Prepare your ICS products for UL 2900-2-2 security testing

UL 2900-2-2 is a UL Outline of Investigation that sets particular cyber security requirements for network-connectable industrial control system products. Published as its first edition in 2016, it is part 2-2 of the UL 2900 series and is used together with UL 2900-1, the general requirements, to test products such as PLCs, distributed control systems, SCADA servers, RTUs and HMIs for vulnerabilities, software weaknesses and missing security controls.

No. UL 2900-2-2 is a voluntary document, and no law requires ICS products to be tested against it. Manufacturers usually pursue it because asset owners, system integrators or procurement teams ask for independent evidence that a controller, gateway or HMI has been security tested. In practice it becomes a contractual requirement when a customer writes it into a tender or supply agreement.

UL 2900-1 contains the general software cyber security requirements for any network-connectable product. UL 2900-2-2 is a product-specific part that applies those requirements to industrial control systems, adding particular requirements suited to operational technology, such as remote access, authenticator protection and fail-safe behaviour. A product evaluated to UL 2900-2-2 is assessed against UL 2900-1 together with the ICS-specific requirements in part 2-2.

Manufacturers and vendors of industrial control system components are the main audience. That includes makers of programmable logic controllers, distributed control systems, SCADA servers, remote terminal units, intelligent electronic devices and human machine interfaces. It is most relevant when selling into critical infrastructure, utilities, manufacturing or building automation, where buyers want third-party evidence that connected products resist known attacks.

Both address the security of industrial control system products, but they work differently. IEC 62443 is an international series covering security programmes, secure development and component and system security levels. UL 2900-2-2 is a UL testing document focused on evaluating a specific product for vulnerabilities, malware, malformed input handling, software weaknesses and security controls. Many ICS vendors treat IEC 62443 as the primary framework and use UL testing as supporting evidence.

You prepare product and design documentation, implement the required security controls, and then submit the product to a testing laboratory for evaluation. Testing typically covers known vulnerability scanning, malware testing, malformed input or fuzz testing, structured penetration testing and software weakness analysis of source code or binaries. Evidence of secure development practices, patch integrity and a vendor risk management process is also reviewed alongside the product itself.

UL 2900-2-2 is mapped in OneClickComply's control library and is available on request, rather than being a live framework in the platform today. On request, the mapping links its documentation, secure development and product management expectations to controls you may already run for ISO 27001 or IEC 62443, so evidence is collected once. OneClickComply does not test products or issue UL certification.