICS: Seven Steps to Effectively Defend ICS (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
What frameworks does CISA Industrial Control Systems (ICS) Security Guidance map to?
CISA Industrial Control Systems (ICS) Security Guidance maps to 4 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (100% coverage), NIST Cybersecurity Framework 2.0 (100% coverage), ISO 27002:2022 (6% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I get started with CISA Industrial Control Systems (ICS) Security Guidance compliance?
Start your CISA Industrial Control Systems (ICS) Security Guidance compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CISA Industrial Control Systems (ICS) Security Guidance requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 16 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 718 frameworks.
Get Started Free →Free forever — no credit card required