Operational technology has kept our most hazardous facilities running safely for decades. Now it’s quietly becoming one of their greatest vulnerabilities and most PSM programmes haven’t caught up.
The question your last audit probably didn’t ask
Think about the last time your PSM programme was audited. The inspectors walked the plant, reviewed your procedures, checked your mechanical integrity records, and tested your relief valves. They may have even sat with operators in the control room.
But did anyone open a laptop and ask: Who can access your DCS from outside the building? Does your PLC firmware still receive security patches? Has anyone mapped the attack surface of your safety instrumented systems?
If those questions weren’t asked, or if the honest answer is “I don’t know”, you’re not alone. And that’s precisely the problem.
OT cybersecurity for COMAH isn’t a separate IT problem wearing a hard hat. For COMAH operators, it sits squarely inside Process Safety Management, and the consequences of getting it wrong are physical, not just digital.
IEC 62443, IEC 61511 and COMAH: What the standards now require
Operational technology – the PLCs, DCS, SCADA systems and safety instrumented systems that run your process – has historically lived in an air-gapped world. The assumption that physical separation made it safe from external attack wasn’t just policy; it was engineering reality.
That world is gone.
The convergence of IT and OT networks, the adoption of remote monitoring, the integration of cloud-based analytics, and the quiet proliferation of vendor maintenance connections have eroded that boundary faster than most organisations have been able to keep up with. Today, the average industrial site has dozens of external network pathways it can’t fully account for.
The scale of this exposure is no longer theoretical. According to a 2024 Bitsight report, over 180,000 ICS/OT devices are now publicly reachable on the internet, a figure that rose 12% in a single year. For many organisations, the attack surface has grown not through negligence, but through the incremental, well-intentioned decisions of operational teams trying to keep complex infrastructure running.
In an office environment, that’s a manageable problem. Patch, monitor, repeat. But in hazardous process environments, where a failure could overwhelm a safety system and lead to a toxic release or explosion, the stakes are categorically different. A cyberattack on your process control layer isn’t a data breach. It’s a loss of control.
The Triton/TRISIS malware, discovered in 2017 at a Middle Eastern petrochemical facility, was specifically engineered to disable safety instrumented systems. Its goal was not data theft. It was to remove the last line of defence before a physical catastrophe.
What HSE’s OT cyber security trial inspection programme found
This is easy to miss: the major process safety frameworks have already acknowledged this shift.
IEC 61511 has been explicit since its 2016 revision that a cybersecurity risk assessment is a required input to the safety lifecycle. ISA/IEC 62443 provides a detailed framework for industrial control system security, with extended expectations around governance, risk management, secure design, and supply chain assurance. HSE inspections remain built on OG86, which HSE continues to maintain as good practice and which already incorporates both the NCSC’s CAF and IEC 62443. HSE is working toward IEC 62443 as the more detailed benchmark, particularly for risk assessment at higher-consequence sites, rather than replacing OG86 outright.
The guidance exists. The standards are clear. The gap is in implementation.
The evidence bears this out. When HSE published findings from its OT cybersecurity trial inspection programme covering COMAH operators across chemical manufacturing, refining, fuel pipelines, gas terminals, and industrial gases, not a single operator had fully achieved all the required objectives for good cyber hygiene. Governance arrangements were insufficiently formalised. Risk assessments failed to account for major accident hazards. Technical controls were applied ad hoc, without being underpinned by management systems. Almost no capability existed to detect or respond to a cyber incident.
Critically, those inspected were a self-selecting volunteer group – ones that already knew something needed to be done. HSE noted that compliance across the wider sector was likely lower still.
The standards have moved considerably since those inspections. The question for any operator today is not whether the sector had gaps then. It’s whether your own programme has kept pace.
“We’ve never had an incident” is not a programme
The most common barrier to prioritising OT cyber resilience isn’t scepticism. It’s assumed assurance.
OT cyber risk rarely gets explicitly deprioritised. It quietly gets absorbed into the engineering function, where it sits unexamined at leadership level. Nobody decides this is acceptable. It just becomes the default.
The problem is that assumed assurance isn’t assurance at all. It’s an unexamined gap and in process safety, gaps have consequences.
Cyber threats to OT environments are, by design, difficult to detect. Threat actors conducting reconnaissance inside an industrial network can remain dormant for months before acting. Many facilities have no monitoring capability on their OT networks whatsoever, not because they’ve assessed the risk and accepted it, but because the question has never been properly framed.
