VSP

What is VSP?

VSP (Vraagspecificatie Proces Eisen, the process requirements of the request specification) is the set of process requirements in the Dutch CSIR that defines how an organisation or contractor organises, carries out and demonstrates the cybersecurity of the industrial automation in objects such as pumping stations, locks, bridges and treatment plants. Its counterpart VSE sets requirements for the system itself, while VSP covers ways of working: who is responsible, how changes, patches and incidents are handled and how all of that is recorded. In the CSIR the VSP controls sit in section 1.1, as a translation of the Dutch government baseline BIO into a baseline for industrial automation. There is also a contractual version: numbered VSP requirements for contractors in Design & Construct contracts.

🧠 Where does the abbreviation VSP come from?

The abbreviation comes from the contracting practice of Rijkswaterstaat, the Dutch agency responsible for national roads and waterways. In a Design & Construct contract, based on the Dutch UAV-GC conditions, the client describes what it wants in a request specification (vraagspecificatie). Rijkswaterstaat’s model documents split this into, among others, the Vraagspecificatie Eisen, with the requirements for the object, and the Vraagspecificatie Proces, with the requirements for the contractor’s processes. So VS stands for vraagspecificatie, the P for process (proces) and the E in VSE for requirements (eisen). Rijkswaterstaat deliberately uses process requirements sparingly: only work the client considers genuinely important is given a process requirement.

The CSIR (Cybersecurity Implementatierichtlijn Objecten, the cybersecurity implementation guideline for objects) of Rijkswaterstaat and Het Waterschapshuis, the shared IT organisation of the Dutch water boards, adopts that distinction. Chapter 1, “Generic controls and control objectives”, is split into two parts:

Every row in those tables has three columns: the BIO source (the number of the original BIO control), the translation of that BIO control into a baseline for industrial automation, and the resulting VSP or VSE control set. The BIO numbers follow the chapter structure of ISO 27002:2013, from 5 (policy) to 18 (compliance).

VSP is therefore not a freely chosen label but the process dimension of the BIO translation in the CSIR.

🔄 What is the difference between VSP and VSE?

The distinction is easy to remember: VSE describes what the system must be able to do technically, VSP describes how people and organisations set up and manage security. Each needs the other. Installing a firewall is a VSE topic, but without a process for changes, administration and review, its configuration will be out of date within a few years.

Many topics appear on both sides. Patching, backups and logging each have a process part (who does what, how often, with which reporting) and a system part (the technology has to support it).

🔧 What do the VSP controls in the CSIR contain?

The VSP controls in section 1.1 start with a top-level requirement: danger or damage caused by disruption, failure or misuse of IA, process automation and OT must be prevented, and any damage that does occur must be repaired. Below that are process requirements such as these:

• Resilience level and fallback - processes follow cybersecurity resilience level 1 by default, unless another level applies to an object. Where the CSIR provides no measure, you follow NEN-ISO/IEC 27002 and IEC 62443.
• Comply or explain - deviations and temporarily postponed implementations are recorded in the Cybersecurity Dossier or Cybersecurity Security Plan.
• Annual audit and PDCA - at least once a year an audit of the design, existence and operation of the measures, plus an annual evaluation of the security file.
• Roles - cybersecurity responsibilities with segregation of duties, a security officer and a key person with relevant qualifications.
• Staff - confidentiality and a Dutch certificate of conduct (VOG) where the role requires it, plus training according to section 2.7 and the security house rules in annex CSR 17.
• Access - remote access only through central, monitored facilities and after a formal request with a risk assessment.
• Changes and patching - a change procedure according to section 2.8 (change management), emergency patches when both the likelihood of misuse and the expected damage are high, and a reasoned report with formal approval when systems are not patched.
• Incidents - a central reporting point, immediate reporting, monthly reports according to CSR 21, an incident response plan according to CSR 14, problem management and a Coordinated Vulnerability Disclosure procedure following the guidance of the Dutch NCSC.
• Assume breach - a recovery plan according to CSR 15, a backup and recovery process that is tested every year, and a continuity plan for power outages (CSR 12).
• Risk and procurement - a risk analysis according to NEN-ISO/IEC 27005 before design, then at least annually, and an assessment under the Dutch guidance on national security in procurement and tendering.

🏗️ How are VSP requirements used in contracts?

