Cybersecurity Management
This domain tests whether you can run an OT cybersecurity program: governance structure, roles, policy, budgets, metrics, third parties, and change control. Questions often ask what a lead manager should do first or how to report to executives.
Core rules
- Establish a documented program with named accountability: an OT security manager, asset owners, and a steering group that includes operations and engineering-not IT alone.
- Build a policy hierarchy: policy, standards, procedures, and work instructions. IEC 62443-2-1 provides a useful structure for an OT security management system.
- Fund from risk, not fear: prioritize controls that reduce the highest-scored risks and show cost against consequence.
- Report outcome metrics, not activity counts. Useful measures include percentage of critical OT assets with tested backups, mean time to apply approved patches, and remote-access sessions reviewed.
- Manage third parties with pre-qualification, contractual security requirements, controlled remote access, and offboarding.
- Route every OT change through change management with rollback plans and operations approval.
Worked example
The board asks for a one-page security scorecard. Instead of "attacks blocked," propose: 92% of critical PLCs have documented compensating controls where patching is unavailable; 78% of remote sessions were reviewed within 24 hours; 4 of 6 sites completed a recovery test. Reasoning: these measures show risk reduction and control effectiveness, which executives can act on; attack counts mostly reflect internet noise.
Traps that cost marks
- Assigning OT security solely to the IT department; operations must own plant risk.
- Measuring activity (training sessions held) rather than outcomes (phishing failures on OT accounts).
- Letting vendors bypass change control through "emergency" access.
Key points
- Name accountable OT security roles across IT, engineering, and operations.
- Use a policy hierarchy and IEC 62443-2-1 as a program structure.
- Prioritize and fund controls by risk score and consequence.
- Report outcome-based metrics to executives.
- Third-party access needs contracts, controls, and offboarding.
- Every OT change requires rollback planning and operations approval.