The key norms in industrial teleassistance

The increase in connected devices exposes companies to growing cybersecurity threats. The NIS2 Directive and the IEC 62443 standard frame the norms in teleassistance aimed at improving cybersecurity, requiring integrated and cooperative measures among organizations.

Information and communication technologies are the foundation of complex systems that support the daily activities of society, economy, and industry. With the emergence of digitalization, connectivity, Industry 4.0, and the Internet of Things (IoT), we are witnessing an exponential increase in connected digital devices. However, despite the number of connected devices, security and resilience are not always integrated into the design, often rendering cybersecurity policies inadequate.

The cybercrime market is indeed concerning, due to attacks aimed at encrypting data or sabotaging production, as highlighted by research from ENISA. IT and OT systems, therefore, can no longer be considered separate, as 94% of attacks on IT systems have caused disruptions in OT systems, highlighting the vulnerability of companies due to an increasingly complex network.

Norms in teleassistance and tools for the protection of industrial machinery

To protect their data, companies must implement analysis and control tools, as established by the IEC TS 63074 standard, which introduces the concept of Security Risk Analysis and refers to the IEC 62443 family.

The deadline for the Machinery Regulation (EU) 2023/1230, which comes into effect on January 1, 2027, requires specific regulations in remote assistance to ensure cybersecurity. The United States, with NEC 2023, for example, has already introduced similar requirements in 12 states, suggesting a trend of anticipation that could also be reflected in Europe with NIS2.

Directive (EU) 2022/255 (NIS2), in effect from October 2024, broadens the scope to include machinery manufacturers, introducing a multi-risk requirement that also involves associated service providers. It is crucial to define the characteristics that industrial plants and machines must meet to ensure an adequate level of cybersecurity and clarify the degree of obligation.

Moreover, it should be noted that although the Machinery Directive 2006/42/EC does not explicitly address cybersecurity, there are related regulations, such as ISO 13849-1 and EN 415-10 standards, which establish some fundamental principles. For example, remote connection must be locally authorized, and safety parameters should not be modifiable without onsite validation. This further emphasizes the importance of adopting an integrated security strategy that protects machines from external threats.

Next, we will examine in detail what the main norms in teleassistance say and what they entail.

NIS2 Directive

The NIS2 Directive (Network and Information Security 2) represents the evolution of the first NIS Directive, introduced by the European Union in 2016 to strengthen cybersecurity. Adopted starting in 2022, this new directive updates and enhances the regulatory framework to address the growing threats and ensure greater resilience of networks and information systems, including those of industrial teleassistance.

One of the main objectives of the NIS2 Directive is to broaden the scope compared to the previous directive. It includes more sectors and critical services for national security, such as digital infrastructures, cloud service providers, data centers, and teleassistance services. Therefore, it is the regulations in teleassistance that are relevant for organizations operating as service providers and companies that use connected devices and systems and must comply with this directive.

Specifically, the NIS2 Directive introduces stricter requirements for risk management and security incident reporting. Organizations must adopt appropriate and proportionate security measures to the risk, including vulnerability management, identity and access management, network monitoring, and implementation of intrusion detection systems. For example, in the case of a security incident, organizations must promptly report the incident to the competent authority, ensuring a rapid response and coordination at the European level.

At the European level, the directive promotes cooperation and information sharing among member states and organizations to improve the collective ability to prevent, detect, and respond to cyberattacks. Such cooperation is particularly relevant for industrial remote assistance, where networks and control systems may be distributed across multiple sites and managed by different.

Standard IEC 62443 

Let’s now look at the IEC 62443 standard, which is one of the main international regulations developed to ensure the security of industrial automation and control systems (ICS).

This standard, created by the International Electrotechnical Commission (IEC), provides guidelines and requirements for the protection of networks and control systems from cyber threats. Its adoption is, therefore, crucial for monitoring and managing industrial devices and processes remotely.

IEC 62443 is structured into four sections that cover various aspects of industrial security:

• Part 1: Terminology, Concepts, and Models - Provides an overview of the terms and models used in the standard.
• Part 2: Policies and Procedures for Organizations - Establishes the requirements for security policies and operational procedures, including risk management, access control, and change management.
• Part 3: System Requirements - Defines the security requirements for industrial control systems, such as network monitoring, vulnerability management, and data integrity.
• Part 4: Component Requirements - Specifies the security requirements for components of control systems, including field devices, human-machine interfaces (HMI), and supervisory software.

The implementation of IEC 62443 offers numerous advantages:

• It provides a structured approach to identify and mitigate security risks, ensuring that connected devices and networks are protected against cyber attacks.
• Moreover, it encourages the adoption of integrated security practices at the design and development level, ensuring that telecommunication systems are secure from the start.
• Furthermore, it facilitates collaboration between telecommunication service providers and industrial operators, establishing a common language and shared security requirements.
• Additionally, it enhances trust and transparency among the parties involved and contributes to creating a safer and more resilient ecosystem.

Other norms in teleassistance

In addition to the NIS2 Directive and the IEC 62443 standard, there are other regulations in industrial tele-assistance that impact security.

Among these, the GDPR (General Data Protection Regulation) is the EU's general regulation on data protection and requires organizations to protect personal data processed, including data collected and used in tele-assistance operations. It is essential for companies operating in this sector to adopt adequate measures to ensure compliance with the GDPR, especially when it comes to protecting sensitive data of operators or customers.

Another relevant standard is ISO/IEC 27001, which defines the requirements for an information security management system (ISMS). In industrial remote assistance, adopting ISO/IEC 27001 helps implement appropriate security controls to protect sensitive information and ensure operational continuity.

Furthermore, the NIST Cybersecurity Framework (CSF) provides guidelines for managing and reducing cybersecurity risks. Although developed for U.S. organizations, this framework is widely adopted globally and can be used as a reference to improve security in industrial remote assistance operations.

Finally, the RED Directive (Radio Equipment Directive) applies to radio communication devices, imposing safety and compatibility requirements to ensure that devices used in industrial teleassistance do not cause harmful interference and are secure against attacks and tampering.

Main standards, norms, and frameworks for industrial cybersecurity

Conclusions

Security is a critical factor in ensuring the continuity and efficiency of modern industrial operations, and in this regard, it is essential to know and apply the norms in teleassistance. The NIS2 Directive, the IEC 62443 standard, and other key regulations provide a solid and detailed regulatory framework to address the challenges of cybersecurity in this sector.

Complying with these regulations not only helps mitigate security risks but also facilitates collaboration and trust among the various parties involved in the industrial ecosystem. Adopting a proactive approach to security, based on these directives, represents a fundamental step toward ensuring a secure and resilient digital future for industrial remote assistance operations.