SUC scope
Identification of the IACS scope: equipment, networks, functions, users and access points. This is the inventory that feeds every subsequent step — an asset missing here cannot be rated in ZCR 2, nor placed in a zone in ZCR 3.
What is entered here
| Category | Role in the rest of the study |
|---|---|
| Equipment ("Hardware" supporting assets) | Rated in ZCR 2, placed in a zone in ZCR 3, assessed in SL-C in annex 4-2 |
| Networks | Support for conduits; each piece of equipment is attached to one or more networks |
| Functions (business values) | Linked to assets in the ZCR 2 rows |
| Users | Accounts, roles and access |
| Access points | Used to check the completeness of conduits in ZCR 3 |
Entering vendor, model and firmware for equipment is not cosmetic: it is what enables the CVE analysis on the Scan & vulnerabilities page.
Toolbar buttons
| Button | Effect |
|---|---|
| SUC diagram | Opens the graphical representation (zones, conduits, FR/CR requirements) |
| CVE Analysis | Opens the per-equipment vulnerability analysis |
| Grid | Shows/hides cell borders |
"SIS analysis" profile
If the profile is enabled in the Context, ZCR 1 also captures the essential functions: loss of control, loss of protection, loss of view.
Completeness
The SUC diagram flags with a dashed circle any equipment present in the inventory but without a ZCR 2 row. It is the fastest way to check that the initial analysis covers the whole scope.