Access to industrial automation and control systems (IACS) devices must be governed by logical permissions and physical controls.
Logical permissions can be based on authentication and authorization methods such as password, digital certificate or multi-factor authentication and user roles. The system requires that only authenticated and authorized users have access to the relevant devices. Access rights should be limited to those who need to access certain equipment based on the principle of least privileges.
Possible physical controls include secure rooms, locks and camera surveillance.
