What does ISO 27001 require for equipment at a production line and plant floor?

The register attaches ISO 27001 7.9 (Security of assets off-premises), ISO 27001 7.13 (Equipment maintenance), ISO 27001 8.7 (Protection against malware), ISO 27001 8.9 (Configuration management), ISO 27001 8.20 (Networks security), ISO 27001 8.22 (Segregation of networks) to a production line and plant floor by its default exposure (attended), link (always), data held and plant, with the ISO 27002 guidance beside each.

Who is there when a production line and plant floor runs, and how is it connected?

Exposure attended: operators are on the line every shift; the control cabinets are open to anyone on the floor. Link always by default: a wired plant network with a link to the office network that is rarely as separate as the drawing says.

What does a lost, stolen or offline production line and plant floor cost?

A line offline from the office keeps running on its controllers; a line reached through the office network stops when the office is compromised.

What should we ask the vendor of the hardware at a production line and plant floor?

For the PLCs, the HMIs, the SCADA server and the engineering workstations, over the fixed link: 1. Can you show measured boot or firmware attestation on the equipment, and how a failed check reports back over the fixed link? 2. How does the equipment take an update unattended over the fixed link, and how does it roll back on its own when the update fails part way? 3. Can a lost or stolen unit be wiped remotely, and what happens to the wipe command while the unit is offline? 4. Is local storage on the equipment encrypted at rest with the key held off the device, and can that be verified from the fleet console? 5. Can the equipment be recovered to a known state by a non-technical person on site, without a technician's visit? 6. What spares, lead times and end-of-support dates apply to the equipment, and who holds the spares nearest the site? For this class: How is the plant network separated from the office network today, and how does an engineering workstation reach the PLCs?

Every site class · Plant, substation and utility asset

Production line and plant floor

PLCs and HMIs on the line, a SCADA server, engineering workstations, barcode readers and the MES client, on a plant network that predates the office one.

How the register reads it

Also called	factory, assembly line, SCADA cell
Family	Plant, substation and utility asset
Exposure by default	Attended: operators are on the line every shift; the control cabinets are open to anyone on the floor. A line that says attended, unattended, public or hostile (outdoors, in transit, at sea) overrides it.
Link by default	Always: a wired plant network with a link to the office network that is rarely as separate as the drawing says. A line that names the link (fibre, 4G, satellite, radio, offline) overrides it.
Regulated data by default	None; a line that names customer, staff, patient, card or controlled data adds it.
Runs plant	Yes: the OT overlay (NIST SP 800-82 Rev 3) attaches, and IEC 62443 is named beside it as a reference.
What a loss costs	A line offline from the office keeps running on its controllers; a line reached through the office network stops when the office is compromised.
Contract focus	OT segregation evidence, controller patching and rollback terms, vendor remote maintenance conditions, safety-system isolation.

What each regime attaches

17 clauses across 7 regimes, on the class defaults

Shown on a register for the regimes you tick, by the exposure, link, data and plant the line states; with none ticked, the ISO 27001 rows are the default. Requirement text drawn from the compliance.theartofservice.com corpus, read against the held text of each standard: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022, with the 27002:2022 guidance beside it

Attaches to every site: the off-premises, equipment, media, endpoint, backup, redundancy, network and continuity controls of Annex A, by the site's exposure, link, data and plant. With nothing ticked these rows render as the default.

ISO 27001 7.9 Security of assets off-premises

Protect assets used or held off-site.

ISO 27002 7.9 guidance: Requires assets located away from the organisation's premises to be protected.

Evidence an auditor accepts: offsite_asset_inventory; transport_security_procedures; third_party_agreements
Common gap: Missing offsite asset register
Source framework: ISO/IEC 27001:2022

ISO 27001 7.13 Equipment maintenance

Maintain equipment correctly to preserve availability, integrity and confidentiality.

ISO 27002 7.13 guidance: Requires equipment to be maintained correctly, so that information stays available, intact and confidential.

