On Friday the first draft of the System Protection Profile for Industrial Control Systems was issued by PCSRF. The draft was written by a contractor with Common Criteria experience, but limited process control experience. Now the PCSRF members will review and comment.

We have not reviewed the document in detail yet. Our early impression is the document primarily put the Security Capabilities Profile in Common Criteria language, and we are concerned that it is too general. To be successful, a Protection Profile should be used by a vendor to submit a Target of Evaluation, a product, for certification. So one early question is what products or systems could be evaluated under this Protection Profile?

More detailed analysis to follow, and we will post a link to our written comments when they are available. Also, stay tuned for Digital Bond’s draft Protection Profile for Control Centers.