SEC Digital, OT and Control-Plane Security

The identity and access manager shall ensure that every human identity with access to BMS, EPMS, CDU and PLC engineering workstations and HMIs, BMC/Redfish interfaces, network devices, hypervisor and Kubernetes control planes, cluster managers and storage controllers is individually attributable, uses phishing-resistant multi-factor authentication where the system supports it (with compensating controls recorded where it does not, for example legacy HMIs), and is joined, moved and removed through an authoritative identity source within defined deadlines. The OT security owner shall maintain an inventory of OT systems that cannot integrate with central identity and the compensating controls applied.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational. Optional: E5, E6. Operating states: NORMAL, MAINTENANCE, EMERGENCY.

The platform security lead shall maintain an inventory of machine identities with access to in-scope infrastructure, including owner, purpose, scope, credential type, rotation interval and expiry, and shall prohibit long-lived static credentials for consequential authority where short-lived or certificate-based credentials are supported. The platform security lead shall require hardware-rooted identity (for example TPM or device identity certificates) and boot or firmware attestation (for example via SPDM or TPM quotes) for accelerator nodes, BMCs and fabric devices that support it, and shall gate cluster admission on successful attestation.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational. Optional: E5, E6. Operating states: NORMAL, MAINTENANCE, RECOVERY.

The infrastructure security owner shall define privileged roles by authority action (observe, configure, command, bypass, update, revoke, recover, per AIDCF-005) and by domain, shall prohibit standing cross-domain privileged roles (for example a single role with write access to both BMS/EPMS and cluster control planes) except as approved break-glass, and shall broker privileged sessions through a privileged access management (PAM) system or jump hosts providing just-in-time elevation, session recording and approval for command and bypass actions. The infrastructure security owner shall test at a defined interval that privilege boundaries hold, including that elevation requires approval and that sessions are recorded.

Evidence required: E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5, E7. Operating states: NORMAL, MAINTENANCE, EMERGENCY, RECOVERY.

The infrastructure security owner shall govern break-glass arrangements for all in-scope domains: inventory of emergency accounts, storage under dual control with an offline copy outside the failure domains they recover, use triggers, notification on use, maximum duration, mandatory post-use review and credential rotation. The infrastructure security owner shall verify at a defined interval that break-glass retrieval and login work with the primary identity provider and vault unavailable, and shall review all uses.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational. Optional: E4. Operating states: EMERGENCY, FAILED, RECOVERY.

The OT security owner shall perform a security risk assessment for BMS, EPMS, CDU controllers, PLCs, SCADA servers, historians and engineering workstations using a zone-and-conduit approach consistent with ISA/IEC 62443, assign a target security level (SL-T) to each zone, and implement countermeasures across the foundational requirement areas (identification and authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events, resource availability). The facility owner shall ensure that safety-instrumented and protection functions (electrical protection relays, emergency shutdown, hardwired interlocks) are independent of BMS/EPMS networks, and the OT security owner shall verify by test that unauthorised write or command attempts against controllers are blocked or detected and that controllers fail to a defined safe state on loss of supervisory communication.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5. Operating states: NORMAL, MAINTENANCE, DEGRADED, EMERGENCY.

The platform security lead shall harden each cluster manager and control plane to a documented benchmark (for example CIS Kubernetes Benchmark where applicable), restrict API server and scheduler administrative access to brokered privileged paths, enforce admission control that blocks privileged containers, host-namespace access and unapproved images on accelerator nodes, protect control-plane state stores (for example etcd) with encryption and access restriction, and separate tenant-facing from infrastructure-administrative interfaces. The platform security lead shall test at a defined interval that a tenant or workload identity cannot escalate to node, cluster-admin or BMC authority.

Evidence required: E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5, E7. Operating states: NORMAL, MAINTENANCE, RECOVERY.

The infrastructure security owner shall ensure fabric controllers, subnet managers and network automation platforms are reachable only from the management zone, use individually attributable and brokered administrative access, authenticate southbound connections to devices (for example certificate-based gNMI/NETCONF), protect fabric security keys (for example InfiniBand management and partition keys), and log all configuration actions to the security telemetry platform. The fabric operations lead shall reconcile controller access configuration to this requirement at a defined interval.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational. Optional: E5, E6. Operating states: NORMAL, MAINTENANCE.