Evidence an auditor accepts: maintenance_schedule; maintenance_logs; calibration_records
Common gap: no documented maintenance schedule
Source framework: ISO/IEC 27001:2022

ISO 27001 8.7 Protection against malware

Implement malware protection backed by user awareness.

ISO 27002 8.7 guidance: Requires malware protection to be put in place and reinforced by suitable awareness among users.

Evidence an auditor accepts: anti_malware_policy; endpoint_protection; user_awareness_program
Common gap: Outdated malware signatures not regularly updated
Source framework: ISO/IEC 27001:2022

ISO 27001 8.9 Configuration management

Establish, document, implement, monitor and review secure configurations for hardware, software, services and networks.

ISO 27002 8.9 guidance: Requires configurations of hardware, software, services and networks, including their security configurations, to be established, documented, implemented, monitored and reviewed. Supporting material frames this as a standing process that keeps systems configured securely and consistently.

Evidence an auditor accepts: baseline_configurations; change_control_records; configuration_audit_reports
Common gap: outdated baselines
Source framework: ISO/IEC 27001:2022

ISO 27001 8.20 Networks security

Secure, manage and control networks and network devices.

ISO 27002 8.20 guidance: Requires networks and network devices to be secured, managed and controlled in order to protect the information carried in systems and applications.

Evidence an auditor accepts: network_topology_diagrams; firewall_rule_sets; network_access_control_lists
Common gap: outdated topology diagrams
Source framework: ISO/IEC 27001:2022

ISO 27001 8.22 Segregation of networks

Segregate groups of services, users and systems in the network.

ISO 27002 8.22 guidance: Requires segregation within the organisation's networks, keeping groups of information services, of users and of systems apart from one another.

Evidence an auditor accepts: network_segmentation_policy; network_topology_diagrams; firewall_rule_set_documents
Common gap: Informal or outdated network maps used instead of documented diagrams
Source framework: ISO/IEC 27001:2022

NIST SP 800-53 Rev 5

Attaches to every site: the PE family for the premises and the alternate work site, MP for the media, AC-17, AC-19 and AC-20 for remote access, mobile devices and external systems, the CP family for the sites that lose their link, SC-7 for the boundary and SI-7 and CM-8 for what runs there.

SP 800-53 CM-8 System component inventory

Requires an accurate inventory of system components that covers every component, avoids duplicate or cross system accounting, is held at the granularity needed for tracking and reporting, carries the information the organization has defined for accountability, and is reviewed and updated on a defined frequency.

Evidence an auditor accepts: Component inventory with the defined accountability fields populated; Reconciliation of the inventory against a discovery scan or cloud asset listing; Defined review frequency and evidence of review at that cadence
Common gap: Cloud and container assets absent because inventory is built from a fixed asset register
Source framework: NIST SP 800-53 Rev 5

SP 800-53 PE-3 Physical access control

Requires physical access authorizations to be enforced at defined entry and exit points by verifying authorization before entry and controlling ingress and egress with defined mechanisms or guards, physical access audit logs to be kept, publicly accessible areas to be controlled, visitors to be escorted and their activity controlled in defined circumstances,...

Evidence an auditor accepts: Entry and exit point register showing the enforcement mechanism at each; Physical access audit logs from badge or guard systems; Visitor escort procedure and completed visitor logs
Common gap: Tailgating unaddressed, so an authorization check happens for only the first person through
Source framework: NIST SP 800-53 Rev 5

SP 800-53 SC-7 Boundary protection

Requires communications to be monitored and controlled at external managed interfaces and at key internal interfaces, publicly accessible components to sit in subnetworks physically or logically separated from internal networks, and connections to external networks or systems to pass only through managed interfaces built from boundary protection devices arra...

