CISA Industrial Control Systems (ICS) Security Guidance
CISA, through its Industrial Control Systems Cyber Emergency Response Team (ICS‑CERT), publishes a continuous set of security resources for operational technology. This includes ICS‑CERT Advisories (vulnerability disclosures), Recommended Practices (RP‑1, RP‑2, etc.), Vulnerability Reports, Technical Documents, and Security Alerts, all aimed at improving the security of industrial control and SCADA systems.
CISA Industrial Control Systems (ICS) Security Guidance is a compliance framework from United States (CISA) with 2 domains and 16 controls that map to 4 other frameworks. The largest domains are CISA ICS: Defense-in-Depth Recommended Practice (9 controls), CISA ICS: Seven Steps to Effectively Defend ICS (7 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (2)
CISA ICS: Defense-in-Depth Recommended Practice
| Code | Title |
|---|---|
| CISA-ICS-DID-21 | Risk Management for ICS |
| CISA-ICS-DID-22 | Asset Inventory and Risk Characterization |
| CISA-ICS-DID-23 | Physical Security |
| CISA-ICS-DID-24 | ICS Network Architecture |
| CISA-ICS-DID-25 | Security Architecture (Perimeter, Firewalls, Diodes, Access) |
| CISA-ICS-DID-26 | Host Security (Patch, Field Devices, Virtual Machines) |
| CISA-ICS-DID-27 | Security Monitoring (IDS/IPS, Logging, SIEM) |
| CISA-ICS-DID-28 | Vendor Management and Supply Chain Security |
| CISA-ICS-DID-29 | The Human Element (Awareness and Training) |
CISA ICS: Seven Steps to Effectively Defend ICS
| Code | Title |
|---|---|
| CISA-ICS-7S-1 | Implement Application Allowlisting (Whitelisting) |
| CISA-ICS-7S-2 | Ensure Proper Configuration and Patch Management |
| CISA-ICS-7S-3 | Reduce Your Attack Surface Area |
| CISA-ICS-7S-4 | Build a Defendable Environment |
| CISA-ICS-7S-5 | Manage Authentication |
| CISA-ICS-7S-6 | Implement Secure Remote Access |
| CISA-ICS-7S-7 | Monitor and Respond |
Your Compliance Coverage
If you comply with CISA Industrial Control Systems (ICS) Security Guidance, you already cover:
Maps to 4 other frameworks
What is CISA Industrial Control Systems (ICS) Security Guidance and who does it apply to?
CISA Industrial Control Systems (ICS) Security Guidance is a compliance framework from United States (CISA) with 2 domains and 16 controls. CISA, through its Industrial Control Systems Cyber Emergency Response Team (ICS‑CERT), publishes a continuous set of security resources for operational technology. This includes ICS‑CERT Advisories (vulnerability disclosures), Recommended Practices (RP‑1, RP‑2, etc.), Vulnerability Reports, Technical Documents, and Security Alerts, all aimed at improving the security of industrial control and SCADA systems. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does CISA Industrial Control Systems (ICS) Security Guidance actually require?
CISA Industrial Control Systems (ICS) Security Guidance has 16 controls organised across 2 domains. The largest domains are CISA ICS: Defense-in-Depth Recommended Practice (9 controls), CISA ICS: Seven Steps to Effectively Defend ICS (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of CISA Industrial Control Systems (ICS) Security Guidance do I already cover?
CISA Industrial Control Systems (ICS) Security Guidance maps to 4 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (100% coverage), NIST Cybersecurity Framework 2.0 (100% coverage), ISO 27002:2022 (6% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement CISA Industrial Control Systems (ICS) Security Guidance?
Start your CISA Industrial Control Systems (ICS) Security Guidance compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CISA Industrial Control Systems (ICS) Security Guidance requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 16 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required