Frameworks · Middle East
DESC ICS Standard
The Dubai Electronic Security Center launched the Industrial Control Systems (ICS) Security Standard in March 2020. It provides a framework for managing cyber risk to industrial control systems and operational technology in Dubai's critical infrastructure. It applies to Dubai Government and semi-government entities that operate critical infrastructure or ICS.
Who it applies to
It applies to Dubai Government and semi-government entities that operate critical infrastructure or industrial control systems, and to the engineering and integration suppliers in their scope.
Main requirements
Governance
OT security has its own governance, roles and risk management, separate from enterprise IT.
Architecture
IT and OT are segmented into zones and conduits, and remote access is secured.
Operations
Entities keep an asset inventory, patch within OT constraints, monitor systems and control changes.
Response & recovery
Incident response and recovery plans for control systems are tested on a regular schedule.
How xmodo supports it
- 1
OT assets are recorded in the asset register with their zone, so segmentation and access controls are evidenced against real systems.
- 2
Each control has an owner and evidence and maps to DESC ISR 3.1, so your IT programme counts where it applies.
- 3
Incident response for control systems runs in the incident workflow with its own playbooks.
Related frameworks
DESC ICS Standard shares requirements with the frameworks below. Controls you already run for any of them count towards DESC ICS Standard as well.
Frequently asked questions
Does the ISR already cover ICS?
The ISR covers the entity's information security. The ICS Standard adds requirements specific to operational technology: segmentation, patching that is safe for OT, and response for control systems. xmodo maps the two so shared controls are implemented once.