OT cyber resilience: from individual controls to justified confidence
Firewalls, access controls, monitoring and backups all matter. But their presence does not show that your organisation can maintain or restore the operational functions that matter when something goes wrong. OpenPSM® uses the NCSC Cyber Assessment Framework as its common outcome structure, bringing HSE OG86 expectations and IEC 62443 good practice together within it. It translates the outcomes you need into the OT management capabilities that achieve them, and the evidence that shows whether they are in place. Specialist technical assurance stays with the specialists. Management gets a clear line of sight to what is working, where the gaps are and what is being done about them.
White paper: Beyond the Cyber Checklist
Why the presence of controls is not evidence of resilience, and how to set targets, assess capability and give the Board a clear line of sight to what is working, where the gaps are and what is being done. Built on NCSC CAF v4.0, with HSE OG86 and IEC 62443.
We need all organisations to see cyber security as both an essential foundation for their operations and a driver for growth, to view cyber security not just as a ‘necessary evil’ or compliance function but as a business investment, a catalyst for innovation and an integral part of achieving their purpose. It’s not enough any more to talk about being resilient. We must all take the crucial steps that bolster our defences, that improve and grow our capability to contest.
Dr Richard Horne, CEO, National Cyber Security Centre (NCSC)
01
Why OT cyber risk is different
Operational technology controls physical processes. When it is compromised, the consequences can go well beyond data loss or service disruption: harm to people, releases to the environment, unstable production and safety systems that no longer perform as intended.
Approaches designed for corporate IT are not built to account for:
- Safety-critical functions where cyber failure can directly cause physical harm
- Legacy operational technology with long asset lifecycles and limited patching windows
- Engineering realities where availability is often prioritised over security
- Cyber-physical consequences, including latent faults in safety systems that persist after network restoration
- Operational continuity constraints that limit what security measures can practically be applied
But resilience does not stop at the boundary of the OT network. Plant depends on people, procedures, engineering information, communications, supporting IT services and specialist suppliers. Some of those dependencies can be lost for days during normal operation; others become critical within minutes during an incident. A control system can remain technically available while the organisation has lost what it needs to operate it safely.
Organisations operating industrial OT therefore need an approach that is structured, risk-informed and built for industrial operations, and that looks at the whole operational function, not only the control system.
02
A control is not a capability
Firewalls, multi-factor authentication, monitoring and backups each do an important job. Their presence does not, on its own, show that the organisation can achieve the outcome they were put there for.
A backup is a control; recovery is a capability. Recovering an OT system may mean rebuilding rather than restoring, verifying configurations, bringing supporting services back in the right order, mobilising suppliers and having competent people with the authority to decide when plant is fit to return to service.
Remote access works the same way. Authentication and segregation matter, but so does deciding who needs access and why, managing changes in supplier personnel, acting on monitoring information and withdrawing access when it is no longer needed. IT, engineering, operations, procurement and the supplier may each own part of it.
OpenPSM® assesses the management capability that brings those parts together, rather than treating the existence of individual controls as evidence of resilience.
03
Why this matters now
The UK incidents of 2025 showed how cyber disruption reaches physical operations. The NCSC Annual Review 2025 pointed to empty shelves and stalled production lines, and urged organisations to understand how they would keep operating if IT were unavailable.
Where industrial automation and control systems contribute to major accident risk reduction, HSE treats cyber security as part of the overall safety of plant (HSE OG86 and EC&I guidance). HSE has also signalled a growing role for ISA/IEC 62443 as a regulatory benchmark, alongside OG86.
IEC 62443 treats industrial cyber security as a shared responsibility across asset owners, service providers, system integrators and product suppliers, covering people, processes and technology.
Technical controls alone are not sufficient. The direction of travel is towards resilience that can be demonstrated through evidence, not assumed from the presence of controls.
04
What a structured approach actually looks like
Our methodology is built on the NCSC Cyber Assessment Framework (CAF): a nationally recognised structure for assessing cyber security outcomes across four objectives, managing risk, protecting against attack, detecting events, and minimising impact. Each objective is assessed through Contributing Outcomes and Indicators of Good Practice, giving a clear, repeatable picture of where you are and where gaps exist.
The CAF was originally developed for Operators of Essential Services, but its structure makes it equally valuable for any organisation that needs a rigorous, evidence-based approach to cyber security governance, including industrial operators without a formal regulatory mandate.
OpenPSM® breaks the CAF outcomes down into 358 OT-relevant Assessment Records, each with guidance on what to examine, what evidence to look for and how to judge it. You don’t need to assess them all at once: an assessment can cover the whole CAF, a single Principle or one Contributing Outcome, and coverage builds over time.
Setting the target
Rather than chasing a single score, each organisation sets a Corporate Target Profile: the CAF outcomes it requires now, based on regulation, risk, consequence and dependencies, and the outcomes it intends to reach later. Regulation sets the baseline; the organisation decides whether its risks require more. We define two target states, basic and enhanced:
05
Our five stage Maturity Model
- Initial: foundational governance and ownership are established
- Managed: a planned and controlled process is in place
- Defined: the capability is standardised and consistently embedded
- Learning: monitoring, review, testing or other assurance gives justified confidence that the capability is effective
- Optimising: learning is systematically used to strengthen the capability itself
Maturity is not a race to Level 5. Higher maturity is worth pursuing where it gives the confidence or resilience the organisation needs, not simply because a higher level exists.
Our methodology is designed for any organisation operating industrial OT where cyber compromise could cause physical, environmental or operational harm. The regulatory context varies. The challenge does not.
Our methodology is designed for any organisation operating industrial OT where cyber compromise could cause physical, environmental or operational harm. The regulatory context varies. The challenge does not.
Designed to be defensible in the most demanding regulatory environments, which means it more than meets the bar for any industrial operator.
06
The six-stage assessment process
Each assessment follows the same structured process, so results from different sites and different times can be brought together into one picture.
07
How OpenPSM® operationalises it
OpenPSM® is a governance and assurance platform that puts the methodology above into practice. Assessments are evidence based and repeatable. Actions are sequenced by risk, consequence and urgency. Progress is tracked against your target profile. Governance is maintained in a form that supports regulatory inspection, Board oversight and continual improvement.
- CAF-aligned assessments: 358 Assessment Records beneath the CAF outcomes, with OT specific guidance informed by HSE OG86 and IEC 62443
- Corporate Target Profile: the outcomes you require now, and where you intend to get to
- Outcome dashboards: which outcomes are demonstrated and where gaps remain, by Contributing Outcome, Principle, Objective and site. The counts show where to look; they are not a resilience score.
- Prioritised improvement planning
- Evidence referenced, not uploaded: your technical documentation stays in your own controlled environment
- Multi-site learning: recurring weaknesses and transferable strengths visible across sites
- Reporting for Boards, regulators and inspectors
OpenPSM® does not replace specialist technical verification such as penetration testing or architecture review. It helps you identify where that assurance is needed, understand the findings and act on them.
If you’re unsure whether your company can confidently demonstrate all the indicators of good hazard leadership, perhaps it’s time to find out more about OpenPSM®. Get in touch today. Call 0161 509 9392 or click the link below.