Evidence an auditor accepts: Network architecture diagram identifying external and key internal managed interfaces; Firewall and gateway rule sets with review records; Evidence publicly accessible components are separated from internal networks
Common gap: Undocumented external connections such as vendor tunnels bypass the managed interfaces
Source framework: NIST SP 800-53 Rev 5

SP 800-53 SI-7 Software, firmware, and information integrity

Requires integrity verification tools to be employed to detect unauthorized changes to organization-defined software, firmware and information, and requires organization-defined actions to be taken when such unauthorized changes are detected.

Evidence an auditor accepts: Defined list of software, firmware and information subject to integrity verification; Integrity monitoring tool configuration and coverage report; Alerts generated by integrity checks and the response records
Common gap: Integrity monitoring produces constant noise from routine change and is therefore ignored
Source framework: NIST SP 800-53 Rev 5

CIS Controls v8

Attaches to every site: the asset inventory on all of them, anti-malware on the unattended and public ones and on plant, automated and isolated backups where the link is intermittent or absent, remote wipe and the VPN on portable and remote devices.

CIS v8 CIS-1.1 Establish and Maintain Detailed Enterprise Asset Inventory

Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to store or process data, to include: end-user devices (including portable and mobile), network devices, non-computing/IoT devices, and servers. Ensure the inventory records the network address (if static), hardware address, machine name, enterp...

Evidence an auditor accepts: Evidence the safeguard is implemented: Establish and Maintain Detailed Enterprise Asset Inventory; Policy/standard covering CIS Control 1 (Inventory and Control of Enterprise Assets); Configuration / tooling output demonstrating the safeguard
Common gap: Safeguard implemented for some assets but not all in scope
Source framework: CIS Controls v8

CIS v8 CIS-10.1 Deploy and Maintain Anti-Malware Software

Deploy and maintain anti-malware software on all enterprise assets.

Evidence an auditor accepts: Evidence the safeguard is implemented: Deploy and Maintain Anti-Malware Software; Policy/standard covering CIS Control 10 (Malware Defenses); Configuration / tooling output demonstrating the safeguard
Common gap: Safeguard implemented for some assets but not all in scope
Source framework: CIS Controls v8

ISO 22301:2019

Attaches the business continuity plans and procedures to every site, and the plan content and recovery clauses to the sites whose link is intermittent or absent.

ISO 22301 8.4.1 General

Implement and maintain a response structure enabling timely warning and communication to relevant interested parties, with plans and procedures to manage the organization through a disruption and to activate continuity solutions, identified and documented from the output of the selected strategies and solutions, and with procedures that are specific about im...

Evidence an auditor accepts: Documented response structure; Procedures stating immediate steps and the roles that take them; Traceability from selected strategies and solutions to the documented plans
Common gap: Procedures written for one rehearsed scenario, brittle against anything else
Source framework: ISO 22301:2019

DORA, the Digital Operational Resilience Act

Attaches Article 11 (response and recovery) to every site of a financial entity and Article 12 (backup, restoration and recovery) to the sites whose link is intermittent or absent; a site with no recovery objective is a finding.

DORA Art. 11 Response and recovery

Financial entities shall put in place an ICT business continuity policy and ICT response and recovery plans (including measures, procedures and arrangements) to ensure continuity of critical or important functions, quickly contain damage, resume activities and recover, subject to regular testing.

Evidence an auditor accepts: ICT business continuity policy + response/recovery plans; Records of plan testing
Common gap: No ICT continuity/response/recovery plans
Source framework: DORA (Regulation (EU) 2022/2554)

NIST SP 800-82 Rev 3, the OT overlay

Attaches to the sites that run plant: zones and conduits and the dispersed-OT guidance on every one, tamper detection where nobody is there, spares and cold standby where the link is intermittent, and the two remote-access controls where remote access is named. IEC 62443 is named beside it as a reference; its text is not quoted.

SP 800-82 OT-ARCH-1 Network Segmentation by Zones and Conduits

Segment OT networks into logical zones and conduits aligned with the Purdue model and IEC 62443, restricting traffic between zones via controlled conduits with documented data flows.

