Building a Collection Management Framework for Industrial Control Systems

This document outlines guidance for ICS organizations to implement a Collection Management Framework (CMF) that documents available internal data sources, what information they yield, and retention periods to improve detection and incident response. It prescribes a five-step process—develop business-aligned requirements; create a collection plan using internal data sources; implement the plan with new procedures and data identification; test and evaluate effectiveness; and update and communicate the plan—to increase visibility, identify gaps, and prioritize security controls.