Perform a Risk Assessment

Before you deploy the security policy or change security settings on a running control system, you must perform a risk assessment for your system. The risk assessment must determine what, if any, adverse effects might result from deploying a security policy or changing security configuration.

You must test the system operations with the deployed security policy or configured security settings before you energize critical machines or processes. We strongly recommend that you perform these actions in a test environment or put the system in a safe state.