Beyond Mogura Taiji Security For Executives and Leaders Toward Building Inherently Secure and Resilient Systems

Le résumé fourni par la source

Abstract Organizations typically achieve cybersecurity compliance for nuclear and other critical infrastructure through established control‐based guidance documents such as NIST SP 800‐53, NIST SP 800‐82, ISO 27001, and IEC 63096. This paper presents an engineering‐driven methodology that leverages the INCOSE Guide to Security Needs and Requirements (GtSNR) and the trustworthy secure concepts and principles defined in NIST SP 800‐160 Volume 1 Revision 1 to derive security needs and requirements for critical systems (CS) and critical digital assets (CDA). The resulting requirements are realized through security‐informed architecture, design, and implementation, and the resulting engineered security capability might be later mapped to controls to represent and assess that capability for governance and compliance purposes, when needed. By applying systems security engineering (SSE) as defined in NIST SP 800‐160 Vol 1 Rev 1 and INCOSE GtSNR selectively to systems and assets of highest consequence, the proposed approach supports incremental adoption, reduces implementation burden, and enhances alignment between systems engineering and security practices. Although initially developed with the nuclear sector in mind, the methodology applies to other complex, safety‐critical, and cyber‐physical systems. This paper serves as the foundational entry in a dedicated series on systems security specifically tailored to help executive leadership and senior decision‐makers navigate the current landscape of information overload. It provides the strategic “kick‐start” necessary to move beyond reactive compliance toward building inherently secure and resilient (inherently secure, for short) systems, setting the stage for later works that will provide the practical roadmaps, templates, and measurable metrics for the enterprise.

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.