The argument from silence “we’ve seen nothing, therefore we’re fine” is exactly the kind of reasoning that has preceded most major industrial failures. Not an absence of danger. An absence of visibility.
You cannot manage what you cannot see.
OT Cyber Security Maturity for COMAH operators: What good looks like
The gap between where organisations believe they are and where they actually are on OT cyber security maturity is, in our experience, one of the largest we see in any area of process safety.
It isn’t born of negligence. It’s born of the fact that the issue sits at the intersection of two disciplines – process safety and cybersecurity – that have historically operated in separate worlds, with separate teams, separate vocabularies, and separate reporting lines.
Genuinely understanding your position requires looking across multiple dimensions simultaneously: asset inventory and network architecture, governance processes, risk assessment quality, the people, process and technology controls in place, and your ability to detect, respond to, and recover from an incident.
For COMAH duty holders, the regulatory expectation is now explicit. HSE treats cyber security as a core aspect of process safety, requiring that cyber incidents capable of causing loss of containment be addressed directly in COMAH Safety Reports. Boards and Senior Leadership Teams are expected to exercise direct oversight, delegating responsibility solely to IT or engineering may itself be interpreted as inadequate risk management.
The facilities that find surprises in a structured OT Cyber assessment are not, in our experience, poorly managed. They are simply the ones that hadn’t looked carefully enough. Until they did.
Where does your programme actually stand?
A genuine understanding of your Cyber OT posture gives your leadership team an honest picture of risk and a structured basis for prioritising improvement, not driven by anxiety or guesswork, but grounded in evidence.
If you’re not certain where your programme stands, the most useful first step is a structured, honest assessment against existing good practice guidance and standards, rigorous enough to surface the real picture rather than confirm the comfortable one.
Our self-assessment tool is built to do exactly that. Drawing on good practice guidance, established standards, and frontline experience, it shows you where you excel, where you meet requirements, and where the real gaps are.
Not to alarm you. To equip you.
Frequently Asked Questions
Is OT cybersecurity required under COMAH?
Yes. HSE treats OT cybersecurity as a core component of process safety management for COMAH operators. Cyber incidents that could cause loss of containment must be addressed in COMAH Safety Reports. HSE inspections are built on OG86, which incorporates both the NCSC’s Cyber Assessment Framework and IEC 62443, and which HSE continues to maintain as good practice. HSE is working toward IEC 62443 as a more detailed benchmark, particularly for risk assessment at higher-consequence sites. Boards and Senior Leadership Teams are expected to exercise direct oversight of OT cyber risk.
What does IEC 62443 require for COMAH operators?
ISA/IEC 62443 requires COMAH operators to establish a formal OT cybersecurity management system covering governance, risk assessment, secure system design, technical controls, and supply chain assurance. It also requires the ability to detect, respond to, and recover from cyber incidents. It works alongside IEC 61511, which since its 2016 revision has required a cybersecurity risk assessment as a mandatory input to the safety lifecycle.
What is the difference between IT security and OT cybersecurity?
IT (information technology) security protects data, networks, and business systems. OT (operational technology) cybersecurity protects the PLCs, DCS, SCADA systems, and safety instrumented systems that control physical processes. In hazardous facilities, a successful cyberattack on OT systems can result in loss of process control, loss of containment, or the disabling of safety systems – physical consequences, not just data breaches.
What did HSE find in its Cyber OT trial inspection programme?
HSE’s Cyber OT inspection programme covered COMAH operators across chemical manufacture, refining, fuel pipelines, gas terminals, and industrial gases. Not a single operator had fully achieved all the required objectives for good cyber hygiene. Common gaps included insufficiently formalised governance, risk assessments that failed to account for major accident hazards, ad hoc technical controls, and almost no capability to detect or respond to a cyber incident.
How do threat actors target OT systems in COMAH facilities?
Threat actors typically target OT systems through network pathways that have emerged from IT/OT convergence, remote monitoring connections, vendor maintenance access, and misconfigured industrial devices exposed to the internet. Unlike traditional cyberattacks, OT-focused threats can remain dormant inside a network for months before acting. The Triton/TRISIS malware, discovered in 2017 at a petrochemical facility, was specifically designed to disable safety instrumented systems.
How should a COMAH operator assess its OT cyber risk?
A structured OT cyber risk assessment for a COMAH operator should cover: asset inventory and network architecture mapping; identification of external network pathways; governance arrangements and management system maturity; risk assessment quality against major accident hazard scenarios; people, process and technology controls; and detection, response and recovery capability. The assessment should be aligned with ISA/IEC 62443 and informed by HSE’s published guidance.