FR 2 — Use Control (UC)

Ensure authorized users and devices can only perform permitted actions—least privilege, separation of duties, and secure remote operations.

• Least-privilege policy engine with allow-by-exception rules
• Role-based controls for OT personas (operator, engineer, vendor)
• Time-bound maintenance access and break-glass with approvals
• Command/session logging for privileged operations

• Scope by zone: identify where this FR is most critical (e.g., safety zone, engineering access, remote vendor conduit).
• Start in observe mode: baseline behavior and identify necessary exceptions.
• Enforce gradually: enable controls in phases aligned to maintenance windows; document exceptions.
• Continuously verify: monitor drift and anomalies; automate response where safe.

• Policy versions and approvals
• Access decision logs and exceptions
• Privileged session/command audit trails