The selection of countermeasures is driven by the output from a risk assessment, which identifies the risks and their associated likelihood and consequences for each zone and conduit in the industrial automation and control system (IACS). The risk assessment also determines the target security level (SL-T) for each zone and conduit, which represents the desired level of protection against the identified threats. The countermeasures are then selected based on the SL-T and the existing security level (SL-A) of the zone and conduit, as well as the cost and feasibility of implementation. The countermeasures should aim to reduce the risk to an acceptable level by increasing the SL-A to meet or exceed the SL-T. References: ISA/IEC 62443-3-2:2018 - Security risk assessment for system design, ISA/IEC 62443-3-3:2013 - System security requirements and security levels, ISA/IEC 62443 Cybersecurity Fundamentals Specialist Training Course

ISA-TR62443-2-3 is the technical report that describes the requirements for asset owners and industrial automation and control system (IACS) product suppliers that have established and are now maintaining an IACS patch management program. Patch management is the process of applying software updates to fix vulnerabilities, bugs, or performance issues in the IACS components. Patch management is an essential part of maintaining the security and reliability of the IACS environment. The technical report provides guidance on how to establish a patch management policy, how to assess the impact and risk of patches, how to test and deploy patches, and how to monitor and audit the patch management process. References: 1, 2, 3