This standard establishes requirements for: " defining a system under consideration (SUC) for an industrial automation and control system (IACS); " partitioning the SUC into zones and conduits; " assessing risk for each zone and conduit; " establishing security level target (SL-T) for each zone and conduit; and " documenting the security requirements.