A nine-month 'compliance' deadline across three plants
A contract manufacturer with three plants in two countries has committed to an IoT security programme after a customer audit. Asset records are unreliable: the CMDB lists 22,000 'connected devices', while the OT team estimates 31,000, including 6,000 sensors on a 2016 line, 900 IP cameras and 240 cellular routers installed by a systems integrator. Ownership is fragmented: IT owns the network, facilities own the cameras, operations own the line equipment, and the integrator still holds the cellular SIM accounts. The first-year budget is EUR 600,000. The customer contract requires demonstrable controls within nine months or the contract is at risk, and the steering committee has asked for a plan that is 'ISO/IEC 27400 compliant' by month nine. A previous attempt failed when a discovery tool was deployed without OT change approval and disrupted a production line for four hours.
1. How do you respond to the 'compliant by month nine' expectation and structure the programme?
Read the worked answer
Correct the framing first, without dismissing the deadline. ISO/IEC 27400 is guidance, not a certifiable management system; there is no certificate of compliance to hand the customer. What can be delivered in nine months is a governed, risk-based programme with measurable outcomes and an auditable decision trail mapped to the standard's control areas.
Redefine success with the steering committee: a scope statement; a reconciled asset inventory with owners; a risk assessment against agreed criteria; treatment plans for the highest-consequence risks; verified baseline controls on critical lines; an incident path; and a roadmap for the rest. That is what an auditor or customer can actually examine.
Programme structure: executive sponsor, programme manager, and workstreams for governance and policy, discovery and inventory, risk assessment, architecture and segmentation, identity and access, monitoring and incident response, supplier management, and awareness. Align with the existing ISO/IEC 27001 management system where one exists rather than building a parallel structure.
Phasing: months 0-2 discovery, ownership, risk criteria and an OT-safe deployment procedure; months 3-5 segmentation of critical lines, remote-access control, baseline hardening; months 6-9 monitoring, playbooks, supplier contract amendments, internal review and evidence pack. Tell the customer this roadmap explicitly - a credible plan with milestones is stronger than a claim of full coverage that collapses at the first audit.
2. What are the first 90-day priorities, and what is the reasoning behind that order?
Read the worked answer
1. Discovery and ownership. You cannot assess or protect devices you cannot see, and 9,000 devices are unaccounted for. Use passive discovery approved by OT, deployed in a change window with a rollback plan and a production-safe configuration - the previous four-hour outage means credibility depends on this. Reconcile observed traffic against the CMDB and list externally reachable devices.
2. Fix accountability. Publish a RACI covering IT, facilities, operations and the integrator. Transfer the cellular SIM accounts from the integrator to the company, and amend the contract to require asset data, notification duties and cooperation. Unowned devices are the single largest driver of unmanaged risk.
3. Risk criteria and a lightweight register. Define appetite and assessment criteria up front, weighted toward safety and production availability first, then confidentiality. Without criteria, every debate becomes political.
4. Quick containment. Internet-facing devices, default credentials, flat VLANs carrying both office and line traffic, and unmanaged remote access. These are cheap and high-yield.
5. Incident path. Who to call, how to isolate an OT segment without stopping a line, and who may authorise it.
The order is dependency-driven: risk assessment needs inventory, segmentation needs traffic knowledge, monitoring needs choke points, and OT cooperation needs proof that change control is respected.
3. How do you allocate the EUR 600,000 first-year budget, and what do you deliberately not buy?
Read the worked answer
Avoid platform-first purchasing. A large IoT platform bought before inventory exists tends to license devices you cannot yet identify and requires operating capacity you have not built.
Indicative allocation: 15-20% discovery, inventory and asset management; 25-30% network segmentation and remote-access control, because these give the highest risk reduction per euro against the most plausible attack paths; 10-15% monitoring and detection; 10% governance, policy and training; 10% supplier and integrator remediation; 10-15% contingency plus internal audit or assessment support.
Deliberately defer: enterprise-wide IoT platforms, per-device agents on legacy sensors that cannot support them, and wholesale replacement of functioning equipment unless a specific risk justifies it. Also defer anything whose recurring cost or staffing need is unfunded in year two - a tool without operators becomes shelfware and a visible failure.
Show the trade-offs. Present each line against a risk scenario and expected risk reduction, with options: for example, segment two critical lines fully versus apply a lighter control to all three plants. Let the steering committee choose with eyes open. Reserve contingency explicitly for OT change windows and unplanned remediation, since the previous discovery incident shows that operational disruption, not licences, is the likely cost overrun.