Evidence an auditor accepts: Zone and conduit diagram; Purdue level mapping; Conduit data flow matrix
Common gap: Flat OT network
Source framework: NIST SP 800-82 Rev 3

SP 800-82 OT-SECTOR-3 Distributed and Geographically Dispersed OT

Address security for geographically distributed OT (substations, pump stations, wellheads, remote terminal units) where physical access controls and connectivity options are constrained.

Evidence an auditor accepts: Remote site security standard; Communications security configuration (encrypted radio, cellular VPN); Site inspection records
Common gap: Unencrypted SCADA communications
Source framework: NIST SP 800-82 Rev 3

NIST SP 800-207, zero trust architecture

Attaches the satellite-facility deployment scenario to every site and the two design tenets (every communication secured, every asset's posture monitored) to the sites where remote access is named. No regime page: it renders on the remote-access rows and the finding.

SP 800-207 SC-SATELLITE Deployment Scenario: Enterprise with Satellite Facilities

Applies ZTA to an organization with a headquarters plus geographically dispersed locations and remote workers that have no full enterprise-owned network.

Evidence an auditor accepts: ZTA design for remote workers and satellite sites; Policy coverage for off-network access
Common gap: VPN-only model treated as zero trust
Source framework: NIST SP 800-207

Questions for the hardware vendor

six, and one for the class

For the PLCs, the HMIs, the SCADA server and the engineering workstations, over the fixed link:

Can you show measured boot or firmware attestation on the equipment, and how a failed check reports back over the fixed link?
How does the equipment take an update unattended over the fixed link, and how does it roll back on its own when the update fails part way?
Can a lost or stolen unit be wiped remotely, and what happens to the wipe command while the unit is offline?
Is local storage on the equipment encrypted at rest with the key held off the device, and can that be verified from the fleet console?
Can the equipment be recovered to a known state by a non-technical person on site, without a technician's visit?
What spares, lead times and end-of-support dates apply to the equipment, and who holds the spares nearest the site?

For this class: How is the plant network separated from the office network today, and how does an engineering workstation reach the PLCs?

Findings this class can raise

Plant with no segregation stated
A site that runs plant (controllers, RTUs, HMIs, historians) where the line says nothing about a segregated network, a zone or a firewall between the plant and everything else. The OT guidance and the network controls ask for the zones and the conduits to be drawn and the boundary enforced; the register cannot see them, so it asks.
Remote access to plant
A site that runs plant where the line names remote access: a vendor's maintenance session, the engineers' dial-in, a support path. The OT guidance treats remote access to control systems as its own duty, with the vendor's access under separate conditions, and the zero-trust design rules ask that every session be authenticated and every device's posture checked before it reaches the controller.
Concentration in one class or one link type
One site class holding a third or more of the sites (three or more of them), or a single link type across every site: the register names the share so the dependence is a recorded one. A failure mode shared by every site (one carrier, one device model, one class) is what the continuity and redundancy duties ask to be planned for, not avoided.
Financial entity site with no recovery objective
DORA is ticked and the line carries no recovery time objective. Articles 11 and 12 ask a financial entity to hold response and recovery plans and backup and restoration procedures with recovery objectives for its ICT systems, wherever they run; a branch, an ATM estate or an outsourcing site without one is a gap in the plan, not in the site.
Hardware questions unanswered
On the first paste no line answers the six questions the register puts to the vendor of the hardware at each site: attestation of firmware and boot, unattended update and rollback, remote wipe, local storage encryption, recovery without a technician, spares; each class adds one question of its own. The finding is the RFI page: the questions per site, grouped by class, ready to paste into the next rollout's request.

Do this for every site on your list

Paste the list and get this reading for every site at once, with the link, the exposure, the data held, the findings and the duty rows per regime. Eight sites free, no account.

Build my edge register

Print and mail centre · Pumping station and treatment works