For market parties, CERT-WM publishes, alongside the CSIR, a requirements list titled “VSE + VSP eisen generieke versie CSIR 3.4” (version 1.1 of 14 July 2022), taken from the ICO wizard (Inkoopeisen Cybersecurity Overheid, the Dutch government’s cybersecurity procurement requirements). The sheet is called “RWS proces (VSP) en systeem (VSE) eisen”. It names as its source the process request specification for Design & Construct and the basic cybersecurity specification (GRIP). Each requirement has a BIO source, a type, a number, a title and contract wording. Note the version number: CERT-WM calls the guideline “CSIR 3.4”, but the PDF itself carries version 3.0 of 14 September 2021, formally adopted on 16 September 2021 for Rijkswaterstaat and the water boards.

The VSP requirements are numbered from VSP01 to VSP69 and are addressed to the Contractor. A few examples:

Other VSP requirements refer to annexes of the CSIR, such as CSR 19 (intellectual property and software escrow) and CSR 20 (cameras and camera footage). For software development they refer to “Grip op Secure Software Development (SSD)” published by the Dutch CIP. The VSE requirements in the same sheet run from VSE01 to VSE39 and concern the managed object itself.

🛠️ How do you comply with VSP as a contractor?

A contractor or system integrator facing VSP requirements is best served by a fixed approach from the start of the project:

1. Read the request specification - establish which VSP requirements are in your contract and which resilience level applies to the object.
2. Write the cybersecurity plan - describe for each requirement how you meet it, and use the Cybersecurity Security Plan template that belongs with the CSIR.
3. Assign the roles - appoint the key person, arrange confidentiality and certificates of conduct, and make sure your subcontractors apply the requirements too (supplier security).
4. Embed it in your systems - include the requirements in your project management system or ISMS, so that deviations are handled as quality deviations.
5. Build the security file - record configuration items, changes, risk analyses, test results and deviations continuously, not only at handover.
6. Have it tested - schedule the annual audit and cooperate with penetration tests and monitoring if your network is connected to the client’s network.

A common mistake is to treat VSP as a paper exercise. A client is not asking for a polished process description but for evidence that the process works: a completed change log, a backup that has actually been restored and an incident process that has been tested.

❓ Frequently asked questions

What does VSP stand for in the CSIR?

VSP stands for Vraagspecificatie Proces Eisen, the process requirements of the request specification. In the CSIR these are the process requirements in section 1.1, which define how the cybersecurity of industrial automation is organised. Its counterpart VSE contains the system requirements.

What is the difference between VSP and VSE?

VSP covers processes and ways of working, such as responsibilities, change management, incident reporting and audits. VSE covers the technical design of the system, such as network connections, hardening and logging. A measure is usually only effective when both the VSP side and the VSE side are in place.

Who do the VSP requirements apply to?

The VSP controls in the CSIR apply to the organisation that manages objects with industrial automation, such as Rijkswaterstaat or a Dutch water board. In contracts they are translated into numbered VSP requirements for the contractor, for example the contractor in a Design & Construct contract.

Where can I find the official list of VSP requirements?

CERT-WM publishes for market parties the CSIR, the requirements list “VSE + VSP eisen generieke versie CSIR 3.4” and the template for the cybersecurity security plan. Which VSP requirements apply to a specific assignment is set out in the request specification of that contract.

Are VSP requirements derived from the BIO?

Yes, every VSP control in the CSIR refers to a BIO source and gives the translation of that BIO control into industrial automation. Where the CSIR provides no measure, you fall back on NEN-ISO/IEC 27002 and IEC 62443.

What does a contractor have to deliver for VSP?

A contractor delivers, among other things, a process description (cybersecurity plan), an up-to-date cybersecurity file, audit reports and an incident response plan. Deviations from the requirements are reported and recorded in the file under the comply-or-explain principle.

📌 In summary

VSP is the process dimension of the CSIR. In section 1.1 the guideline translates BIO controls into process requirements for securing pumping stations, locks, bridges and other objects. In contracts those requirements become numbered obligations for the contractor. Together with VSE they form the complete set: technology that is properly designed, and processes that keep that technology secure. You can read more about the sector in Water Sector OT Security.

VSP (Vraagspecificatie Proces Eisen) defines how cybersecurity around industrial automation is organised, managed and demonstrated; VSE defines what the system must be able to do technically.