What is the CSIR?
The CSIR (Cybersecurity Implementatierichtlijn Objecten, the Cybersecurity Implementation Guideline for Objects) is a Dutch guideline from Rijkswaterstaat and Het Waterschapshuis that merges the BIO and IEC 62443 into a single practical set of security requirements for the industrial automation of objects such as pumping stations, locks, weirs, bridges and treatment plants. It translates the office-oriented controls of the BIO (Baseline Information Security for Government) to OT and supplements them with process-oriented requirements from IEC 62443. Every object receives a classification, and that classification determines how heavy the measure package is. Version 3.0, from September 2021, can be used by all partners of the Dutch Administrative Agreement on Water, including those that outsource design and maintenance.
🧠 Where does the CSIR come from?
The CSIR started as an internal guideline at Rijkswaterstaat, the Dutch national public works agency, for the cybersecurity of locks, bridges, tunnels and similar structures. The first version combined the Baseline Information Security for Central Government (BIR 2012) with the then still draft parts of IEC 62443 and the NCSC checklist for securing ICS/SCADA systems. The NCSC was therefore a source, not an author.
| Version | Date | Milestone |
|---|---|---|
| 1.01 | 2 December 2013 | First version for Rijkswaterstaat, based on BIR 2012 and draft IEC 62443 |
| 1.4 | 4 August 2015 | Stripped-down version for use in tenders |
| 2.0 | 21 May 2021 | Formally adopted for Rijkswaterstaat; missing IEC 62443 requirements added |
| 3.0 | 16 September 2021 | Formally adopted for Rijkswaterstaat and the water authorities; agency-specific text generalised |
For version 2.0, Rijkswaterstaat had an IEC 62443 specialist check which requirements were still missing and where they belonged. For version 3.0, every Rijkswaterstaat-specific passage was replaced with general text, so that water authorities, provinces, municipalities and contractors can use the guideline. The document runs to more than 150 pages and is maintained by the Rijkswaterstaat Security Centre and Het Waterschapshuis, the shared ICT organisation of the Dutch water authorities. Version 3.0 predates BIO2 and still refers to the chapter numbering of the original BIO, which was based on ISO 27002:2013.
🔄 How do the BIO, IEC 62443 and the CSIR relate to each other?
The BIO is mandatory for Dutch government bodies, but it focuses on information and its confidentiality. In process automation, the priorities are the function of the object, reliability and, above all, safety. The BBN levels and associated CIA ratings of the original BIO therefore offer little guidance for a pumping station or a movable bridge. IEC 62443 does cover that OT side, but it is voluntary and lacks the government-specific requirements.
| Framework | Nature | Focus | Role in the CSIR |
|---|---|---|---|
| BIO | Mandatory framework for Dutch government | Information, confidentiality, office IT | Foundation: BIO controls form the baseline, translated to OT |
| IEC 62443 | International series of standards, voluntary | Function and availability of industrial systems | Enrichment: additional, non-overlapping requirements and security levels |
| ISO 27001 | International management system standard | ISMS and risk management | Structure: CSIR measures are organised along Annex A |
| CSIR | Implementation guideline | Objects with industrial automation | Synthesis of the above into one actionable set |
A key design choice is that the CSIR does not introduce a second management system. IEC 62443 speaks of a Cyber Security Management System (CSMS), the BIO of an ISMS. Running two systems side by side is impractical for a public body, so the CSIR uses the existing ISMS with its ISO structure and fills it with OT measures. An overview of all frameworks side by side is in Security Standards.
🔧 How is the CSIR structured?
The guideline consists of three layers that refer to one another:
- Chapter 1: generic controls - the translated BIO controls, divided into VSP (process requirements, such as policy, roles, audits and supplier agreements) and VSE (system requirements, such as segmentation, logging and hardening). The split matches systems engineering and the V-model used in Dutch civil engineering projects.
- Chapter 2: ten in-depth measure packages - physical access security, logical access, security incidents and the incident response plan, network connections and cryptography, protection against vulnerabilities, logging and monitoring, awareness and training, controlled change, maintenance, and backups. Every measure has a column for each resilience level from 1 to 4.
- Annexes CSR 1 to CSR 24 - detailed guidelines and templates, including object network architecture (CSR 3), passwords (CSR 7), patch management (CSR 8), incident response (CSR 14), a recovery plan (CSR 15), registration of assets in a CMDB (CSR 16), backup and recovery (CSR 18) and physical security (CSR 24).
The guideline also contains a template for the Cybersecurity Dossier, also called the Cybersecurity Security Plan, and a best practice for weighing risks when deviating from the baseline.
🧱 How do function boxes and resilience levels work?
