Certification for commercial products procured by US.

ISASecure®, a wholly owned subsidiary of The International Society of Automation (ISA), is partnering with the United States National Security Agency (NSA) to develop a new certification scheme for commercial operational technology (OT) components sold by manufacturers and procured by the US government for use within National Security Systems (NSS). With a common goal of securing high criticality OT systems, the new certification scheme is intended to increase confidence in the security of commercial components.

ISA developed a set of security levels (SL) with specific cybersecurity requirements for OT components in the international OT cybersecurity standard ISA 62443-4-2. In addition, six new technical security requirements were developed and published by NSA’s Operational Technology Assurance Partnership (OTAP) Program in the NSA/CSS Cybersecurity Technical Report titled "Operational Technology Assurance Partnership: Smart Controller Security within National Security Systems" (April 2025).

In response to the need, ISASecure is developing a separate High Criticality Component Security Assurance (HCSA) certification scheme derived from the well-established Component Security Assurance certification scheme (CSA). Upon completion and the OTAP program office's acceptance of the ISASecure HCSA scheme, the NSA will use the scheme as an approved certification mechanism in the evaluation process of adding OT OEM components to the NSS OT Product Compliant List (PCL).

“This is a major achievement in the history of ISASecure,” said Dr. Mark P. DeAngelo, program manager of ISASecure. “The NSA recognizes the importance of the ISA 62443 standard and the ISASecure program, which independently evaluates a product's conformity to the ISA 62443 standard. ISASecure's reputation and commitment to robust OT security precedes the NSA's decision to partner with us. Our CSA product certification set the foundation for HCSA."

An ISASecure HCSA certificate provides a product manufacturer with essential evidence in consideration of that product's inclusion on the NSA's NSS OT PCL. In other words, ISASecure certification is an important step before a smart controller can be purchased and installed within an NSS.

Manufacturers interested in developing smart controllers are encouraged to join ISASecure to be part of the HCSA development. Stakeholders include manufacturers of components, accreditation bodies and certification bodies.

---

@ISA_Automation  @automation_com @NSAGov #Cybersecurity #PAuto