Academy Program

GRC & Compliance for Critical Infrastructure

How to build a defensible risk program and map it correctly to IEC 62443, NIST CSF, ISO 27001/27005, and EN 50701 -- for people who own risk decisions, not just risk paperwork.

Risk owners, compliance leads, and GRC consultants 2 courses 8 lessons 48 minutes
Learning Path

Structured program journey.

Every program uses this fixed template so admin-created content appears as a polished, consistent Academy experience without editing code.

Risk Governance & Ownership Fundamentals

What cyber risk actually means for a critical infrastructure operator, how to register it defensibly, how to treat it, and how to make sure someone real owns it.

What Cyber Risk Really Means in Critical Infrastructure

Cyber risk in a critical infrastructure operator is not the same thing as cyber risk in a typical IT business, and treating it that way is the single most common mistake GRC teams make. In IT, the dominant concern is usually confidentiality: protecting data from being stolen or exposed. In a substation, a water treatment plant, a rail signaling system, or an airport baggage network, the dominant concern flips. Availability and integrity almost always outrank confidentiality, because the consequence of a successful attack is not a data breach notice -- it is a train that cannot safely stop, a pump that will not shut off, or a control room that loses visibility into what the plant is actually doing. A useful working definition: cyber risk is the combination of a credible threat, an exploitable weakness, and a consequence that matters to the business or to public safety. All three parts have to be present. A theoretical vulnerability with no realistic threat actor and no operational consequence is not a risk worth spending your organization's limited attention on -- it is noise. Good risk programs spend their effort filtering signal from noise, not cataloguing every possible weakness with equal urgency. This is also why risk in OT environments has to be engineered, not guessed. You cannot reason about consequence without understanding the physical process behind the system: what happens if this PLC receives a bad command, what happens if this HMI loses its feed, what happens if this remote access path is abused at 3am on a weekend. Risk assessment that is disconnected from the actual engineering reality of the facility produces a document, not a defensible risk position.

6 min Not started
Open

Building a Defensible Risk Register

A risk register that cannot survive being questioned by an auditor, a board member, or an insurer is not actually doing its job. Defensibility comes from structure, evidence, and traceability -- not from the length of the spreadsheet. Every entry in a defensible register should be traceable back to something real: a specific asset or system, a specific threat scenario, and a specific set of existing controls. Vague entries like "cyber attack on the network" are not risks -- they are categories. A real entry looks more like: "Unauthorized remote access to the RTU network via a vendor VPN with no MFA, leading to manipulation of breaker control commands." That level of specificity is what lets you actually score likelihood and impact meaningfully, and it is what lets an auditor verify your reasoning instead of just trusting your color-coded heat map. A defensible register also separates inherent risk (before controls) from residual risk (after controls), and records the evidence for why a control is believed to be effective -- not just that it exists on paper. A firewall rule that has never been tested is not the same thing as a validated segmentation boundary, and your register should be honest about that difference. Finally, every risk needs an owner who is a named person, not a department. "IT" does not own a risk. A named engineering manager, plant operations lead, or CISO owns it, and that person is accountable for the treatment decision and its timeline. Registers that assign ownership to departments instead of people are one of the most common reasons risk treatment stalls -- accountability diffuses until nobody actually acts.

6 min Not started
Open

Risk Treatment: Mitigate, Transfer, Accept, Avoid

Identifying a risk is only half the job. Every risk in a mature program eventually needs a treatment decision, and there are really only four honest options: mitigate it, transfer it, accept it, or avoid it. Programs that only ever choose "mitigate" usually end up with a backlog of controls that never gets finished, because not every risk deserves the same level of investment. Mitigation means reducing likelihood or impact through a control -- network segmentation, monitoring, hardened configuration, MFA on remote access, and so on. This is the default instinct for most engineers, but it is not always the right call, especially when the cost of the control exceeds the realistic cost of the risk it is reducing. Transfer means shifting the financial consequence elsewhere, most commonly through cyber insurance or contractual liability with a vendor or integrator. Transfer does not reduce the likelihood of an incident and it rarely helps with safety or availability consequences, which is exactly why it is a poor primary strategy for OT risk and a reasonable secondary strategy for residual financial exposure. Accept means a named, authorized owner formally decides the risk is within tolerance and signs off on leaving it as-is -- ideally with a documented rationale and a review date. Acceptance without a named owner and a documented rationale is not risk management, it is just risk ignoring. Avoid means removing the risk entirely by not doing the thing that creates it -- decommissioning an unnecessary remote access path, retiring an unsupported legacy system, or redesigning a process so the exposure no longer exists. Avoidance is often the cheapest long-term option and the most underused, because it requires operational change rather than a technical purchase.

6 min Not started
Open

Assigning Ownership and Reporting Risk to Leadership

A risk program only works if leadership can act on what it is told, and most leadership reporting fails because it reports the wrong altitude of information. Boards and executives do not need a list of CVEs -- they need to know what could stop the business from operating, what it would cost, and what decision is being asked of them. Good executive risk reporting answers four questions clearly: What is the top exposure right now and why. What has changed since the last report. What is the plan and the cost to close the gap. And what decision, if any, is being requested -- budget approval, risk acceptance sign-off, or awareness of an accepted risk that leadership should know about even if no action is needed today. Ownership has to be explicit and personal, not organizational. When a risk is assigned to 'IT Department' instead of a named individual, there is no one whose performance review depends on closing it, and it will sit untreated indefinitely. Each risk owner should know three things about their assignment: what they are accountable for, by when, and who they escalate to if they are blocked. Finally, risk reporting cadence should match risk volatility, not a fixed calendar. A stable, well-controlled environment might reasonably report quarterly. A facility mid-way through a network re-architecture, an active vendor onboarding, or recovering from an incident needs tighter reporting -- because that is exactly when new exposure is most likely to appear and go unnoticed until the next scheduled report.

