Reader Comment – Advisory Formats

Earlier this week David Spinks, moderator of the Cyber Security in Real-Time Systems group on LinkedIn, left a comment in that group about my short post on the changes in Siemens advisory formats. He noted that:

“If I were a Siemens customer I would want to understand the reason for these changes. If you have a PDF document then you can detect any changes whereas in HTML format that is very difficult! UK HMG are in the same mode they DO NOT like to issue PDFs because it provides and audit trail ....”

Siemens had provided the following explanation for reason for dropping the .pdf and .txt version of their advisories and updates:

“As expected, the CSAF format is now the dominant standard for machine readable advisories, and the HTML format provides much better readability for humans due to interactive content like product grouping. Due to these improvements, the download rates of PDF and TXT advisories decreased further.”

Not explicitly stated here, but certainly implied is the fact that the storage and maintenance of the number of advisories that Siemens issues every month (November 2025 was a relatively light month with 7 new advisories and 18 updates) in multiple formats has got to be a rather significant business expense. Having said that, it would seem to me that the storage cost for .html files would be higher than .pdf files.

David does make an important point though about changeability issues. Even ignoring any possibility of nefarious intent, it is easier to correct minor mistakes and typos in an .html document than in one in a pdf format. And that could lead to management of change issues as people inevitably (and not necessarily with malice aforethought) incrementally expand the scope of ‘minor mistakes and typos’ that are acceptable to change.

We, as consumers of these advisories, have little chance to influence the decision-making processes of companies as large as Siemens, but if you have concerns similar to those that David has voiced, at least let your sales/service reps know about them. In the meantime, to keep your internal management of change documentation in good shape, save the Siemens .html documents to .pdf when you first access them, and each time you do a formal review (risk assessments, etc) of that vulnerability in your system, download (and date) the advisory again from the Siemens site. That way you will be sure to have the latest version, with any ‘minor changes’ that may have crept in without notification.

CSB to Consider Status of Past Recommendations

The Chemical Safety and Hazard Investigation Board (CSB) announced in today’s Federal Register (78 FR 15931-15932) that it would be holding a public meeting to review the status of some of the chemical safety recommendations that it has made as the result of some of its past investigations. Since the CSB has no regulatory authority, these safety recommendations are the strongest action the Board can take. The meeting will be on April 24^th, 2013 in Washington, D.C.

Status Review

The recommendations that the Board will conduct a status review of include:

2005-04-I-TX-7 issued to the American Petroleum Institute (API) and the United Steelworkers International Union (USW) in March 2007. This recommendation urged API and USW to jointly lead the development of an ANSI consensus standard with guidelines for fatigue prevention;

2001-05-I-DE-1 (Process Safety Management coverage of atmospheric storage tanks);

2005-04-I-TX-9 (Process Safety Management requirement for organizational management of change reviews); and

2010-07-I-CT-1 (Regulations addressing fuel gas safety).

Fatigue Response Inadequate

According to the notice the American Petroleum Institute has completed their work on the response to the 2005-04I-TX-7 in the form of the development of a new ANSI-approved Recommended Practice (RP 755; Note that link is to an API presentation about RP 755, to buy the standard see). The CSB staff has reviewed RP 755 and the notice describes their response this way:

“After review, the CSB staff found that RP 755 makes a contribution to chemical safety by explicitly stating that ``workplace fatigue is a risk to safe operations'' and also by suggesting various measures to manage fatigue risks. However, the staff determined that RP 755 does not fully meet the intent of the CSB recommendation in multiple important respects, and therefore has urged the Board to vote designating the status of Recommendation No. 2005-4-I-TX-7 as ‘Open-Unacceptable Action.’”

The full recommendation is available on the CSB web site. The Board will consider that recommendation at this meeting. It will also look at the agency responses for the other mentioned recommendations and take appropriate actions upon them as well.

Public Participation

The CSB is soliciting public comments on the staff recommendation. Comments may be submitted electronically (fatiguecomments@csb.gov). They should be received by April 5, 2013.

The CSB meeting on April 24^th is open to the public. There is nothing in the notice that indicates that advanced registration is required.