The storage platform owner shall restrict storage controller and management interfaces to the management zone with brokered privileged access, shall require multi-person approval or delayed execution for destructive operations (volume or bucket deletion, snapshot or retention policy reduction, replication break), shall protect immutable recovery copies with retention locks that administrators cannot shorten, and shall log management actions to security telemetry.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational. Optional: E5, E6. Operating states: NORMAL, MAINTENANCE, RECOVERY.

The infrastructure security owner shall maintain a zone-and-conduit model covering facility OT (BMS, EPMS, CDU, PLC, fire and physical security integrations), infrastructure management (BMC, PDU, switch management, OOB), AI control planes, storage management, tenant and corporate networks and external connections, with each conduit's permitted flows, protocols and direction, and the security level target per zone. The OT security owner shall reconcile the as-built network (firewall rules, VLAN/VRF configuration, physical links, wireless and cellular devices) to the model at a defined interval and after change, and shall record every undocumented path (including dual-homed hosts and vendor-installed modems) as a Finding.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational. Optional: E5, E7. Operating states: NORMAL, MAINTENANCE, EMERGENCY.

The infrastructure security owner shall segment each management plane into its own zone, shall disable insecure management protocols (for example IPMI over LAN where Redfish is available, unauthenticated SNMP versions, Telnet), shall restrict BMC access to brokered administrative paths, and shall prevent host operating systems from reaching their own or other BMCs over the network except where required and approved. The infrastructure security owner shall test at a defined interval from representative tenant, workload and corporate vantage points that management interfaces are unreachable and that pivoting between management planes is blocked.

Evidence required: E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5, E7. Operating states: NORMAL, MAINTENANCE, RECOVERY.

The security operations manager shall operate boundary devices on every conduit in the zone model with deny-by-default rule sets, documented business justification and owner for each rule, review of rules at a defined interval, removal of unused rules, and logging of denied and permitted consequential flows to security telemetry. The OT security owner shall use unidirectional or protocol-break gateways where the zone model requires one-way data export from power and cooling control zones.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E1, E7. Operating states: NORMAL, MAINTENANCE.

The infrastructure security owner shall permit remote access to in-scope systems only through a managed remote-access gateway that enforces individual identity, MFA, per-session approval by the system owner for vendor and OEM access, time limits, session recording and the ability to terminate sessions in real time, and shall prohibit persistent vendor connections, vendor-installed remote-access tools and modems. The OT security owner shall require that remote sessions to power and cooling control systems with write or command capability are supervised by an on-site or on-shift authorised operator.

Evidence required: E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5, E7. Operating states: NORMAL, MAINTENANCE, EMERGENCY.

The infrastructure security owner shall define secure configuration baselines for each in-scope device class, including disabled unused services, credential policy, logging, and for firmware-bearing devices the approved signed firmware versions, secure boot enablement, firmware rollback protection and measured boot where supported. The platform security lead shall verify compliance with the baseline at a defined interval using automated assessment or attestation and shall record non-compliant devices as Findings.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational. Optional: E5, E6. Operating states: NORMAL, MAINTENANCE, RECOVERY.

The security operations manager shall maintain vulnerability visibility for all in-scope asset classes (including passive or vendor-advisory-based identification for OT assets that cannot be actively scanned), shall prioritise using exploitation evidence (for example known-exploited catalogues) and infrastructure consequence (reachability to CG-05/CG-06/CG-07/CG-15 authority), and shall meet remediation or mitigation times defined per priority. The security operations manager shall report overdue items to governance.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E1, E7. Operating states: NORMAL, MAINTENANCE.

The change authority shall require that patches and firmware updates to OT controllers, BMCs, NICs, switches, accelerator nodes and control planes are tested on representative test systems, approved by the system owner and, for OT, the vendor where required, applied in stages that never update all redundant members or all fault domains simultaneously, and verified after application with rollback available. The security operations manager shall measure patch latency against defined targets.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E1, E7. Operating states: MAINTENANCE, TRANSITION, NORMAL.

