This handbook is intended for use primarily by Department of Defense (DOD) installation commanders, supported by staff members, as a management tool to self-assess,1 prioritize, and manage mission-related vulnerabilities and risks that may be exposed or created by connectivity to ICS. ICS include a variety of systems or mechanisms used to monitor and/or operate critical infrastructure elements, such as electricity, water, natural gas, fuels, entry and access (doors, buildings, gates), heating & air-conditioning, runway lighting, etc. Other terms often heard include SCADA, DCS, or EMCS.2 Throughout this book the term "ICS" is used as encompassing such variations. This book is intentionally generic. Whatever the category of ICS, the approach to vulnerability assessment and risk management is similar. The applicability of actions recommended here may be extended to any DOD military installation regardless of the specific categories of ICS encountered. In keeping with the generic approach and due primarily to the unique nature of each installation''s infrastructure, beyond a couple of exceptions there are no checklists, standard operating procedures (SOP), or similar sets of lock-step actions provided here. However, a risk management team using the handbook likely will want to develop checklists tailored to their specific circumstances. Among other purposes, this handbook is intended to increase awareness of how a threat related to the ICS itself translates into a threat to the mission, either directly through the ICS or circuitously via network connections. Every military installation has numerous mission-support processes and systems controlled by, or that otherwise depend on, ICS. Every connection or access point represents potential vulnerabilities and, therefore, risks to the system under control (i.e., electrical, water, emergency services, etc.), which can escalate quickly to adverse impact on mission essential functions (MEF) and mission accomplishment. Why buy a book you can download for free? First you gotta find a good clean (legible) copy and make sure it''s the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. We look over each document carefully and replace poor quality images by going back to the original source document. We proof each document to make sure it''s all there - including all changes. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it''s just a 10-page document, no problem, but if it''s 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It''s much more cost-effective to just order the latest version from Amazon.com This book is published by 4th Watch Books and includes copyright material. We publish compact, tightly-bound, full-size books (8 � by 11 inches), with glossy covers. 4th Watch Books is a Service Disabled Veteran-Owned Small Business (SDVOSB). If you like the service we provide, please leave positive review on Amazon.com. For more titles published by 4th Watch Books, please visit: cybah.webplus.net A full copy of all the pertinent cybersecurity standards is available on DVD-ROM in the CyberSecurity Standards Library disc which is available at Amazon.com. UFC 4-010-06 Cybersecurity of Facility-Related Control Systems NIST SP 800-82 Guide to Industrial Control Systems (ICS) Security Whitepaper NIST Framework for Improving Critical Infrastructure Cybersecurity FC 4-141-05N Navy and Marine Corps Industrial Control Systems Monitoring Stations UFC 3-430-11 Boiler Control Systems NISTIR 8089 An Industrial Control System Cybersecurity Performance Testbed