Mark van Zomeren

The objective of this paper is to frame research improving the governance of modern cyber-physical systems (CPS) and Complex Systems of CPS through better regulation and compliance. CPS are increasingly being used to undertake high-hazard activities that have the potential to cause significant impacts on people and the environment. The analysis detailed in this paper provides insights into how maritime, aviation, and nuclear regulators from the United States of America, the European Union, and Australia, in particular, facilitate the global trend of integrating cyber components into the high-hazard physical systems they regulate. This insight is gained by undertaking a systematic document review and word search analysis of the regulations, codes, standards and guidance documents published or referred to by these regulators, relevant to the operation of the high-hazard CPS they regulate. These documents were selected to assess the importance that these regulators place on cybersecurity, cyber safety, and cyberworthiness. This analysis confirmed that current regulations primarily treat cyber and physical safety in isolation and generally perceive the application of cybersecurity as adequate for achieving safety for the cyber aspects of CPS. This demonstrates the need for the application of more contemporary concepts, such as cyberworthiness, to the regulation of high-hazard CPS, as well as methods to pathologically assess and incrementally improve governance of such systems through approaches like Complex Systems Governance.

The objective of this paper is to frame research improving the governance of modern cyber-physical systems (CPS) and Complex Systems of CPS through better regulation and compliance. CPS are increasingly being used to undertake high-hazard activities that have the potential to cause significant impact on people and the environment. The analysis detailed in this paper provides insights into how maritime, aviation, and nu-clear regulators from the United States of America, the European Union, and Australia, in particular, facilitate the global trend of integrating cyber components into the high-hazard physical systems they regulate. This insight is gained by undertaking a systematic document review and word search analysis of the regulations, codes, standards and guidance documents published or referred to by these regulators, rele-vant to the operation of the high-hazard CPS they regulate. These documents were se-lected to assess the importance that these regulators place on cybersecurity, cyber safety, and cyberworthiness. This analysis confirmed that current regulations primar-ily treat cyber and physical safety in isolation and generally perceive the application of cybersecurity as adequate for achieving safety for the cyber aspects of a CPS. This demonstrates the need for the application of more contemporary concepts, such as cyberworthiness, to the regulation of high-hazard CPS, as well as methods to patho-logically assess and incrementally improve governance of such systems through ap-proaches like Complex Systems Governance.

Building on a literature review conducted to identify literature on international best practices for the through-life technical assurance of cyber-capable systems, this chapter considers the use of cyber-physical systems (CPS) within the context of large and complex organizations such as nation-state defense organizations and critical civilian infrastructure. Building on the concept of CPS, the chapter discusses the societal impacts of complex CPS (CCPS) and systems of CCPS to draw out some of the safety consequences of operating CPS. Safety considerations and mitigation strategies are explored before moving to the regulation of public risk posed by CPS. The case for moving from traditional cybersecurity to cyber-worthiness is made by highlighting the need to consider not only the information assurance aspects of CPS but also the ongoing provision of timely and safe physical outputs of CPS. The importance of model-based cyber-worthiness assessments is considered in the context of tracking and communicating threats to CPS. The application of complex systems governance (CSG) to addressing cyber-worthiness is then considered a viable methodology for managing the complexity of present-day CPS before considering how emergent features of truly complex CPS may be handled via cyber-worthiness assessment and CSG.