NIST issued a RFP a few weeks ago for the development of a field device Protection Profile. Common Criteria Protection Profiles are used by industry groups to define the functional and assurance requirements. Vendors can build to these Protection Profiles and actually get their products independently tested and certified.

A field device protection profile would be smaller than PCSRF’s previous two efforts, the System Protection Profile and Control Center Protection Profile, and the target of evaluation is likely to be under the control of a single vendor. Both of these facts bode well for a faster and more effective effort.

Digital Bond along with a number of other vendors have put in proposals for this work. Whoever wins this will lead a worthy attempt to define specific security requirements for future PLC’s, RTU’s and other field devices. You will be able to review and contribute to the drafts as they work there way through PCSRF in the first half of 2006.