Cybersecurity · Industry · Energy
I work on cybersecurity governance and risk management where downtime means safety incidents and production losses.
Blog
Seventeen draft standards now show what a CRA claim will consist of. The manufacturer declares its own scope, some requirements are handed to your environment, and for operational technology no standard exists yet.
Blog
Business continuity plans and disaster recovery plans are not the same thing, and the interdependencies between business, IT and OT decide whether you pay for resilience up front or during the incident.
Blog
Faster patching is the wrong investment for most legacy OT, because the supplier controls the calendar and the plant operator controls the change window. The money goes into compensating controls and into procurement.
Blog
The system owner carries the security risk for the OT estate and mostly doesn't govern like it. The access restrictions were inherited from a build project where cybersecurity wasn't on the requirements list, and the aftermarket business model is what keeps them in place.
Portfolio
Seven interdependent capabilities for building an ISMS that drives security decisions rather than merely satisfying an audit.
Portfolio
A 7-article series on implementing systematic security documentation within ISMS frameworks, from foundational concepts to practical implementation templates.