Disclaimer: This repository is an educational and indicative resource. It does not constitute legal, regulatory, or technical advice. Content marked sourceType: "constructed-indicative" has not been verified against official sources. Always refer to authoritative standards bodies and seek professional counsel for compliance decisions.

A structured, open-access knowledge base for Operational Technology (OT) cybersecurity — covering international standards, compliance requirements, frameworks, audit evidence, and recommendations.

Primary Standard: IEC 62443 (paraphrased) Malaysia Focus: NACSA Act 854 cross-referenced throughout Audience: OT security engineers, GRC practitioners, auditors, NCII-designated operators

This resource is for educational and indicative purposes only. It does not constitute legal or technical advice. IEC 62443 content is paraphrased from the standard — obtain normative text from iec.ch. NACSA Act 854 references are indicative — verify against official Gazette text. All content marked sourceType: "constructed-indicative" has not been verified against official sources.

This repository follows the GRC Portfolio v2.0 Standardized Schema, optimized for machine-readability and dynamic SPA rendering.

Data is structured to maintain a strict bidirectional mapping: IEC 62443 Requirement (SR) $\leftrightarrow$ OT Security Control $\leftrightarrow$ Audit Evidence $\leftrightarrow$ Artifact Template

• Controls (/controls/library.json): 25 OT-specific controls mapped to the Purdue Model using the unified schema.
• Evidence (/evidence/index.json): Mapped to 51 System Requirements (SRs) and 7 Foundational Requirements (FRs).
• Standards: Comprehensive data for IEC 62443-3-3, NIST 800-82, and NACSA Section 26.

• Naming: Kebab-case slugs; safety-weighted risk levels.
• Scoring: Standardized 5x5 Likelihood/Impact risk matrix.
• Audit Ready: FAT/SAT security checklists included in the templates.

OT-Security/
├── index.html                          # Single-page application entry point
├── app.js                              # Application logic and rendering
├── style.css                           # Styles and CSS variables
├── validate.js                         # Data validation script (11 checks)
├── architecture/
│   ├── asset-types.json                # OT asset type definitions
│   ├── purdue-model.json               # Purdue model levels 0-5
│   └── zones-conduits.json             # Zone and conduit definitions
├── artifacts/
│   └── inventory.json                  # 31 audit artifacts with controlSlugs
├── controls/
│   ├── domains.json                    # 13 security domains
│   └── library.json                    # 25 controls with maturity levels
├── cross-references/
│   ├── iec62443-to-nacsa.json          # IEC 62443 ↔ NACSA Act 854
│   ├── iec62443-to-nist80082.json      # IEC 62443 ↔ NIST SP 800-82
│   ├── iec62443-to-nist-csf.json       # IEC 62443 ↔ NIST CSF 2.0
│   ├── mitre-to-controls.json          # MITRE ATT&CK ICS ↔ controls
│   └── sector-to-nacsa-cop.json        # Sectors ↔ NACSA codes of practice
├── evidence/
│   └── index.json                      # Evidence items per domain (36 items across 13 domains)
├── requirements/
│   ├── index.json                      # Domain index (13 domains)
│   └── by-domain/                      # Per-domain requirement files
│       ├── asset-inventory.json
│       ├── backup-recovery.json
│       ├── configuration-management.json
│       ├── data-protection.json
│       ├── identity-access-management.json
│       ├── incident-detection-response.json
│       ├── monitoring-logging.json
│       ├── network-segmentation.json
│       ├── patch-vulnerability-management.json
│       ├── physical-security.json
│       ├── remote-access.json
│       ├── safety-system-security.json
│       └── supply-chain.json
├── risk-management/
│   ├── checklist.json                  # Assessment checklist
│   ├── methodology.json               # Risk methodology
│   ├── risk-matrix.json               # 5x5 safety-weighted matrix
│   ├── risk-register.json             # 20 OT/ICS risks
│   └── treatment-options.json         # Treatment strategies
├── sectors/
│   ├── index.json                      # 6 OT-focused NACSA NCII sectors
│   └── requirements/                   # Sector-specific requirements
│       ├── building-automation.json
│       ├── energy.json
│       ├── manufacturing.json
│       ├── oil-gas.json
│       ├── transport.json
│       └── water.json
├── standards/
│   ├── iec62443/
│   │   ├── index.json                  # IEC 62443 series overview
│   │   ├── foundational-requirements.json  # 7 FRs
│   │   ├── security-levels.json        # SL 1-4 definitions
│   │   └── system-requirements.json    # 51 SRs with SL descriptions
│   ├── mitre-attack-ics/
│   │   ├── index.json                  # MITRE ATT&CK for ICS overview
│   │   └── techniques.json             # ICS techniques
│   └── nist-800-82/
│       └── index.json                  # NIST SP 800-82 Rev 3 overview
└── threats/
    ├── known-incidents.json            # Stuxnet, TRITON, Ukraine, etc.
    └── threat-actors.json              # OT threat actor profiles

• IEC 62443 full SR coverage (51 SRs across 7 FRs with SL 1-4 descriptions)
• 25 controls across 13 security domains with maturity levels
• 36 evidence items across all 13 domains with audit guidance (whatGoodLooksLike, commonGaps)
• 31 audit artifacts with control-slug mapping
• 20 OT/ICS risks across 7 categories with 5x5 safety-weighted risk matrix
• 66 MITRE ATT&CK for ICS techniques mapped to defensive controls
• 5 cross-reference files (NACSA, NIST CSF 2.0, NIST SP 800-82, MITRE ICS, sector COPs)
• 6 sector-specific requirement files (energy, water, oil & gas, transport, manufacturing, building automation)
• Audit Package UI on control detail views (artifacts + evidence checklist)
• Risk Management section (methodology, matrix, register, checklist, treatment options)
• Dark mode toggle
• Data validation script (validate.js — 11 checks)
• CC-BY-4.0 license

For Malaysian NCII-designated OT operators:

See full mapping: cross-references/iec62443-to-nacsa.json

• IEC 62443 — Security for Industrial Automation and Control Systems (paraphrased; obtain from iec.ch)
• NIST SP 800-82 Rev 3 — Guide to OT Security (public domain; nvlpubs.nist.gov)
• MITRE ATT&CK for ICS — OT adversary tactics and techniques (public; attack.mitre.org/matrices/ics)
• NIST CSF 2.0 — Cybersecurity Framework (public; nist.gov)
• NACSA Act 854 — Cyber Security Act 2024, Malaysia (public Gazette)

• dawuds/cloud-sec — Cloud cybersecurity framework (CSA CCM v4, CIS Benchmarks, BNM RMiT Cloud)
• dawuds/AI-Governance — Multi-framework AI governance reference (11 frameworks, Malaysia NGAIGE anchor)
• dawuds/nacsa — NACSA Act 854 (Act 854) structured compliance database
• dawuds/RMIT — BNM Risk Management in Technology (RMiT)
• dawuds/pdpa-my — Malaysia PDPA Act 709 + Amendment A1727