Layered Security Guidance for Data Asset Management in Additive Manufacturing

Area of Science:

• Cybersecurity
• Manufacturing Engineering
• Information Technology

Background:

• Additive Manufacturing (AM) is increasingly used for critical parts, but its complexity presents cybersecurity risks.
• Existing Information Technology (IT) and Operational Technology (OT) security standards lack AM-specific guidance.
• A structured approach is needed to integrate AM-specific security revisions with current standards.

Purpose of the Study:

• To propose a layered, risk-based approach for developing and managing AM-specific cybersecurity guidance.
• To address the insufficiency of current IT/OT security standards for Additive Manufacturing.
• To demonstrate a method for integrating AM-specific security needs with existing frameworks.

Main Methods:

• Literature review on AM data and asset management for security.
• Leveraging the National Institute of Standards and Technology's Cybersecurity Framework (CSF) for asset identification and management.
• Utilizing the Open Security Controls Assessment Language (OSCAL) for integrating guidance.

Main Results:

• Identified AM geometry and process definitions crucial for mapping data flows and documenting processes.
• Developed a structured layering approach to integrate AM-specific security guidance with existing IT/OT standards.
• Demonstrated a traceable and rigorous method for authoring and managing AM cybersecurity guidance.

Conclusions:

• A risk-based, layered approach is effective for creating comprehensive AM cybersecurity guidance.
• The proposed method ensures AM-specific guidance is value-added, non-redundant, and consistent with existing standards.
• Implementation of this approach enhances the security posture of Additive Manufacturing operations.