Maintenance Window

Document, communicate and provide audit planning and conduct rules that confine auditors to read only access within the agreed plan, place potentially disruptive activity into maintenance windows or off peak periods, and require audit activity to be logged and...

UR E27 requires equipment manufacturers to provide secure update + patch mechanisms supporting ship lifecycle (typically 20-25 years).

NSS-17 + NSS-42-G require vulnerability + patch management + removable media + portable device controls. Vulnerability management: vendor security advisories + CVE feeds + ICS-CERT + national CERT subscriptions;

Sections 5.5 + 5.6 + 5.7 + 5.8 establish firmware + configuration + time + data protection capabilities required of IEDs. Per public IEEE 1686 abstract + vendor capability statements (full IEEE text NOT reproduced): Section 5.5 Firmware Quality and Update Cont...

Protect is the second of five functional elements per MSC-FAL.1/Circ.3/Rev.2. Activities include: (1) Access Control - identity and access management for IT + OT systems + role-based access + least privilege + privileged access management (PAM) for OT engineer...

Establish an OT patch management process that tests patches in a representative environment, schedules deployment during maintenance windows, and applies compensating controls when patching is not feasible.