This collection supports study of industrial control systems (ICS), operational technology (OT), and cybersecurity. It includes practical guidance, standards, sector publications, research papers, and editable policy examples.
Choose a reading path for your question or assignment:
- OT security foundations: The Five ICS Cybersecurity Critical Controls - 2022.10. Start with five practical priorities for protecting industrial environments.
- OT security in depth: NIST SP 800-82 - Guide to Operational Technology (OT) Security - Revision 3 - 2023.09. Use this broader reference for OT architectures, threats, safeguards, and risk.
- Cybersecurity outcomes: NIST - Cybersecurity Framework - v2.0 - 2024.02.26. Use the CSF to organize and discuss cybersecurity outcomes.
- Applying the CSF: NIST SP 1301 - Cybersecurity Framework - Quick Start Guide for Creating and Using Organizational Profiles - v2.0 - 2024.02.26. Create current and target organizational profiles and identify gaps.
- Finding supporting controls: NIST SP 1347 - Cybersecurity Framework - Informative References Quick Start Guide - v2.0 - 2026.08. Learn to interpret mappings to other standards; use the accompanying workbook.
- CSF mappings and examples: NIST - Cybersecurity Framework - Informative References and Implementation Examples - v2.0 - Undated. Explore supporting controls and illustrative actions in the Excel workbook.
- Incident response: Dynamic Incident Response - A Framework for Security Teams - Edition 1 - 2026.09.15. Study a framework for organizing incident response work.
- OT asset inventory: Foundations for OT Cybersecurity - Asset Inventory Guidance for Owners and Operators - 2025.08.13. Identify and document the assets needed to understand an OT environment.
Folders group documents by publisher or lead issuing organization, with series subfolders where useful. Government folder prefixes identify AU (Australia), DE (Germany), GB (United Kingdom), JP (Japan), and US (United States). EU identifies the European Union. Joint guidance is filed under its lead issuer.
- CISA, ASD, and NCSC: OT security principles, asset inventories, connectivity, procurement, logging, and practical defensive guidance.
- NIST: cybersecurity frameworks, technical guidance, cryptographic standards, manufacturing examples, and smart grid reports. SP means Special Publication; IR means Interagency or Internal Report; FIPS means Federal Information Processing Standard.
- SANS Institute: incident response and ICS critical controls.
- DOE, NERC, and FERC: energy security, maturity models, reliability standards, and regulatory orders.
- IAEA, NRC, and NEI: nuclear security guidance, regulations, and industry plans.
- SEDC: editable policy and form examples. Adapt these to the scenario; they are not a complete security program by themselves.
- Research Papers, ASAP-SG, and InGuardians: background research, smart grid security profiles, and metering attack methodology.
The date at the end of a filename identifies the publication edition, at the
precision available. Undated means no publication date was established; it does
not mean the document is recent. Versions use labels such as v2.0; revisions
and editions retain their own labels.
- CSF workbook: contains both informative references and implementation examples. It is a live export retrieved on October 18, 2026. Mappings identify supporting material; they do not demonstrate that an outcome is fulfilled. NIST does not endorse non-NIST mappings in its catalog. Consult the NIST resource page for refreshed data.
- SP 800-53: the Rev 5 PDF includes December 2020 updates. The separate Release 5.2.0 summary describes later changes; it is not the full updated control catalog. Follow the NIST publication record for control catalog resources.
- NERC:
Future Enforcementcontains approved future editions. Distinguish these from the editions in the main CIP folder. Check jurisdiction, effective dates, and implementation plans in the NERC catalog. - NEI 08-09: Rev 7 is under
Submitted Revisions. Its transmittal requests NRC endorsement; submission alone does not establish endorsement. - Regulations: the Part 73 PDF is the annual edition revised January 1, 2026. Consult the eCFR for subsequent amendments.
- Historical readings: CPNI guidance, older CISA/DHS recommended practices, NIST manufacturing examples, the smart grid introduction, and SEDC templates provide context. Assess their assumptions against the system being studied. A newer framework does not automatically update its companion documents.
- Other editions: the CSA guidance here is v4; see the publisher's v5 page for newer guidance. The Chemical Sector implementation guide here is the 2015 edition; a May 2020 revision has been identified but is not included.
Each entry opens the local reading and links to its publisher record or source. A source may host a newer edition than the local copy. A link to a publisher does not imply that the publisher endorses this collection.
