The seven foundational requirements

FR1 to FR7 — what each asks for, and which of them a given zone is actually argued on.

By the end you can

Name the seven foundational requirements and what each asks.
Pick the requirement a given finding speaks to.
Explain why a safety zone is not argued on data confidentiality.

The seven

Every requirement in the standard hangs off one of seven headings. They are the vocabulary an assessment is written in.

Requirement	What it asks
FR1 — Identification and authentication control	Every human, device and software process on the control network is identified.
FR2 — Use control	Identified users and devices may only do what their role permits, and it is logged.
FR3 — System integrity	Control logic, firmware and process data are not altered without being noticed.
FR4 — Data confidentiality	Recipes, batch records and process data stay inside the zone that owns them.
FR5 — Restricted data flow	Zones are segmented and traffic crosses only through declared conduits.
FR6 — Timely response to events	The plant notices a security event and responds without losing the process.
FR7 — Resource availability	Control keeps running — availability outranks a clean IT containment.

Not every requirement in every zone

A zone's profile is argued from the subset that matters there. Nobody assesses a safety instrumented system on data confidentiality; they assess it on use control, integrity and the availability of its protective function. The enterprise zone is the opposite: it is argued on identification and on restricting data flow, because its job is to stay out of the plant.