6 min Not started
Open

Standards & Compliance Mapping

A practitioner's map of IEC 62443, NIST CSF 2.0, ISO 27001/27005, and EN 50701 -- what each one is actually for, and how they work together instead of competing.

IEC 62443 in Practice: Zones, Conduits, and Security Levels

IEC 62443 is the standard most directly built for industrial automation and control systems, and its core idea is deceptively simple: you cannot secure a flat network, so you divide the environment into zones, control what crosses between them through conduits, and assign each zone a security level that matches how much protection it actually needs. A zone is a grouping of assets that share the same security requirements -- for example, the safety instrumented system, the basic process control system, and the corporate IT network are usually different zones because they have very different consequence profiles if compromised. A conduit is the communication path between zones, and every conduit should have a defined, restricted purpose -- not just 'the firewall between OT and IT' as a single undifferentiated boundary. Security Levels (SL) run from SL-0 to SL-4 and describe the sophistication of adversary a zone is expected to resist, from no protection required up to protection against well-resourced, highly motivated attackers with extended resources. The standard distinguishes SL-T (Target -- what you decided the zone needs) from SL-A (Achieved -- what your current controls actually deliver). The gap between SL-T and SL-A is, in effect, your risk treatment backlog for that zone, expressed in the standard's own language. In practice, this framework matters because it gives you a defensible way to say why a safety-critical zone gets more investment than a non-critical monitoring segment, instead of applying the same controls everywhere and running out of budget before you reach the parts that matter most.

6 min Not started
Open

NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover

NIST CSF is not a control checklist, and treating it like one misses most of its value. It is a governance and maturity language that lets very different teams -- engineering, IT, legal, executive leadership -- talk about the same cybersecurity program using a shared vocabulary. Version 2.0 added Govern as an explicit function sitting above the original five (Identify, Protect, Detect, Respond, Recover), reflecting a hard-won lesson from a decade of incidents: programs that had good technical controls but no real governance -- no clear roles, no risk appetite statement, no supply chain oversight -- still failed. Govern covers organizational context, risk management strategy, roles and responsibilities, policy, and oversight of third-party and supply chain risk. Identify is about knowing what you have and what matters -- asset inventories, business context, and risk assessment. Protect is the safeguards that limit or contain a potential incident. Detect is your ability to notice that something is happening. Respond is your capability to act once you know. Recover is your ability to restore normal operations and capture lessons learned. For a critical infrastructure operator, the practical value of CSF is as a maturity lens: it lets you say, honestly, "we are strong in Protect but weak in Detect," and prioritize investment accordingly, rather than spreading effort evenly across a function list without ever asking which function is actually the current bottleneck.

6 min Not started
Open

ISO 27001 and ISO 27005: Management Systems and Risk Methodology

ISO 27001 and ISO 27005 are often confused for the same thing, but they answer different questions. ISO 27001 is a management system standard: it defines how an organization runs its information security program -- policies, roles, internal audits, management review, and continual improvement -- and it is the standard an organization gets certified against. ISO 27005 is a risk management methodology standard: it explains how to actually identify, analyze, evaluate, and treat information security risk, and it is meant to be used inside the management system that 27001 describes. In other words, 27001 is the skeleton -- the accountable structure that proves a real management system exists and is maintained -- and 27005 is one credible way to do the risk muscle work inside that skeleton. An organization can be excellent at technical controls and still fail a 27001 audit because the management system itself -- documented risk acceptance criteria, management review records, internal audit evidence -- is missing or inconsistent. For a critical infrastructure operator, 27001/27005 pair well with IEC 62443: 62443 tells you how to structure the technical architecture of an OT environment, while 27001 tells you how to run the governance system that makes sure those technical decisions are documented, reviewed, and kept current instead of becoming a one-time project that quietly goes stale. A common practical mistake is treating ISO 27001 as a one-off certification event rather than a living management system. Auditors specifically look for evidence of continual improvement -- management review minutes, updated risk assessments, corrective action tracking -- not just a policy binder that was written once and never touched again.

6 min Not started
Open

EN 50701: Cybersecurity for the Railway Sector

EN 50701 is the dedicated European standard for cybersecurity in the railway sector, and it exists because railway systems have characteristics that generic IT or even generic OT standards do not fully capture: long asset lifecycles that can exceed thirty years, safety certification requirements (SIL) that interact directly with cybersecurity decisions, and a mix of signaling, rolling stock, and trackside systems that were rarely designed with networked cybersecurity threats in mind. The standard borrows heavily from IEC 62443's zone and conduit model but adapts it for the railway domain, requiring cybersecurity risk assessment to be integrated with the existing railway safety assurance process (RAMS -- Reliability, Availability, Maintainability, Safety) rather than run as a separate, disconnected workstream. This matters in practice: a cybersecurity control that degrades signaling availability or interferes with a safety function is not an acceptable trade-off just because it improves a security metric. EN 50701 also puts significant weight on the security of the supply chain and on lifecycle management -- vendors of signaling and rolling stock equipment are expected to provide security documentation, vulnerability disclosure processes, and support commitments that typical thirty-year rail asset lifecycles demand and that many IT-oriented vendors are not used to providing. For an operator or consultancy working in rail, EN 50701 should be read as the sector-specific translation layer that makes IEC 62443's general industrial logic usable in a railway safety context -- not a replacement for 62443, but the standard that tells you how to apply it correctly when trains, signaling, and passenger safety are involved.

6 min Not started
Open