- 3PDA Security Profile - v1.0 - 2011.05.18 — Source
- AMI Security Profile - v2.1 - 2012.10.23 — Source
- DM Security Profile - v1.0 - 2012.02.20 — Source
- SA Security Profile - v0.15 - Draft - 2012.09.30 — Source
- WAMPAC Security Profile - v0.08 - 2011.05.16 — Source
- Best Practices for Event Logging and Threat Detection - 2024.08 — Source
- Principles of Operational Technology Cyber Security - 2024.10.02 — Source
- BSI - ICS Security Compendium for Product Suppliers - 2014.11.19 — Source
- BSI-CS 005E - ICS Top 10 Threats and Countermeasures - v1.50 - 2022 — Source
- Mitigating Security Risk in the National Infrastructure Supply Chain - 2017.06 — Source
- Personnel Security Risk Assessment - A Guide - Edition 4 - 2013.06 — Source
- Personnel Security Risk Assessment - Briefing Sheet - Undated — Source
- Risk Management Advice - Doing Business Overseas - 2012.05 — Source
GB - CPNI - Centre for the Protection of National Infrastructure/SICS - Security for Industrial Control Systems
- SICS - Establish Ongoing Governance - v1.0 - Final - Undated — Source
- SICS - Establish Response Capabilities - v1.0 - Final - Undated — Source
- SICS - Executive Summary - v1.0 - Final - Undated — Source
- SICS - Framework Infographic - Undated — Source
- SICS - Framework Overview - v1.1 - Final - Undated — Source
- SICS - Improve Awareness and Skills - v1.0 - Final - Undated — Source
- SICS - Manage ICS Lifecycle - v1.0 - Final - Undated — Source
- SICS - Manage The Business Risk - v1.1 - Final - Undated — Source
- SICS - Manage Third Party Risks - v1.0 - Final - Undated — Source
- SICS - Manage Vulnerabilities - v1.0 - Final - Undated — Source
- SICS - Select and Implement Security Improvements - v1.1 - Final - Undated — Source
- NCSC - 10 Steps to Cyber Security - Infographic - 2021.05.11 — Source
- NCSC - Common Cyber Attacks - Infographic - Undated — Source
- NCSC - Common Cyber Attacks - Reducing the Impact - 2016.01 — Source
- NCSC - Design Principles and Operational Technology - 2020.05.22 — Source
- NCSC - Virtualisation Security Design Principles - Blog Post - 2019.08.07 — Source
- Secure Connectivity Principles for Operational Technology (OT) - 2026.01.15 — Source
- IAEA TDL 005 - Computer Security Incident Response Planning at Nuclear Facilities - 2016.06 — Source
- IAEA TDL 006 - Conducting Computer Security Assessments at Nuclear Facilities - 2016.06 — Source
- NSS 17-T - Computer Security Techniques for Nuclear Facilities - Revision 1 - 2021.09 — Source
- NSS 23-G - Security of Nuclear Information - Implementing Guide - 2015.02 — Source
- NSS 33-T - Computer Security of Instrumentation and Control Systems at Nuclear Facilities - 2018.05 — Source
- NEI 08-09 - Cyber Security Plan for Nuclear Power Reactors - Revision 7 - Submitted - 2025.04.07 — Source
- CIP-002-5.1a - Cyber Security - BES Cyber System Categorization - Undated — Source
- CIP-003-9 - Cyber Security - Security Management Controls - Undated — Source
- CIP-004-7 - Cyber Security - Personnel & Training - Undated — Source
- CIP-005-7 - Cyber Security - Electronic Security Perimeter(s) - Undated — Source
- CIP-006-6 - Cyber Security - Physical Security of BES Cyber Systems - Undated — Source
- CIP-007-6 - Cyber Security - Systems Security Management - Undated — Source
- CIP-008-6 - Cyber Security - Incident Reporting and Response Planning - Undated — Source
- CIP-009-6 - Cyber Security - Recovery Plans for BES Cyber Systems - Undated — Source
- CIP-010-4 - Cyber Security - Configuration Change Management and Vulnerability Assessments - Undated — Source
- CIP-011-3 - Cyber Security - Information Protection - Undated — Source
- CIP-012-2 - Cyber Security - Communications between Control Centers - Undated — Source
- CIP-013-2 - Cyber Security - Supply Chain Risk Management - Undated — Source
- CIP-014-3 - Physical Security - Undated — Source
NERC - North American Electric Reliability Corporation/CIP - Critical Infrastructure Protection/Future Enforcement
- CIP-002-8 - Cyber Security - BES Cyber System Categorization - Undated — Source
- CIP-003-11 - Cyber Security - Security Management Controls - Undated — Source
- CIP-004-8 - Cyber Security - Personnel & Training - Undated — Source
- CIP-005-8 - Cyber Security - Electronic Security Perimeter(s) - Undated — Source
- CIP-006-7.1 - Cyber Security - Physical Security of BES Cyber Systems - Undated — Source
