Requirement:

The asset owner shall have policies and procedures related to identifying and authenticating all human users on all IACS interfaces that can be used by human users to access the IACS. This includes, but is not limited to: a) device interactive human user login interfaces, b) application interfaces such as web services, file transfers and OPC servers, and c) remote desktop interfaces that provide human users login access to IACS devices over the network.

Guidance: