Chemical Engineering June 2022 - 35

systems that are organized into the following five
key areas:
1. Assessment to identify organizational cybersecurity
risks to systems, assets, data and capabilities
2. Safeguards to protect the organization, including
access control, processes and procedures, protective
technology and training
3. Detecting and identifying cybersecurity events
4. Cyber-incident response plans
5. Plans to recover and restore capabilities and services
should there be an incident
ISA 62443. The International Society of Automation
(ISA; Research Triangle, N.C.; www.isa.
org) released standards that outline cybersecurity
plans, processes and procedures for securing
and defending industrial plants from cyberattacks
[10]. ISA 62443 is focused on operational technology,
rather than information technology, and it
is not specifically tailored to the chemicals sector
but does offer an approach to create a cybersecurity
management system. Companies can seek
ISA 62443 certification, which is a third-party technical
expert attestation of compliance with the requirements.
These include requirements related
to engineering processes, product design and
network susceptibility.
American Chemistry Council. The American
Chemistry Council (ACC; Washington, D.C.; www.
americanchemistry.com) requires its members to
perform a risk assessment to review cyber vulnerabilities,
implement security measures to address
those threats, and provide training and guidance to
employees on current and emerging threats. ACC
members include companies involved in chemical
manufacturing, sales,
and storage and disposal.
transportation,
distribution,
Data privacy and protection laws. Should a
company fall victim to a cyber incident, there is
always a risk that sensitive personal data belonging
to individuals could be impacted. There is no
single U.S. federal law for data privacy and protection
that comprehensively covers the chemicals
sector, but every state has passed some form of
data-breach response legislation, and many states
have consumer protection laws of various types.
About half of the states also have minimum technical
and security requirements that companies are
required to implement to protect data. In addition,
California has a comprehensive data-protection
regime through the California Consumer Privacy
Act (CCPA), which went into effect in 2020. Since
the passage of the CCPA, other states, including
Virginia and Colorado, have adopted similar laws.
Additionally, several countries and regions have adopted
comprehensive data protection legislation, including
the U.K., Brazil, South Africa, China, South
Korea and Japan. The E.U., in particular, has long
applied a more wide-ranging data-protection regulatory
scheme, and its most recent data protection
law, the General Data Protection Regulation (GDPR),
CHEMICAL ENGINEERING WWW.CHEMENGONLINE.COM
http://www.achema.de http://www.isa,org http://www.isa,org http://www.americanchemistry.com http://www.americanchemistry.com http://WWW.CHEMENGONLINE.COM
Chemical Engineering June 2022

Table of Contents for the Digital Edition of Chemical Engineering June 2022