To avoid heavy risk analyses for every object, the CSIR classifies objects with a business impact analysis. What counts is the impact if the object’s function fails, not the cause of that failure. The average score across impact categories such as safety, societal consequences and financial damage determines the function box.
| Function box | Cybersecurity resilience level | Meaning |
|---|---|---|
| A | 4 | Highest classification, heaviest measure package |
| B | 3 | Heavy package |
| C | 2 | Elevated package |
| D | 1 | Baseline package |
| E | 1 | Baseline package |
The measures per resilience level correspond to the security levels of IEC 62443; level 1 largely matches SL 1. Three rules matter most in practice:
- Minimum level 1 - every object, and also loose OT components without a function box such as a pump pit or a field cabinet, gets at least the baseline package
- Weakest link - if object A is operated or managed from a lower-classified object B, B is raised to A’s level
- Comply or explain - deviations and postponed measures are recorded, with a risk assessment, in the Cybersecurity Dossier
🛠️ How do you apply the CSIR in a project?
The CSIR is written for both clients and contractors. It cannot be inserted unchanged into a tender specification: the client selects the relevant controls from chapter 1 and translates them into requirements under Dutch contract conditions such as UAV-GC or ARVODI. A typical approach:
- Classify the object - determine its function box and resilience level, or use level 1 as the floor
- Select the controls - choose the VSP and VSE controls that fall within the scope of the contract
- Design the object network - following CSR 3: a separate segment per function, a layered design based on the Purdue Model, and zones with defined interfaces, as in the Zones and Conduits Model of IEC 62443-3-3
- Document everything - in the Cybersecurity Dossier, which the contractor submits to the client for acceptance
- Keep it current - at least an annual audit of design, existence and operation, plus a PDCA evaluation
A few concrete values from the guideline show how operational it is:
| Topic | Requirement in CSIR 3.0 |
|---|---|
| SCADA operator, application management and administrator accounts | Personal, at least 20 characters, changed every 180 days |
| SCADA service accounts | At least 20 characters, changed every 365 days |
| Vendor default accounts | Disabled, never used |
| Log retention | Based on a risk assessment, always at least three months |
| Check that logs are unaltered | Independent internal audit at least every six months |
| Network traffic between objects | Never direct, only through a controlled and monitored interface |
| Supplier remote access | Through a central, monitored facility, open only for the duration of a change or fault |
The CSIR also takes an assume breach approach: your organisation must expect that an attack can succeed and therefore have an incident response plan and a recovery plan ready.
🏭 What role does the CSIR play in the Dutch water sector?
The Dutch water authorities have stated that they apply the CSIR, and Rijkswaterstaat has worked with it since the first version in 2013. That makes it part of the standard knowledge base of OT security in the water sector. CERT-WM, the CSIRT of the water authorities, makes version 3.0 publicly available.
Since the Dutch Cybersecurity Act (Cyberbeveiligingswet) entered into force on 15 August 2026, BIO2 has been legally mandatory for government bodies within its scope. BIO2 allows public bodies to implement OT controls equivalently using the CSIR and IEC 62443. For a water authority within the scope of the Cbw, the Dutch implementation of NIS2, the CSIR is therefore a practical way to demonstrate its duty of care for pumping stations and treatment plants. Note that version 3.0 follows the old BIO numbering, so you may need your own mapping table to BIO2.
❓ Frequently asked questions
What does the abbreviation CSIR stand for?
CSIR stands for Cybersecurity Implementatierichtlijn Objecten, the Dutch Cybersecurity Implementation Guideline for Objects. It is a guideline from Rijkswaterstaat and Het Waterschapshuis for securing industrial automation in objects such as pumping stations, locks and bridges. The abbreviation has nothing to do with incident response.
Is the CSIR mandatory?
The CSIR is not a law or a formal standard but an implementation guideline. Rijkswaterstaat and the water authorities have adopted it as their own guideline and include it in contracts, which can make it binding for contractors. Under BIO2, Dutch public bodies may use the CSIR to implement OT controls equivalently.
What is the difference between the CSIR and IEC 62443?
IEC 62443 is an international series of standards for securing industrial automation, with roles for asset owners, integrators and suppliers. The CSIR takes the relevant IEC 62443 requirements, combines them with the mandatory BIO controls and spells them out operationally for Dutch objects. An organisation that follows the CSIR therefore applies IEC 62443 indirectly.
What is a function box in the CSIR?
A function box is the classification (A to E) that an object receives in the CSIR, based on the impact if its function fails. Box A is the highest and maps to resilience level 4, while boxes D and E map to level 1. The resilience level determines which measures from chapter 2 apply.
What are VSP and VSE in the CSIR?
VSP and VSE are the two types of controls in chapter 1 of the CSIR. VSP controls are process requirements, such as roles, audits, awareness and supplier agreements. VSE controls are system requirements, such as network segmentation, logging, passwords and hardening.
Can organisations other than water authorities use the CSIR?
Yes, version 3.0 was deliberately generalised so that all partners of the Administrative Agreement on Water and other public bodies with process automation can apply it. Contractors and suppliers working for these clients use the CSIR as well. Private companies can adopt its structure as a practical translation of IEC 62443.
📌 In summary
The CSIR (Cybersecurity Implementatierichtlijn Objecten) merges the BIO and IEC 62443 into one actionable set of OT measures, scaled through function boxes A to E and resilience levels 1 to 4. The guideline from Rijkswaterstaat and Het Waterschapshuis gives clients and contractors concrete requirements for networks, accounts, logging and incidents at pumping stations, locks and bridges, and under BIO2 it is a recognised route to OT security in the Dutch public sector.