CWE Grouping: ICS Operations (& Maintenance): Compliance/Conformance with Regulatory Requirements
Grouping ID: 1383
Vulnerability Mapping:PROHIBITEDThis CWE ID must not be used to map to real-world vulnerabilities
Summary
Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Membership
Nature
Type
ID
Name
MemberOf
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things.
(this CWE ID must not be used to map to real-world vulnerabilities)
Reason
Grouping
Rationale
This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
Comments
See member weaknesses of this category.
Notes
Relationship
Relationships in this category are not authoritative and subject to change. See Maintenance notes.
Maintenance
This entry might be subject to CWE Scope Exclusions SCOPE.SITUATIONS (Focus on situations in which weaknesses may appear) and/or SCOPE.HUMANPROC (Human/organizational process).
Maintenance
This category was created in CWE 4.7 to facilitate and illuminate discussion about weaknesses in ICS with [REF-1248] as a starting point. After the release of CWE 4.9 in October 2022, this has been under active review by members of the "Boosting CWE" subgroup of the CWE-CAPEC ICS/OT Special Interest Group (SIG). Subgroup members did not find any CWEs to add to this category in CWE 4.11. There may be some gaps with respect to CWE's current scope, which will require consultation with many CWE stakeholders to resolve.
Summary
