3381 Guidance on management of third party changes to plant control systems

Overview:

The Energy Institute's Power Utility Committee has identified a need for guidance to help operator assurance for the management of change (MoC) of third party implemented changes to plant control systems. Recognising the frequent use of third party support, the committee considers that guidelines on assurance against unauthorised or uncontrolled changes may be beneficial to equipment and plant operators. This is in the context of the legal responsibilities that owners and operators have with regard to the safe operation of their assets. It is considered likely that an owner or operator will have robust MoC processes in place for changes they initiate. This guidance is focused on how these MoC processes may be adapted to address changes initiated and implemented by a third party.

This publication has drawn on many existing sources from the public domain, together with input from practitioners from the power utility industry and good practices from other high reliability industries.

The main purposes of this publication are to:

• raise awareness of the risks concerning third party changes to control systems and remote access to the data they generate, and
• assist organisations in managing this appropriately and providing the necessary assurance to themselves that this process is under adequate control.

The guidance is aimed at:

• operators of plant or equipment containing control systems that are critical to safety and/or operations, or
• third parties wishing to make a change to, or access data from, control systems that are critical to safety and/or operations.