Arcturus Manufacturing: Cyber Risk Appetite Across IT and OT
Arcturus Manufacturing runs 14 plants. Operational technology on the plant floor is separated from corporate IT by a single firewall, and remote vendor access is permitted through a shared jump host with generic credentials. A contractor laptop was recently found attempting to spread ransomware; the plant's safety instrumented systems run unsupported operating systems and were isolated only by a manual network disconnection performed during the incident. No production stopped, but the near miss exposed that recovery procedures for OT are undocumented. Cyber insurance renewal has come in 40% higher, with a new condition requiring evidence of network segmentation within 12 months. Engineering has proposed a $9 million, three-year segmentation program. Plant managers say any downtime is unacceptable and want the work done during scheduled maintenance windows, which offer roughly six hours per plant per quarter. The board has no cyber risk appetite statement and wants one before approving the program.
1. Draft the core of a cyber risk appetite statement the board could adopt. Include at least one quantitative tolerance and explain how it would bind operating decisions.
Read the worked answer
Core statement: Arcturus accepts cyber risk only where it cannot cause loss of containment, safety-system failure, or more than a defined period of production loss across critical plants. Risk that could affect employee safety is not accepted at any level and must be treated or avoided.
Quantitative tolerances:
- No single cyber event may cause more than 24 hours of downtime at any safety-critical plant or more than $5 million in combined response and business interruption cost.
- All safety instrumented systems must be segmented from corporate and vendor networks by the end of the insurance condition period.
- Remote vendor access must be individually attributable, time-bound, and approved; zero shared generic credentials tolerated.
- Recovery time objective for critical OT: 12 hours, tested twice a year.
How it binds decisions: the 24-hour tolerance makes the current manual-disconnect recovery plan unacceptable, so segmentation and tested recovery become funded obligations rather than preferences. The 12-month insurance condition sets an external deadline; if the board cannot meet it, it must formally accept the insurance consequence. The zero-tolerance safety line means plant managers cannot veto segmentation of safety systems for convenience, though they can negotiate timing.
Write the statement with escalation rules and a review trigger, such as any near miss involving safety systems. An appetite statement without tolerances and consequences is a slogan.
2. The $9 million segmentation program cannot be funded in full this year. Prioritize what to do first and justify the sequence in risk terms.
Read the worked answer
Prioritize by threat path and consequence, not by plant order or by what is easiest to buy.
- Remove shared vendor credentials and implement individual, time-bound remote access. This is the path the near miss actually used. It is cheap relative to segmentation and reduces the most likely initial-access route. This is the project's correct first tranche.
- Segment safety instrumented systems from corporate and vendor networks. Unsupported operating systems plus shared access is the highest-consequence combination; this also addresses the insurance condition directly.
- Immutable, tested OT backups and a documented recovery sequence, because the previous manual disconnect proves recovery is improvised. Recovery capability reduces downtime even before full segmentation.
- Full IT/OT segmentation plant by plant, starting with the plants handling the most hazardous processes, using the six-hour quarterly windows for staged work.
- Detection and monitoring across the OT estate, since segmentation will take three years and threats will not wait.
Justification: this sequence buys down the most plausible path to the most severe outcome first, then reduces blast radius. Funding the full $9 million by cutting across all five workstreams would leave the vendor-access hole open longer. Revisit if a plant's maintenance windows cannot support staged work without extended shutdown.
3. What should the board be asked to accept as residual risk, and how should that acceptance be documented and revisited?
Read the worked answer
Name the residual scenarios explicitly. The board should be asked to accept, for a defined period: that some legacy OT remains unsegmented during the three-year program; that a determined attacker with vendor credentials could still reach one or more plant networks; that recovery at certain plants may exceed 12 hours until backups and runbooks are tested; and that the insurance premium and conditions reflect this.
Document it as a decision, not a briefing:
- A one-page risk acceptance record per scenario, stating likelihood, impact range, current controls, treatment in progress, residual rating, and the date by which treatment is expected.
- Named acceptor: the board risk committee, with the CEO and plant operations accountable for execution.
- Time limit: acceptance expires at the next insurance renewal or in 12 months, whichever is sooner, and must be renewed with evidence.
- Trigger review on any safety-system near miss, a failed recovery test, or a change in insurance terms.
Also document what is not accepted: safety-system compromise and shared generic credentials should remain outside appetite and be treated as must-fix items, even if the program slips. This distinction prevents the residual acceptance from becoming a blanket excuse for delay and gives the audit committee a way to test whether the board's stated appetite matches its funding decisions.