50
CYBerseCurItY For InDustrIAL ControL sYsteMs
the release of 800-82 in the summer of 2008, it became apparent that
there was more value in building upon National Institute of Standards
and Technology’s (NIST) work, rather than competing with it.
In some instances we have seen t to apply annotations to the
NIST denitions that expand or clarify the work. In the author’s
notes in Table2.1 we will challenge some conclusions about the dif-
ferences between ICS and IT security, where they appear to lack
perspective or perhaps unhelpfully echo “us versus them” sentiments,
which can be observed between ICS and IT security practitioners
from time to time.
As was the case with ICS security requirements, we have elected
to reproduce the NIST compar