  Security by design, Sbd is a concept for developing and maintaining systems
that are, to the greatest extent possible, free from security vulnerabilities
and impervious to security attacks. In addition to technical aspects, such as
how to develop a robust industrial control systems hardware, software,
communication product, etc., SbD includes also soft aspects, such as
organizational managerial attitude and behavior, and employee awareness. Under
the Sbd concept, systems, ICS in our context, will be considered more
trustworthy by users. User's trust in the systems will be derived from the
meticulous adherence to the SbD processes and policies. In accordance with the
SbD concept, security is considered. Security measures are implemented, at
every stage of the product and systems development life cycle, rather than
afterwards. This document presents the security requirements for the
implementation of the SbD in industrial control systems. The information
presented does not negate any existing security and cyber security standards,
etc. Instead, we strongly recommend that organizations should implement and
comply with those standards and best practices. Security by design is not a
one-time process. It starts at the very beginning of the products of the system
design and continues through all its lifecycle. Due to the benefits of the SbD,
higher level of security, and robustness to cyber attacks, all organizations
associated with the energy sector should strive to establish an ecosystem. The
requirements presented in this document may be perceived as burdensome by
organizations. However, strict compliance with the requirements and existing
security standards and best practices, including continuous monitoring, as
specified in this document, is essential to realize an ecosystem driven and
protected by the SbD
