POWER September 2011 - 23

A successful IFAT requires a team with
representatives of the customer, the vendors
(including control system vendors
and security solution vendors), and a
neutral third party. Customer representatives
are necessary to provide oversight,
decision-making, and technical knowledge
of the corporate systems; they also need
to learn about and be confident with the
integrated solution. Representatives from
each control system vendor and integrated
security solution vendor must be present
to verify that their systems are configured
as required and to provide technical insight
when troubleshooting the integrated
security solution.
Finally, an impartial third party is fundamental
to a successful IFAT. The third party
defines and runs the testing activities and
serves as the host for all customer and
vendor representatives in order to create a
neutral, productive work environment. The
customer, vendors, and third-party host
collectively ensure the success of the integrated
solution and gain knowledge from
one another throughout the IFAT process.
Conducting an IFAT
Any IFAT requires planning and preparation
in order to be successful. Its scope
has three basic areas:
■ Determination of systems and networks.
■
Testing to ensure that the equipment
meets regulatory requirements and can
be maintained by the customer.
■ Reporting IFAT results to vendors.
First, with the guidance of the neutral
third party, the customer and vendors must
determine the integrated network design
and the systems required for testing at the
IFAT. To provide the most benefit, the actual
systems being installed at the customer
site should be present at the IFAT for testing.
When the actual systems are not available,
equivalent systems should be used.
Once the integrated network has been
designed and the necessary systems have
been identified, a test plan is developed.
The IFAT test plan, written by the neutral
third party, based on customer and vendor
requirements, describes the integrated
network tests and security application
tests to be conducted. This test plan is
reviewed with all IFAT participants to ensure
understanding and agreement. Upon
agreement on a final test plan, detailed
test plans are developed, including stepby-step
guides and pass/fail criteria for
each test. These test plans are followed
during actual testing activities.
September 2011 | POWER
Upon completion of the IFAT testing activities,
a final results package is distributed
to all parties that includes the results
of all tests, final baseline configurations
for all systems, and an action item list for
unresolved issues. This set of documentation
provides the customer and vendors
with the necessary tools for a smooth installation
of system components.
With the current trend of more intelligent
ICSs and increased regulatory compliance,
the best approach to achieving
ICS and IT integration is by conducting
an IFAT. Performing an IFAT avoids costly
redesign and troubleshooting during plant
outages, saving time and money while ensuring
a better security solution. ■
-Contributed by Jerome Farquharson,
(jfarquharson@burnsmcd.com), critical infrastructure
and compliance practice manager,
and Alexandra Wiesehan, cyber security
analyst, for Burns & McDonnell.
PM_USA_MultiDisc_11,58_19,05.qxp:Layout 1 27.06.2011 12:06 Uhr Seite 1
Geiger
MultiDisc®
Screen
> Fish Friendly - EPA 316b
Compliant Screens
> Eliminates Condenser
Fouling from Debris
Carryover
> Easily Retrofit
> Low Maintenance Design
> Single Chain
>No Submerged Bearings
or Shafts
> Integral Spray Pump
For more Info
Contact: dlanderson@passavant-geiger.us
Or call: 631 239 4121
CIRCLE 14 ON READER SERVICE CARD
www.powermag.com
23
Passavant-Geiger GmbH
Hardeckstrasse 3
76185 Karlsruhe · Germany
www.passavant-geiger.de
http://www.passavant-geiger.de http://www.powermag.com
POWER September 2011

Table of Contents for the Digital Edition of POWER September 2011
