CWE-1383: Compliance Concerns in ICS Regulatory Requirements
Explore how vulnerabilities in ICS systems can be linked to regulatory compliance gaps and conflicting requirements, based on the SEI ETF's document. Learn about the impact of multiple regulatory frameworks on operational resilience and more.
Summary
Concerns within this particular classification are associated with the section titled "Compliance/Conformance with Regulatory Requirements" found in the SEI ETF's document on "Categories of Security Vulnerabilities in ICS" that was published in March 2022. According to the document, vulnerabilities in ICS systems can arise due to the presence of multiple regulatory frameworks and governing bodies, each with their own distinct areas of focus such as operational resilience, physical safety, interoperability, and security. These vulnerabilities may be a result of gaps in consideration, outdatedness, or conflicting requirements when adhering to the regulations. It's important to note that the recommendations from the "Nearest IT Neighbor" section of the report, alongside suggestions from the CWE team, are included in this category. However, please be aware that these relationships may undergo changes in future versions of the CWE.