Establishing an Industrial Cybersecurity Management System

Learning objectives

Explain the purpose of an IACS security programme or CSMS.
Identify the governance processes needed to sustain technical controls.
Define useful programme evidence.
Connect continuous improvement to operational experience.

Introduction

This module considers how organisations govern sustained industrial cyber security.

Planned video lesson

Module 07 video lesson

Video lesson coming soon. The written module can be completed without the video.

Planned recording: 8-10 minutes comparing a policy statement with the real records needed to prove that the Riverside control is operating.

Transcript will be added with the video.

Main lesson

From project controls to sustained governance

Technical controls only remain effective when the organisation governs them. IEC 62443-2-1:2024 addresses the asset owner's security programme for IACS in operation. It structures requirements as security programme elements and includes a maturity model for evaluation. Older editions, project documents and training may use the term cybersecurity management system, or CSMS. Check the invoked edition and use its defined terminology in formal claims.

The practical purpose is stable: assign ownership, understand risk, operate controls, respond to events and improve over time.

Core programme areas

An effective programme normally covers:

Policy, scope and management commitment.
Organisation, roles, competence and segregation of duties.
Asset, configuration and data-flow management.
Risk assessment and treatment.
Identity, access and remote-support governance.
Physical and environmental security.
Supplier and third-party management.
Vulnerability and patch management.
Backup, recovery and continuity.
Logging, monitoring and event response.
Incident management and regulatory reporting.
Secure change and project handover.
Document control, audit and improvement.

The programme must fit the operating environment. A small unmanned station may use central processes, but local assets, connections, restoration needs and accountable owners still need to be visible.

Policy is not evidence of operation

For every control, ask for operational evidence.

Stated control	Stronger evidence
Access is reviewed	Dated review, owner, exceptions and closure record
Backups are taken	Restore test to known hardware or an equivalent test environment
Vulnerabilities are managed	Receipt, applicability decision, risk owner and treatment record
Suppliers are controlled	Contract requirement, approved access, session log and review
Staff are trained	Role-based competence record and exercise outcome
Incidents are reported	Tested escalation route, contact list and exercise findings

Risk treatment needs ownership

Each treatment should identify:

Risk and affected essential function.
Selected control.
Implementation owner.
Due date.
Verification method.
Residual risk.
Acceptance authority.
Review trigger.

Avoid accepting risk through silence. If a control is deferred because no outage is available, record the compensating controls and the person authorised to accept the remaining exposure.

Continuous improvement

Improvement should use evidence from:

Incidents and near misses.
Vulnerabilities that reached deployed products.
Failed or delayed restoration.
Audit findings.
Repeated unauthorised access attempts.
Supplier performance.
Obsolete or unsupported assets.
Changes in threat, regulation and good practice.

Metrics should lead to decisions. Counting detected events is not useful unless it changes priorities, resources or controls.

Planned original figure — M07-F01

Create a programme wheel connecting governance, risk, people, assets, access, suppliers, vulnerabilities, monitoring, response, recovery and improvement.

Planned asset: /static/training/ot-cyber-security/module-07/figure-01.svg

Engineering example

Riverside application

Riverside needs governance that continues after project handover: assigned owners, repeatable controls, evidence, exercises and review dates.

Practical activity

Apply what you learned

Create a minimum operational assurance calendar:

Monthly review of remote-access and privileged-account records.
Quarterly asset and connectivity reconciliation.
Vulnerability review when advisories arrive.
Patch and compensating-control review at the agreed frequency.
Annual restoration exercise.
Incident tabletop exercise.
Review when products approach end of support.

Assign a named owner and retained record to every activity.

Your response (optional)

Record your reasoning and project notes here. Your response stays in this browser and is not submitted to the website.

Loading saved response…

0 / 10,000

Do not enter real credentials, confidential network details, sensitive asset information or security-sensitive project data.

Knowledge check

Answer every question correctly to complete this module. If an answer is incorrect, review the explanation and try again. This is not a formal examination.

1. Backup software reports “job successful” every night, but no controller restoration has been tested. What has been demonstrated?

The recovery requirement is met because successful backup jobs prove that the files are restorable.The control is ineffective because only manual backups can be accepted for an IACS.Backup creation is evidenced, but recoverability, completeness and the restoration procedure remain unproven.

2. A patch is deferred until the next outage. Which record makes that a governed risk decision?

Affected assets, rationale, residual risk, controls, owners, review date and authorised acceptance.The supplier advisory, original vulnerability score and a note that production availability takes priority.A maintenance action showing that the patch will be reconsidered when operational staff request it.

3. Which measure gives management the strongest evidence that remote-access governance is working?

The total number of VPN connections has reduced compared with the previous year.Periodic reviews reconcile approved work, users, session records, exceptions and corrective actions.The remote-access policy has been reissued to all service providers each year.

0 of 3 questions answered correctly.

Key takeaways

Remember these points

A policy states intent; records, tests and reviews show whether a control operates.
Deferred actions need an owner, residual-risk decision, compensating controls and review date.
Exercises test governance, communications and restoration as well as technical controls.

Relevant standards and guidance

This module uses original explanatory language. Consult the applicable editions and project requirements rather than treating this lesson as normative text.

ISA/IEC 62443-2-1
NIST Cybersecurity Framework 2.0

Last reviewed

15 July 2026.