ED Decision 2023/009/R
When complying with the requirement in IS.I.OR.220(a), the organisation should define and implement a strategy to detect information security incidents which may have a potential impact on safety.
This should be done in a way to ensure that at least the detection strategy is able to cover all known information security threats to their assets that may materialise in a safety hazard having unacceptable consequences.
DETECTION STRATEGY
In order to determine the scope of the event detection, the organisation should:
(a) identify a list of threat scenarios from the risks identified under IS.I.OR.205;
(b) identify, as a minimum, those assets that, if compromised, contribute to the scenario(s) that may materialise in an unsafe condition. For this identification of the assets, the measures introduced under IS.I.OR.210 should also be considered.
Note: The contribution of an asset to the threat scenario and the materialisation of an unsafe condition should be assessed by considering also the whole functional chain. In some cases, the asset may be at the end of a functional chain and if it is compromised, the effect on safety is direct and may be immediate; conversely, if the asset is far from the end of a functional chain and it is compromised, the effect should propagate and may be delayed.
Loading collections...