OT cybersecurity: 7 first actions to secure an industrial site

On an industrial site, cybersecurity cannot be handled like office IT: you do not reboot a running PLC to apply a patch, and an incident can have physical consequences. Here are the seven actions we recommend starting with, in the spirit of the IEC 62443 family of standards.

1. Inventory assets and flows

PLCs, HMIs, SCADA workstations, switches, gateways: you cannot protect what you do not know. The inventory can rely on passive network captures, without disturbing equipment.

2. List remote access paths

Forgotten 4G modems, remote-control software installed by a contractor, always-on VPNs: often the easiest way in. We cover it in a dedicated article.

3. Separate business IT from the industrial network

A clear IT/OT boundary, with an intermediate zone (industrial DMZ) for necessary exchanges, limits the spread of an incident that starts from email or an office workstation.

4. Define zones and conduits

IEC 62443-3-2 groups equipment into zones with the same security requirements and controls the conduits between them. It is the basis of segmentation that stays compatible with operations.

5. Control accounts and passwords

Shared accounts, default passwords, maintenance accounts never disabled: an account review is quick and highly effective.

6. Back up programs and configurations

PLC programs, SCADA projects, network device configurations: up-to-date, tested, offline backups sharply reduce downtime after an incident.

7. Monitor and prepare the response

A passive detection probe on the OT network and an incident procedure known to production and maintenance teams let you react fast, and meet the reporting obligations set by NIS2.

What next?

These actions give you a baseline. To know which to tackle first on your site and prepare for NIS2, an OT cybersecurity assessment builds a prioritised roadmap.