Standards Settingthe StandardforAutomation Certification ISA Education&Training Publishing Conferences & Exhibits AMERICAN NATIONAL STANDARD ANSI/ISA-62443-3-2-2020 Security for industrial automation and control systems, Part 3-2: Security risk assessment for system design FUY Approved August 11, 2020 NOTICEOFCOPYRIGHT This is a copyrighted document and may not be copied or distributed in any form or manner without the permission of ISA. This copy of the document was made for the sole use of the person to whom ISA provided it and is subject to the restrictions stated in ISA's license to that person It may not be provided to any other person in print, electronic, or any other form. Violations of ISA's copyright will be prosecuted to the fullest extent of the law and may result in substantialcivil and criminal penalties. TUV Rheinland Shenzhen ANSI/ISA-62443-3-2-2020 Security for industrial automation and control systems, Part 3-2: Security risk assessment for system design ISBN: 978-1-64331-116-6 Copyright @ 2020 by the International Society of Automation (iSA). All rights reserved. Not for resale. Printed in the United States of America. No part of this publication may be reproduced, photocopying, recording, or otherwise), without the prior written permission of the Publisher ISA 67 T.W. Alexander Drive P.O.Box12277 Research Triangle Park, NC 27709 USA - 3 - ANSI/ISA-62443-3-2-2020 PREFACE This preface, as well as all footnotes and annexes, is included for information purposes and is not part of ANSI/ISA-62443-3-2-2020. This document nas been prepared as part of the service of ISA, the International Scciety of Automation, toward a goal of uniformity in the field of instrumentation. To be of real value, this document should not be static but should be subject to periodic review.Toward this end,the Societywelcomes allcomments andcriticisms andasksthattheybeaddressedtotheSecretary Standards and Practices Board; ISA; 67 T.W. Alexander Drive; P. O. Box 12277; Research Triangle Park, NC 27709; Telephone (919) 549-8411; Fax (919) 549-8288; E-mail: [email protected]. metric system of units in general and the International System of Units (Sl) in particular, in the preparation of instrumentation standards. The Department is further aware of the benefits to USA users of isA standards of incorporating suitable references to the Sl (and the metric system) in TUV Rheinland Shenzhen their business and professional dealings with other countries. Toward this end, this Department will endeavor to introduce Sl-acceptable metric units in all new and revised standards, recommended practices and technical reports to the greatest extent possible. Standard for Use of the International System of Units (Sl): The Modern Metric System, published by the American Society for Testing and Materials as IEEE/ASTM S! 10-97, and future revisions, will be the reference guide for definitions, symbols, abbreviations, and conversion factors. It is the policy of isA to encourage and welcomg the participation of all concerned individuals and interestsinthedevelopmentofiSAstandards,recommendedpracticesandtechnicalreports Participation in the IsA standards-making process by an individual in no way constitutes endorsement by the employer of that individual, of IsA or of any of the standards, recommended practices and technical reports that IsA develops. CAUTION - ISA adheres to the policy of the American National Standards Institute with regard to patents. If isA is informed of an existing patent that is required for use of the standard,it will requirethe owner of the patent to either grant a royalty-free license for use of the patent by users complying with the standard or a license on reasonable terms and conditions that are free from unfair discrimination. Even if IsA is unaware of any patent covering this Standard, the user is cautioned that implementation of the standard may require use of techniques, processes or materials covered by patent rights. IsA takes no po