- CIP-007-7.1 - Cyber Security - Systems Security Management - Undated — Source
- CIP-008-7.1 - Cyber Security - Incident Reporting and Response Planning - Undated — Source
- CIP-009-7.1 - Cyber Security - Recovery Plans for BES Cyber Systems - Undated — Source
- CIP-010-5 - Cyber Security - Configuration Change Management and Vulnerability Assessments - Undated — Source
- CIP-011-4.1 - Cyber Security - Information Protection - Undated — Source
- CIP-013-3 - Cyber Security - Supply Chain Risk Management - Undated — Source
- CIP-014-4 - Physical Security - Undated — Source
- CSSWG - Security Guidelines for the Electricity Sector - Control System Electronic Connectivity - 2013.10.28 — Source
- ICSCorsair - How I Will PWN Your ERP Through 4 to 20 mA Current Loop - 2014.08.07 — Source
- Purdue Enterprise Reference Architecture (PERA) - 1993 — Source
- Dynamic Incident Response - A Framework for Security Teams - Edition 1 - 2026.09.15 — Source
- ICS Cybersecurity Response to Physical Breaches of Unmanned Critical Infrastructure Sites - 2014.01 — Source
- The Five ICS Cybersecurity Critical Controls - 2022.10 — Source
- 01 - Introduction - 2016 — Source
- 02 - References - 2016 — Source
- 03 - Implementation Plan - 2016 — Source
- 04 - Information Security Policy (ISP) - 2016 — Source
- 05 - ISP Implementation Guidelines - 2016 — Source
- 06 - Physical Environmental Security Policy - 2016 — Source
- 07 - IT Assets Accountability Policy - 2016 — Source
- 08 - Data Classification Policy - 2016 — Source
- 09 - Data Protection & Availability Standard - 2016 — Source
- 10 - Data Assets Inventory Form - 2016 — Source
- 10 - Data Assets Inventory Form - 2016 — Source
- 11 - IT Hardware Inventory Form - 2016 — Source
- 11 - IT Hardware Inventory Form - 2016 — Source
- 12 - IT Risk Management Policy - 2016 — Source
- 13 - IT Risk Assessment Procedure - 2016 — Source
- 14 - Risk Register Form - 2016 — Source
- 14 - Risk Register Form - 2016 — Source
- 15 - Cybersecurity Awareness Training Policy - 2016 — Source
- 16 - Internet Access Policy - 2016 — Source
- 17 - Acceptable Use Policy - 2016 — Source
- 18 - Password Policy - 2016 — Source
- 19 - Password Construction Guidelines - 2016 — Source
- 20 - User Account Management Policy - 2016 — Source
- 21 - Role Based Access Control Form - 2016 — Source
- 21 - Role Based Access Control Form - 2016 — Source
- 22 - Personnel Security Policy - 2016 — Source
- 23 - Email Use Policy - 2016 — Source
- 24 - System Acceptance and Configuration Policy - 2016 — Source
- 25 - Computer Configuration Baseline Standard - 2016 — Source
- 26 - System Patching Policy - 2016 — Source
- 27 - Backup and Recovery Policy - 2016 — Source
- 28 - Vulnerability Management Policy - 2016 — Source
- 29 - Remote Access Policy - 2016 — Source
- 30 - System Logging and Monitoring Policy - 2016 — Source
- 31 - Data Encryption Policy - 2016 — Source
- 32 - Network Configuration Standard - 2016 — Source
- 33 - Change Management Policy - 2016 — Source
- 34 - IT Change Request Procedure - 2016 — Source
- 35 - Firewall Configuration Change Form - 2016 — Source
- 36 - IT Change Request Form - 2016 — Source
- 37 - IT Employee Change Form - 2016 — Source
- 38 - Third Party Access - 2016 — Source
- 39 - Outsourced Information Processing Policy - 2016 — Source
- 40 - Compliance Requirements Policy - 2016 — Source
- 41 - Business Continuity and Disaster Recovery - 2016 — Source
- 42 - Incident Management Policy - 2016 — Source
- 43 - Information Security Incident Response Plan - 2016 — Source
- 44 - Information Security Incident Response Form - 2016 — Source
- 45 - PCI Compliance Policy - 2016 — Source
- 46 - Glossary - 2016 — Source
- 47 - Appendix A - PCI DSS Mapping - 2016 — Source
- 48 - Appendix B - Printing Schedule - 2016 — Source
- Configuring and Managing Remote Access for Industrial Control Systems - 2010.11 — Source
- Cross Sector Cybersecurity Performance Goals - v2.0 - 2025.12 — Source
US - CISA - Cybersecurity and Infrastructure Security Agency/Cybersecurity Framework Implementation Guidance
- Framework Implementation Guide - Commercial - 2020.05 — Source
- Framework Implementation Guide - Dams - 2020.05 — Source
- Framework Implementation Guide - Emergency Services - 2023.11 — Source
- Framework Implementation Guide - Manufacturing - 2020.05 — Source
