Recalibrating a Cyber Risk Register and a Legacy OT Plant
Northline Chemicals operates 12 plants and $4.8B in revenue. Its ERM register has 340 cyber entries, and 68% are rated high or critical on a 5x5 heat map, so the board has stopped trusting the ratings. Cyber insurance renewal rose 38%, and the carrier now asks for evidence that OT is segmented from IT. Plant 7 runs a legacy SCADA system on Windows Server 2008 in a flat network; a vendor shared administrator account is used for remote support. The plant manager says an unplanned outage costs $180,000 per hour and refuses a 36-hour segmentation window during peak season. Corporate risk appetite says the company will not accept unacceptable safety or environmental risk and will tolerate moderate cyber risk where controls are measurable. A safety instrumented system shares the same network segment.
1. How should the CISO and ERM lead recalibrate the register and present top risks to the board?
Read the worked answer
Treat the 340-entry register as a data-quality problem first. Consolidate duplicate assets and scenarios, separate inherent and residual risk, and replace subjective 5x5 labels with calibrated ranges: likelihood per year, financial loss, safety and environmental consequence, and regulatory impact. Use a consistent scenario taxonomy, such as crown-jewel service, threat, and control gap, and require evidence for each high rating. Then aggregate by business service and dependency, not by tool. Present the board with the top 8 to 10 risks in business language: expected annual loss range, potential safety event, insurance and regulatory exposure, and treatment owner. Show why the count fell and what is still above appetite. This restores credibility because the board can see movement, compare risks, and challenge assumptions rather than debate a heat-map color.
2. Recommend a treatment path for Plant 7 and justify it against the plant manager's outage constraint.
Read the worked answer
Do not accept no outage as a reason to leave a flat network. Treat the safety instrumented system sharing the segment as an immediate safety issue. Short term, isolate vendor access behind a jump host with MFA and session recording, remove the shared administrator account, add passive OT monitoring, and apply virtual patching and firewall ACLs. These are compensating controls, not a substitute for segmentation. Plan segmentation in a phased cutover during a scheduled maintenance window, with a safety case and rollback. Quantify the $180,000 hourly outage cost against expected loss and safety risk; a planned window may cost less than a single incident. If the plant manager still refuses, escalate as a documented risk acceptance to the executive risk committee, with the safety exception explicit.
3. Define KRIs the board can use to track OT risk at Plant 7 and across the estate.
Read the worked answer
Use KRIs that show exposure and control drift: percentage of OT assets with unsupported operating systems in a segmented zone; percentage of vendor remote sessions with MFA and recording; number of critical OT assets with direct internet or flat-network paths; mean time to deploy a virtual patch; and count of risk acceptances past expiration. Add one safety-specific indicator: unresolved safety instrumented system isolation findings. Review monthly with the plant manager and quarterly with the board. Pair each indicator with a threshold and an owner so the board sees when a metric crosses appetite, not just a trend line. This makes the metrics actionable and ties them to the insurance carrier evidence request.