CYBRARY Security levels: how hard must this hold?
SL0 to SL4 in plain words, the difference between target and achieved, and why one plant runs at several levels at once.
By the end you can
- Describe each security level by the attacker it is meant to withstand.
- Distinguish a target level from an achieved level.
- Explain why different zones in one plant carry different targets.
The levels
A security level is stated as the capability of the attacker the zone must withstand — not as a product feature and not as a score out of ten.
| Level | What it means |
|---|---|
| SL0 — No specific requirement | Nothing is expected of this zone. |
| SL1 — Casual or coincidental | Protection against accidental misuse. |
| SL2 — Intentional, simple means | A low-skill attacker with generic tools and low motivation. |
| SL3 — Intentional, sophisticated means | An attacker with ICS-specific skills, tools and moderate resources. |
| SL4 — Intentional, extended resources | A well-resourced actor with ICS-specific skills and sustained motivation. |
Target, achieved, and the gap between
A target level is a decision: this zone must hold against that attacker, because of what happens physically if it does not. An achieved level is a measurement: this is what the zone demonstrably holds against today. The gap between the two is the work program, and it is the honest thing to publish.
One plant runs at several levels at once. The safety zone is held highest because the consequence is physical; the enterprise zone is held lowest because the consequence of losing it is commercial, and because everything below it already treats it as untrusted.