Durham, NC (News release) -- The International Society of Automation (ISA) -- the leading professional society for automation -- announced that ISASecure®, a wholly owned subsidiary of ISA, is partnering with the United States National Security Agency (NSA) to develop a new certification scheme for commercial operational technology (OT) components sold by manufacturers and procured by the US government for use within National Security Systems (NSS). With a common goal of securing high criticality OT systems, the new certification scheme is intended to increase confidence in the security of commercial components.
ISA developed a set of security levels (SL) with specific cybersecurity requirements for OT components in the international OT cybersecurity standard ISA 62443-4-2. In addition, six new technical security requirements were developed and published by NSA's Operational Technology Assurance Partnership (OTAP) Program in the NSA/CSS Cybersecurity Technical Report titled "Operational Technology Assurance Partnership: Smart Controller Security within National Security Systems" (April 2025).
In response to the need, ISASecure is developing a separate High Criticality Component Security Assurance (HCSA) certification scheme derived from the well-established Component Security Assurance certification scheme (CSA). Upon completion and the OTAP program office's acceptance of the ISASecure HCSA scheme, the NSA will use the scheme as an approved certification mechanism in the evaluation process of adding OT OEM components to the NSS OT Product Compliant List (PCL).
"This is a major achievement in the history of ISASecure," said Dr. Mark P. DeAngelo, program manager of ISASecure. "The NSA recognizes the importance of the ISA 62443 standard and the ISASecure program, which independently evaluates a product's conformity to the ISA 62443 standard. ISASecure's reputation and commitment to robust OT security precedes the NSA's decision to partner with us. Our CSA product certification set the foundation for HCSA."
An ISASecure HCSA certificate provides a product manufacturer with essential evidence in consideration of that product's inclusion on the NSA's NSS OT PCL. In other words, ISASecure certification is an important step before a smart controller can be purchased and installed within an NSS.
Manufacturers interested in developing smart controllers are encouraged to join ISASecure to be part of the HCSA development. Stakeholders include manufacturers of components, accreditation bodies and certification bodies. For more information, contact Dr. Mark P. DeAngelo, program manager, ISASecure at ISASecure@isa.org.
About ISASecure®
Founded in 2007 by the International Society of Automation (ISA), the ISASecure® mission is to provide the highest level of assurance possible for the cybersecurity of industrial automation control systems. ISASecure, a wholly owned subsidiary of ISA, is a globally recognized ISA/IEC 62443 conformance scheme, conducting certifications for off-the-shelf control system products and supplier development practices since 2010.
Founders and key supporters of ISASecure include BP, Chevron, ExxonMobil, Saudi Aramco, Shell, GSK, Honeywell, Johnson Controls, Schneider Electric, Yokogawa, Carrier, Siemens, YPF, Amazon Web Services, exida, TUV Rheinland, CSSC, FM Approvals, Synopsys, Trust CB, SecurityGate, BYHON, TUV SUD, Trane and Bureau Veritas. The program's ISASecure designation signifies to the marketplace that industrial automation and control products conform to industry-consensus cybersecurity standards. The ISASecure trademark provides confidence to users of ISASecure certified products and systems and creates product differentiation for suppliers who conform to the ISASecure specifications. Learn more at isasecure.org.
About ISA
The International Society of Automation (ISA) is a non-profit professional association founded in 1945 to create a better world through automation. ISA's mission is to empower the global automation community through standards and knowledge sharing. ISA develops widely used global standards and conformity assessment programs; certifies professionals; provides education and training; publishes books and technical articles; hosts conferences and exhibits; and provides networking and career development programs for its members and customers around the world. Learn more at www.isa.org.
About the OTAP Program
The Operational Technology Assurance Partnership (OTAP) Program provides the US government with a trusted, repeatable and technically rigorous mechanism to assess, validate and assure the cybersecurity of operational technology (OT) components and systems used within National Security Systems (NSS).
Through structured collaboration with US government stakeholders, OEMs and standards bodies, OTAP enables informed acquisition, risk management and deployment decisions that strengthen the resilience and mission assurance of cyber-physical systems critical to national defense and security. Its mission is to ensure NSS mission resilience and cybersecurity by validating the security and compliance of OT and fortify these systems by establishing and verifying rigorous, testable security requirements that enable OT cybersecurity and resilience.