Announcing the Publication of v2 of the Trusted CI OT Procurement Matrix & Companion Guide

Last year, the Secure by Design team announced the publication of the first version of the Trusted CI OT (Operational Technology) Procurement Matrix. After gathering feedback from maritime operational technology practitioners and some of their vendors, we have published an updated version of the Matrix and a companion Guide to further assist the OT community.  

The Guide can be found here: https://doi.org/10.5281/zenodo.13743314

The purpose of the Matrix is to assist those in leadership roles during the procurement process. It’s meant to help formulate questions for vendors to discuss security controls on devices that will be used for maritime research. The Matrix includes a list of controls, requirements for the control, potential questions for vendors, tips, and real world examples justifying a given control.    

The updates to v2 of the Matrix includes columns for ISO/IEC 27000 family and the ISA/IEC 62443 Series of Standards.

The updated version of the Matrix can be found here: https://doi.org/10.5281/zenodo.10257812

We have already seen positive impacts from this document. “Even at our project stage of construction, where a majority of OT procurements are complete and fulfilled, we find the OT Vendor Procurement Matrix to continue to be useful," Christopher Romsos, Datapresence Systems Engineer for the Regional Class Research Vessel (RCRV) said. "Despite having contracts in place and work well underway at the time the matrix was published, we realized that the OT Vendor Procurement Matrix could be leveraged as a discovery tool to inform our Cyber Risk Management Planning needs. We're in a more informed position now for our CRMP activities because the matrix provided us with something we could easily use in the field and that was designed to assess cyber risk in OT systems,” he said.

The Secure by Design team will be moderating a panel for in-person attendees later this week at the NSF Cybersecurity Summit. The Matrix will surely come up as a discussion topic.

Highlights from the 2024 NSF Research Infrastructure Workshop

Members of Trusted CI had an extraordinary experience at the 2024 NSF Research Infrastructure Workshop in Tucson, Arizona March 26-29. The workshop was held in the foothills of the Santa Catalina Mountains and co-hosted by NOIRLab, the University of Arizona’s Biosphere 2, and its Richard F. Caris Mirror Lab Facility. The week was full of important presentations; impactful meetings with representatives from Major Facilities, Mid-Scales, and NSF; as well as a set of tours that left a lasting impression on the workshop attendees. 

The RIW officially began on a Tuesday, but Trusted CI held its quarterly Research Infrastructure Security Community (RISC) meeting the day before, taking advantage of a number of Framework cohort members traveling to Tucson to attend the RIW. The RISC meeting included a presentation from NSF’s Cybersecurity Advisor for Research Infrastructure, Mike Corn, to discuss the upcoming revision of the NSF Research Infrastructure Guide and potential changes related to cybersecurity. On Tuesday evening, Trusted CI’s “Secure by Design” team participated in the poster session. Their poster, “Cybersecurity Risks to Large Science Projects,” won second place in the poster competition. 

Overall, the RIW program agenda emphasized topics that impact members of the Trusted CI community, notably the tracks on Cyberinfrastructure (Tuesday) and Cybersecurity (Thursday), as well as a plenary talk on Friday that covered a recent cybersecurity incident at one of the NOIRLab sites.

On Wednesday, in-person attendees were given the opportunity to join one of three different tours organized by the event committee: Kitt Peak National Observatory, Biosphere 2 or the Richard F. Caris Mirror Lab.

Trusted CI highly encourages members of the NSF cyberinfrastructure operations community to attend next year’s workshop and thanks the RIW organizers and co-hosts for another great event. Materials from this year's workshop will be posted soon to the NSF Research Infrastructure Knowledge Sharing Gateway.

Trusted CI Webinar: NSF's 2025 Research Infrastructure Guide: Information Assurance, Monday May 20th @ 11am Eastern

NSF's Michael Corn is presenting the talk, NSF's 2025 Research Infrastructure Guide: Information Assurance, on May 20th at 11am Eastern time.

Please register here.

NSF's major facilities represent some of the most significant research facilities on the globe. The forthcoming revision to the Research Infrastructure Guide (or RIG) details NSF's guidance on securing these facilities and its expectations for cybersecurity programs at the major facilities. This presentation will explain how we approached shaping this guidance, the unique challenges we faced, and offer a peek at some of the resulting guidance the revised RIG will provide.

Speaker Bio: Michael Corn has been a CISO at four institutions (UIUC, Illinois System, Brandeis University, and most recently UC San Diego). A regular author on a variety of privacy, cybersecurity and identity related topics, he is currently the Cybersecurity Advisor for Research Infrastructure in the Office of the Chief Officer for Research Facilities and additionally provides support to the Office of the Chief of Research Security Strategy and Policy within NSF. A recent online presentation on cybersecurity policy can be found at https://bit.ly/3JIpI8w.

---

Join Trusted CI's announcements mailing list for information about upcoming events. To submit topics or requests to present, see our call for presentations. Archived presentations are available on our site under "Past Events."