<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-ics-compliance-assessment
description: >-
  Assess ICS/SCADA environment compliance against regulatory frameworks
  including NERC CIP, TSA Security Directives, IEC 62443, and NIST SP 800-82
  with evidence collection, gap analysis, and remediation tracking.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - compliance
  - ics
  - scada
  - nerc-cip
  - iec-62443
  - nist
  - audit
  - ot-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0800", "T0866"]
  nist-csf: ["ID.GV-3", "PR.IP-12"]
  iec-62443: ["SR 1.1", "SR 7.1"]
  uuid: a1b2c3d4-1001-4000-a001-000000000013
---

# Performing ICS Compliance Assessment

## Overview

ICS compliance assessment validates adherence to regulatory requirements that vary
by sector: NERC CIP for electric utilities, TSA Security Directives for pipelines,
NRC requirements for nuclear, and IEC 62443 as a cross-sector standard. Assessment
requires mapping controls, collecting evidence, and tracking remediation.

Mode: `[MODE: BLUE]` for assessment; `[MODE: ARCHITECT]` for framework mapping.

## Prerequisites

| Requirement | Details |
|---|---|
| Applicable regulatory framework requirements documentation | Required |
| ICS asset inventory with classification (BES Cyber Assets for NERC CIP) | Required |
| Security policy and procedure documentation | Required |
| Access control records and logs | Required |
| Network architecture diagrams | Required |
| Previous audit findings and remediation status | Required |

## Key Concepts

### Framework Mapping

```yaml
control_mapping:
  access_control: {nerc: CIP-004/005, iec: SR 1.1/1.2, nist: AC-2/AC-3, tsa: "2.A"}
  change_management: {nerc: CIP-010, iec: SR 7.6, nist: CM-2/CM-3, tsa: "2.D"}
  incident_response: {nerc: CIP-008, iec: SR 6.1, nist: IR-1/IR-4, tsa: "2.C"}
  network_security: {nerc: CIP-005, iec: SR 5.1, nist: SC-7/SC-8, tsa: "2.D"}
```

### NERC CIP Assessment

```bash
python3 -c "
import json
for a in json.load(open('bes_assets.json')):
    impact = a.get('impact_rating','low')
    print(f'{a[\"name\"]}: {impact}')
    if impact=='high': print('  -> Requires CIP-005 through CIP-011')"

# ESP boundary scan
nmap -Pn -sT -p 1-65535 --max-rate 100 -oA esp_scan esp_fw_ip

# Service documentation verification
for h in $(cat bes_systems.txt); do nmap -Pn -sT -sV $h -oA "cip007_$h"; done
```

### Evidence Collection

```bash
mkdir -p evidence/$(date +%Y%m%d)
last -50 > evidence/$(date +%Y%m%d)/logins.txt
iptables -L -n -v > evidence/$(date +%Y%m%d)/firewall.txt
ss -tlnp > evidence/$(date +%Y%m%d)/services.txt
sha256sum evidence/$(date +%Y%m%d)/* > evidence/$(date +%Y%m%d)/manifest.sha256
```

### Gap Analysis

```bash
python3 -c "
import json
for sev in ['critical','high','medium','low']:
    items = [f for f in json.load(open('findings.json')) if f.get('severity')==sev]
    print(f'{sev.upper()}: {len(items)} findings')
    for i in items: print(f'  [{i.get(\"status\",\"open\")}] {i[\"id\"]}: {i[\"title\"]}')"
```

## Workflow

### Step 1: Scope and Discovery

```bash
python3 performing_ics_compliance_assessment_scope.py --inventory ics_assets.json --output scope.yaml
```

### Step 2: Execute Assessment

```bash
python3 performing_ics_compliance_assessment_execute.py --scope scope.yaml --output results/
```

### Step 3: Analyze and Report

```bash
python3 performing_ics_compliance_assessment_report.py --results results/ --output report.json
```

## Verification

- [ ] Frameworks scoped
- [ ] Asset classification completed
- [ ] Evidence collected
- [ ] Gap analysis with severities
- [ ] Remediation plan with owners/dates
- [ ] Cross-framework mapping documented
- [ ] Management sign-off obtained
- [ ] Continuous monitoring established

## Detection Opportunities

- Control failures → gap
- Evidence gaps → incomplete docs
- Remediation past due → regulatory risk
- New requirements → reassessment
- External findings → gap validation

```yaml
title: Ics Compliance Assessment Detection
id: a17284d1-7e27-4a72-80a9-d70989d54ba0
status: experimental
description: Detects suspicious activity related to performing ics compliance assessment techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*ics*"
  condition: selection
level: medium
tags:
  - attack.t0800
  - attack.t0866
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- NERC CIP Standards (CIP-002 through CIP-014)
- IEC 62443 Series
- NIST SP 800-82 Rev 3
- TSA Security Directives for Pipelines
