Abstract
This article examines the key challenges associated with implementing information security requirements in industrial control systems. Based on the analysis of scientific publications, international standards, and industry analytical reports, as well as on the author’s own analysis and practical experience, the limitations of directly transferring information security requirements developed for corporate information systems to the industrial environment are identified. It is shown that the architectural and operational characteristics of ICS, the priority of availability and continuity of technological processes, and the long life cycle of industrial equipment necessitate the adaptation of information security requirements. The role of an information security management system is substantiated as a tool for risk-oriented adaptation of security requirements and for the implementation of compensating security measures in industrial systems.