NSA & ISASecure to Develop OT Security Certification for NSS

Executive Summary

The International Society of Automation's (ISA) subsidiary, ISASecure, is collaborating with the U.S. National Security Agency (NSA) to establish a new cybersecurity certification scheme for operational technology (OT). The program, named the High Criticality Component Security Assurance (HCSA) scheme, is designed to vet commercial off-the-shelf OT components intended for use in U.S. National Security Systems (NSS). This partnership signifies a major step towards standardizing and elevating the security requirements for critical OT products within the U.S. government's most sensitive environments.

Regulatory Details

The HCSA scheme is a specialized certification track being developed to provide a higher level of assurance for OT components in critical applications. It will be built upon the foundation of ISASecure's existing Component Security Assurance (CSA) certification program, which is based on the internationally recognized ISA/IEC 62443 series of standards, specifically ISA/IEC 62443-4-2 for component-level security.

The HCSA will incorporate all baseline requirements from the CSA program and augment them with six additional technical security requirements developed by the NSA's Operational Technology Assurance Partnership (OTAP) Program. These supplementary requirements are detailed in the NSA/CSS Cybersecurity Technical Report from April 2025, "Operational Technology Assurance Partnership: Smart Controller Security within National Security Systems," and are designed to address the specific threat models and security needs of NSS.

Affected Organizations

The primary organizations affected by this new scheme are manufacturers and vendors of OT components, such as smart controllers and other industrial automation devices. Companies wishing to sell their products for use within U.S. National Security Systems will need to achieve HCSA certification. This initiative will also impact government procurement agencies and system integrators responsible for building and maintaining National Security Systems, as it provides a clear mechanism for selecting compliant and trusted components.

Compliance Requirements

For an OT component to be considered for use in a National Security System, its manufacturer will need to submit the product to an accredited ISASecure certification body for HCSA evaluation. Upon successful evaluation and certification, the product will be recognized by the NSA's OTAP program office. This HCSA certificate will serve as crucial evidence for the product's inclusion on the NSA's NSS OT Product Compliant List (PCL). Being on the PCL is a prerequisite for the procurement and installation of these components within an NSS.

Implementation Timeline

The announcement marks the beginning of the development phase for the HCSA scheme. While a specific timeline for full implementation was not provided, the process involves finalizing the scheme's requirements, establishing assessment procedures, and formal acceptance by the NSA's OTAP program office. Once launched, OT vendors can begin submitting their products for certification.

Impact Assessment

This partnership represents a significant convergence of commercial cybersecurity standards and national security requirements. For OT vendors, achieving HCSA certification will become a competitive differentiator and a market access requirement for the lucrative government and defense sectors. It will likely drive vendors to invest more heavily in the security of their products from the design phase onward. For the U.S. government, it strengthens the supply chain security for critical infrastructure and national security systems, reducing the risk of compromise through vulnerable commercial components. The reliance on the globally recognized ISA/IEC 62443 standard also promotes a common security language and framework across the industry.