The infrastructure security owner shall maintain a security exception register for in-scope systems recording the deviation, risk assessment including infrastructure consequence, compensating controls, approver at the authority level required by consequence, and expiry. The infrastructure security owner shall verify compensating controls are in place before approval and at renewal.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational. Optional: E4. Operating states: NORMAL, MAINTENANCE.

The security operations manager shall collect security telemetry from identity providers, PAM, remote-access gateways, boundary devices, BMCs, network devices, fabric controllers, cluster managers, storage controllers and OT passive monitoring (including controller write and program-change events), with time synchronised to NET-024 sources, integrity protection, and retention per the evidence retention class, and shall monitor source health and alert on silent sources.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E1, E7. Operating states: NORMAL, MAINTENANCE, EMERGENCY, RECOVERY.

The security operations manager shall maintain detection use cases mapped to infrastructure threat scenarios (for example ATT&CK for ICS techniques and AIDCF-004 scenarios X05, X08, X15), covering unexpected controller writes or program changes, BMC firmware update or power commands outside change windows, mass configuration pushes, privilege escalation, anomalous remote sessions and automation acting outside its scope, and shall validate detection effectiveness by safe simulation at a defined interval.

Evidence required: E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5, E7. Operating states: NORMAL, MAINTENANCE, EMERGENCY.

The security operations manager shall maintain incident playbooks for infrastructure scenarios (BMS/EPMS compromise, BMC compromise, control-plane compromise, malicious automation, vendor account compromise) that define pre-approved containment actions (credential revocation, conduit closure, session termination, controller isolation to local or manual control), the safety checks required before each action, and the decision authority. The facility owner shall ensure that OT containment actions are coordinated with facility operations so that isolating supervisory control does not remove cooling or power continuity, and the security operations manager shall exercise the playbooks at a defined interval.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5, E7. Operating states: EMERGENCY, DEGRADED, RECOVERY.

The security operations manager shall define forensic collection procedures for each in-scope system class, including OT controllers and BMCs, specifying what to collect, how to collect safely, and chain-of-custody requirements, and shall ensure retention and legal hold capability for telemetry and session recordings. The OT security owner shall ensure baseline copies of controller programs and firmware hashes are available for comparison.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational. Optional: E5, E6. Operating states: EMERGENCY, RECOVERY.

The automation owner shall register every agent, automation and closed-loop control that can observe, configure, command, bypass, update or recover infrastructure (including AIOps remediation, cooling optimisation loops, power capping, network automation and AI agents with tool access), stating its effective identity, tools and APIs, target systems, permitted actions, rate and magnitude limits, operating states in which it may act, and its human owner. The infrastructure security owner shall reconcile registered scope with effective permissions at a defined interval and shall prohibit any automation from holding cross-domain command or bypass authority without approval under SEC-003.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational; E7 Derived and analytical. Optional: E4. Operating states: NORMAL, DEGRADED, MAINTENANCE, EMERGENCY.

The automation owner shall classify each automated action by consequence and reversibility and shall require human approval (single or dual) for actions above the defined threshold, such as OT setpoint or mode changes beyond limits, power-cycling beyond one fault domain, firmware updates, fabric-wide configuration pushes and destructive storage operations. The infrastructure security owner shall verify by test that approval cannot be bypassed by the automation's own identity.

Evidence required: E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5, E7. Operating states: NORMAL, MAINTENANCE, EMERGENCY.

The OT security owner shall enforce, at a boundary or broker the actor cannot modify (for example an OT protocol-aware gateway, a command broker or controller-level write protection), an allowlist of permitted commands, registers or objects, and parameter ranges for writes to BMS, EPMS, CDU and PLC systems from automation, agents and remote sessions, and shall block or require approval for anything outside the list. The OT security owner shall test at a defined interval that out-of-list writes and out-of-range values are blocked and alarmed.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5. Operating states: NORMAL, MAINTENANCE, EMERGENCY.

The automation owner shall provide, for every registered automation and agent, a kill switch that halts its actions without depending on the automation itself, a record of actions taken sufficient to reverse them, and a defined safe state (for example last approved setpoints, previous configuration) for each target. The automation owner shall test at a defined interval that the kill switch halts actions within target time and that rollback restores the safe state, coordinating OT rollback with facility operations.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5, E7. Operating states: NORMAL, EMERGENCY, RECOVERY, DEGRADED.