OT/IT Risk Appetite in a Global Manufacturer
A discrete manufacturer operates 22 plants across three regions, with 9,000 IT endpoints and 1,200 OT devices on flat plant networks. Safety systems share network segments with production scheduling. The risk register contains 380 high-severity findings, but the remediation team has six full-time engineers and cannot patch OT devices without production shutdowns. A ransomware incident last year stopped two lines for five days and cost $4.2M in downtime and recovery. The board has asked for a risk appetite statement, a defensible prioritization method, and a set of board-level indicators. The plant managers are measured on uptime, not security, and have rejected two previous patching plans. The CISO has a 12-month budget of $2.8M and a mandate to reduce the top risks without stopping production.
1. Draft a risk appetite and tolerance approach that the board can approve. Explain how it handles safety, uptime, financial loss, and regulatory exposure.
Read the worked answer
Express appetite in business outcomes, not tool counts. A workable statement: zero tolerance for safety incidents caused by cyber compromise; limited tolerance for production interruption, capped at a defined annualized loss and a maximum acceptable downtime per event; moderate tolerance for regulatory findings where remediation is funded and tracked; low tolerance for loss of intellectual property in design systems.
Translate appetite into tolerances the plant can act on. Use a quantified method such as FAIR to estimate annualized loss exposure for the top scenarios: ransomware on scheduling, compromise of an engineering workstation, and safety-system tampering. Set a threshold, for example no single risk above $3M annualized loss without board visibility, and no safety scenario accepted without engineering sign-off.
Tier assets by safety impact, production criticality, and network reachability. Risk acceptance becomes a formal decision with a named owner, compensating controls, and an expiry date. Plant managers should co-own the residual risk, which aligns their uptime incentive with security rather than setting up a veto.
The board approves appetite and tolerances, not the 380 findings. The CISO reports exposures against those tolerances, including exceptions that exceed them.
2. Prioritize the 380 high findings given six engineers and no shutdown windows. Show a defensible method and name the compensating controls you would use.
Read the worked answer
Score each finding on asset criticality, exposure, threat likelihood, and existing compensating controls. Do not rank by scanner severity alone. A high-severity finding on an isolated test workstation is not equivalent to a medium finding on a safety controller reachable from the corporate network.
Group findings into a small number of risk scenarios, then fix the paths that enable the worst outcomes. Expect roughly 20% of findings to account for most of the material risk. Sequence: first, remove bidirectional IT-to-OT paths and segment safety zones; second, secure remote access and vendor connections with MFA and jump hosts; third, gain passive visibility on OT networks; fourth, address internet-facing IT assets and identity weaknesses used for lateral movement.
Where patching is impossible, use compensating controls: IEC 62443 zones and conduits, unidirectional gateways, application allow-listing on engineering workstations, network monitoring, and controlled USB processes. For Windows OT systems, use vendor-approved patch windows during planned maintenance, not ad hoc shutdowns.
Fund a small OT engineering capability rather than adding generic analysts. Publish a risk burn-down by scenario, not a raw finding count. Any accepted risk above tolerance goes to the board with a costed remediation option.
3. Define four to six board-level indicators that would show whether risk is actually falling, and explain how to avoid gaming.
Read the worked answer
Use a balanced set: percentage of safety-critical zones segmented from IT and internet paths; percentage of OT devices with passive monitoring and known asset identity; mean time to remediate critical internet-facing IT findings; number of open risk acceptances above tolerance and their age; percentage of privileged and remote access paths with phishing-resistant MFA; and tested recovery time for the top two production scenarios.
Avoid indicators that reward volume alone, such as number of patches applied or alerts closed. They invite gaming and do not show outcome. Pair every activity metric with an outcome metric: patching activity with exposure reduction, monitoring coverage with detection time on a tested scenario.
Validate metrics with independent samples and tabletop exercises. If segmentation coverage is 90% but a tabletop shows a reachable path from email to a safety controller, the indicator is wrong. Report trends over at least two quarters, with definitions and data sources agreed in advance. The board should see exceptions and decisions required, not a dashboard of green tiles.