- Framework Implementation Guide - Nuclear - 2020.05 — Source
- Developing an Industrial Control Systems Cybersecurity Incident Response Capability - 2009.10 — Source
- Foundations for OT Cybersecurity - Asset Inventory Guidance for Owners and Operators - 2025.08.13 — Source
- Guide to Securing Remote Access Software - 2023.06.06 — Source
- Improving Industrial Control System Cybersecurity with Defense in Depth Strategies - 2016.09 — Source
- Recommended Cybersecurity Practices for ICS - 2020 — Source
- Secure by Demand - Priority Considerations for Operational Technology Owners and Operators when Purchasing Digital Products - Fact Sheet - 2025.04 — Source
- Secure by Demand - Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products - 2025.01.13 — Source
- 21 Steps to Improve Cyber Security of SCADA Networks - 2002 — Source
- Cybersecurity Capability Maturity Model (C2M2) - v2.1 - 2022.06 — Source
- FERC Order 706 - Mandatory Reliability Standards for Critical Infrastructure Protection - 2008.01.18 — Source
- NIST - Cybersecurity Framework - Informative References and Implementation Examples - v2.0 - Undated — Source
- NIST - Cybersecurity Framework - v2.0 - 2024.02.26 — Source
US - NIST - National Institute of Standards and Technology/FIPS - Federal Information Processing Standards
- FIPS 140-3 - Implementation Guidance - 2026.08.19 — Source
- FIPS 140-3 - Security Requirements for Cryptographic Modules - 2019.03.22 — Source
- FIPS 180-4 - Secure Hash Standard (SHS) - 2015.08 — Source
- FIPS 186-5 - Digital Signature Standard (DSS) - 2023.02.03 — Source
- FIPS 197 - Advanced Encryption Standard (AES) - 2023.05.09 — Source
- FIPS 198-1 - The Keyed Hash Message Authentication Code (HMAC) - 2008.07 — Source
- FIPS 199 - Standards for Security Categorization of Federal Information and Information Systems - 2004.02 — Source
- FIPS 200 - Minimum Security Requirements for Federal Information and Information Systems - 2006.03.09 — Source
- FIPS 201-3 - Personal Identity Verification (PIV) of Federal Employees and Contractors - 2022.01 — Source
- FIPS 202 - SHA-3 Standard - Permutation Based Hash and Extendable Output Functions - 2015.08 — Source
- NIST IR 7628 - Guidelines for Smart Grid Cybersecurity - Revision 1 - Volumes 1 to 3 - 2014.09 — Source
- NIST IR 7628 - Introduction to Guidelines for Smart Grid Cyber Security - 2010.09 — Source
- NIST IR 8183A-1 - Manufacturing Profile Low Impact Example - Volume 1 - General Implementation Guidance - 2019.09 — Source
- NIST IR 8183A-2 - Manufacturing Profile Low Impact Example - Volume 2 - Process Based Manufacturing System Use Case - 2019.09 — Source
- NIST IR 8183A-3 - Manufacturing Profile Low Impact Example - Volume 3 - Discrete Based Manufacturing System Use Case - 2019.09 — Source
- NIST SP 1301 - Cybersecurity Framework - Quick Start Guide for Creating and Using Organizational Profiles - v2.0 - 2024.02.26 — Source
- NIST SP 1347 - Cybersecurity Framework - Informative References Quick Start Guide - v2.0 - 2026.08 — Source
- NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment - 2008.09 — Source
- NIST SP 800-53 - Security and Privacy Controls for Information Systems and Organizations - Revision 5 - 2020.12.10 — Source
- NIST SP 800-53 - Summary of Changes - Revision 5 - Release 5.2.0 - 2025.08.27 — Source
- NIST SP 800-61 - Incident Response Recommendations and Considerations for Cybersecurity Risk Management - Revision 3 - 2025.04 — Source
- NIST SP 800-63B-4 - Digital Identity Guidelines - Authentication and Authenticator Management - 2025.07 — Source
- NIST SP 800-82 - Guide to Operational Technology (OT) Security - Revision 3 - 2023.09 — Source
- 10 CFR Part 73 - Physical Protection of Plants and Materials - Annual Edition - 2026.01.01 — Source
- RG 5.71 - Cyber Security Programs for Nuclear Power Reactors - Revision 1 - 2023.02 — Source
- SECY-12-0088 - Cybersecurity Roadmap - 2012.06.25 — Source
Dynamic Incident Response: A Framework for Security Teams by Joshua Wright, © 2026 The Escal Institute of Advanced Technologies, Inc. d/b/a SANS Institute, is licensed under CC BY 4.0. The publisher PDF is provided unchanged. The Five ICS Cybersecurity Critical Controls is by Robert M. Lee and Tim Conway. Other publications retain their respective authors' and publishers' notices and terms.