Compliance Assessments / CDCAT

Achieve Excellence in cyber risk management

Grounded in comprehensive and contemporary evidence

Every organisation is at a unique stage in their Internet of Things (IoT) and Industrial Control System (ICS) cyber security maturity lifecycle. As adversaries grow more sophisticated, organisations must continually enhance their defensive strategies to stay ahead.

In an era of evolving threats and increasing risks, understanding and managing your organisation’s cyber defences is vital to safeguarding your operations.

The ability to respond with speed and agility is not just important—it’s essential.

ICS Cyber Security: A Lifecycle, Not Just a Project

Achieving a fully secure Industrial Control System (ICS) is a myth. Even after a clean bill of health from a cyber security assessment, hidden vulnerabilities may still exist. It may also be financially impossible to protect all ICS systems and a risk-based decision to accept some risk may be the way forward.

Cyber security must be regarded as an ongoing process, not a one-off project. While a security assessment provides a valuable snapshot in time, ICS environments require iterative testing to address triggers such as system changes or the passage of time.

Frequent reassessment is essential, as most ICS environments rely on commercial off-the-shelf hardware and software. These components are often subject to newly discovered vulnerabilities in operating systems or third-party software, exposing the ICS to emerging threats.

By embracing continuous improvement, organisations can better safeguard their ICS against evolving risks. Capula helps organisations deliver continuous improvement through the design and implementation of a Cyber Security Management System based on IEC 62443.

Board-Level Responsibility for Cyber Security

The ultimate responsibility for cyber security lies at the Board level. To effectively protect critical information assets, it is essential for businesses to have a clear, objective understanding of their potential vulnerabilities.

With this insight, organisations can develop and implement an evidence-based strategy that strengthens weak points, mitigates risks, and minimises the impact of security-related incidents. Proactive leadership at the Board level ensures cyber resilience becomes a core business priority.

33%

Nearly one-third of organisations experienced six or more cyber intrusions in 2023, compared to just 11% the year before.

60%

Ransomware attacks now account for over half of all reported OT intrusions, a significant rise from 32% in 2023.

75%

In most cases of cybersecurity incidents, both IT and OT systems were impacted

Cyber Resilience: The Key to Staying Ahead

Forward-thinking businesses are shifting from a passive stance to a proactive strategy to ensure robust cyber preparedness. By adopting a smarter, more agile approach, organisations can systematically collect critical data, enabling evidence-based investment decisions that are both effective and strategic.

More importantly, these decisions are prioritised with the speed and scale necessary to address evolving cyber threats, ensuring resilience and readiness in a rapidly changing landscape.

Cyber Resilience is best achieved by implementing a Cyber Security Management System (CSMS) based on IEC 62443. This requires a thorough understanding of the standard and a commitment to continuous improvement. It's a strategic investment that not only secures critical infrastructure but also supports business continuity, compliance, and safety.

Cyber Governance

Cyber governance is establishing and overseeing policies, procedures, and controls to manage cybersecurity risks within an organisation effectively. Two key frameworks that guide this governance are the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) 2.0 and the International Electrotechnical Commission's IEC 62443 series, especially the Cyber Security Management System (CSMS) outlined within it.

NIST Cybersecurity Framework (CSF) 2.0

Released in February 2024, NIST CSF 2.0 offers a structured approach to managing cybersecurity risks across various sectors. It introduces a new function called 'Govern,' highlighting cybersecurity governance's significance at the organisational level. This function integrates governance into all five core functions—Identify, Protect, Detect, Respond, and Recover—emphasising its foundational role. Additionally, it addresses privacy, cybersecurity, and digital supply chain challenges, incorporating these considerations into the broader context of enterprise risk management.

The 'Govern' function ensures that cybersecurity activities align with business objectives, regulatory requirements, and risk management strategies. This alignment facilitates effective communication of cybersecurity risks and practices to stakeholders, including boards and senior leadership, promoting transparency and informed decision-making.

IEC 62443 Cyber Security Management System (CSMS)

The IEC 62443 series offer comprehensive guidelines for securing Industrial Automation and Control Systems (IACS). Central to this series is establishing a Cyber Security Management System (CSMS), which provides a holistic approach to securing industrial control systems. The CSMS encompasses six main elements:

Initiating the CSMS Program: Securing management support to ensure adequate resources and commitment.
High-Level Risk Assessment: Identifying and prioritising risks to determine appropriate security levels and critical assets.
Detailed Risk Assessment: Conducting in-depth analyses to understand specific vulnerabilities and threats.
Establishing the CSMS: Developing policies, procedures, and controls tailored to the organisation's risk profile.
Implementing the CSMS: Deploying the established policies and controls across the organisation.
Monitoring and Improving the CSMS: Continuously assess the effectiveness of the CSMS and make necessary adjustments.

Implementing a CSMS aligned with IEC 62443 ensures industrial cybersecurity is integrated into the operational lifecycle, promoting resilience against cyber threats in industrial environments.

Integrating NIST CSF 2.0 and IEC 62443 CSMS

For organisations operating within industrial sectors, integrating the governance principles of NIST CSF 2.0 with the CSMS framework of IEC 62443 can enhance cybersecurity posture. NIST CSF 2.0's emphasis on governance complements the structured approach of IEC 62443, ensuring that cybersecurity measures are comprehensive and aligned with organisational objectives.

This integration facilitates a unified strategy that addresses IT and Operational Technology (OT) environments, promoting a cohesive defence against cyber threats. By aligning these frameworks, organisations can achieve a robust cyber governance structure that supports compliance, risk management, and operational resilience.

Network and Information Systems Regulations (NIS-R) Compliance

Cyber governance provides a structured framework for managing cybersecurity risks by aligning policies and procedures with regulatory requirements. In the context of the Network and Information Systems Regulations (NIS-R), effective cyber governance is crucial for achieving compliance through several key mechanisms.

Why Capula?

As threats targeting critical infrastructure increase, choosing the right advisor and technology partner to secure your systems has never been more crucial. OT and industrial security experts deliver our comprehensive portfolio of services & solutions with a demonstrable track record and over five decades of experience in developing and supporting Industrial Control Systems (ICS) for customers in security-critical sectors.W