What is cybersecurity?
Cybersecurity is the collection of technologies, processes and measures that protects systems, networks, software and data against digital attacks, misuse and disruption. Its goal is to safeguard the confidentiality, integrity and availability of information, together known as the CIA triad. Cybersecurity is essential for both IT systems and OT environments: in a factory, water treatment plant or power grid, a cyberattack can affect not only data but also the physical process and the safety of people.
🎯 Why is cybersecurity important?
- Protects business continuity - a successful attack can halt production for days or weeks, so cybersecurity is a precondition for business continuity
- Prevents data breaches and production downtime - from stolen customer data to encrypted operator stations
- Ensures compliance with laws and standards - such as NIS2, the Dutch Cyberbeveiligingswet, ISO 27001 and the BIO for Dutch government bodies
- Builds customer trust and market reputation - customers and regulators increasingly ask for demonstrable security across the supply chain
In practice, cybersecurity is not an IT project but a continuous discipline of risk management: threats change, systems change, and the measures have to keep pace.
🧱 What are the components of cybersecurity?
Cybersecurity only works when technical, organisational, physical and human measures complement each other:
| Domain | Examples |
|---|---|
| Technical | Firewall, SIEM, EDR, Zero Trust, IDS, VPN, Air gap, Jump Server |
| Organisational | Policy, Risk Management, ISMS, Change Management, IAM, Incident Response |
| Physical | Secure server rooms and control cabinets, access control, locked network ports |
| Human | Security Awareness training, phishing simulations, clear roles and responsibilities |
What you protect differs per environment:
- IT systems (servers, workstations, networks, cloud environments)
- OT environments (production lines, PLCs, SCADA, DCS and safety systems such as an SIS)
- Data (customer information, product recipes, configuration files and PLC programs)
- Processes (production continuity, safety, Compliance)
🔄 How does cybersecurity in OT differ from IT?
In IT, confidentiality usually comes first: the biggest risk is data leaking out. In OT the order is reversed. Safety and availability come first, then integrity (are the measured value and the command correct?) and confidentiality last. A process that stops, or a setpoint that is manipulated, can damage equipment, harm the environment or injure people.
| Aspect | IT | OT |
|---|---|---|
| Priority | Confidentiality, integrity, availability | Safety and availability, integrity, confidentiality |
| System lifetime | 3–5 years | 15–25 years or longer |
| Patching | Monthly, often automatic | Only during planned shutdowns, after testing with the vendor |
| Impact of an incident | Data breach, financial loss | Production downtime, physical damage, danger to people |
| Typical measure | Endpoint agent, MFA, cloud security | Network segmentation, passive monitoring, scheduled patch management |
That is why you cannot apply IT measures to OT one-to-one. An active network scan can make an old PLC hang. OT convergence therefore calls for a shared approach that respects the differences.
🚨 What are the main threats?
- Ransomware - encrypts systems and demands a ransom; often hits OT indirectly, because the IT systems that production depends on go down
- State actors and APT groups - persistent, well funded and sometimes focused on sabotage or preparing for it, such as Volt Typhoon in US critical infrastructure
- Insiders - employees or former employees who cause damage deliberately or by accident
- Supply chain attacks - via suppliers, software updates or maintenance connections; see supply chain risk
- Phishing and Social Engineering - still one of the most common first steps to steal credentials
- DDoS attacks - overloading websites and services
- Exploits of vulnerabilities (CVE) and unauthorised access through weak passwords or misconfiguration
🏭 Which well-known OT incidents have occurred?
| Year | Incident | What happened? |
|---|---|---|
| 2010 | Stuxnet | Sabotaged uranium enrichment centrifuges at Natanz (Iran) via manipulated Siemens PLCs |
| 2015 | BlackEnergy | Outage of several hours for around 225,000 customers of three Ukrainian distribution companies, after attackers took over SCADA workstations remotely |
| 2016 | Industroyer | First known malware built specifically for power grids, speaking protocols such as IEC 60870-5-104 directly; roughly one-hour outage in Kyiv |
| 2017 | TRITON | Attack on a Triconex safety system at a Saudi petrochemical plant |
| 2017 | NotPetya | Wiper spread via Ukrainian accounting software; Maersk estimated its losses at up to 300 million dollars |
| 2021 | Colonial Pipeline | Ransomware via a legacy VPN account without MFA; the largest US fuel pipeline was shut down for five days |
| 2024 | FrostyGoop | Modbus commands cut heating to 600 apartment buildings in Lviv |
You will find more background under cyber incidents.
📏 Which standards and frameworks do you use?
- NIST CSF 2.0 - since February 2024 with six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new and covers leadership, roles and supply chain risk.
- ISO 27001:2022 - the standard for an ISMS, with 93 controls in Annex A grouped into organisational, people, physical and technological themes. Certificates against the 2013 edition have no longer been valid since 31 October 2025.
- IEC 62443 - the series of standards for industrial automation, with zones and conduits and four security levels: SL 1 against casual errors up to SL 4 against well-resourced state attackers.
- NIST SP 800-82 - US guidance on OT security, widely used as a practical complement.
ISO 27001 often provides the management framework for the whole organisation, while IEC 62443 provides the technical detail for the plant.
🇪🇺 Which legislation applies in the Netherlands and the EU?
| Law | Applies to | Key dates |
|---|---|---|
| NIS2 / Cyberbeveiligingswet | Essential and important entities in sectors including energy, water, transport, healthcare and manufacturing | In force in the Netherlands since 15 August 2026; incident reporting at 24 hours / 72 hours / 1 month |
| Cyber Resilience Act | Manufacturers of products with digital elements, such as PLCs and switches | Reporting obligations from 11 September 2026; fully applicable from 11 December 2027 |
| Machinery Regulation | Machine manufacturers | Replaces the Machinery Directive on 20 January 2027; protection against corruption becomes a safety requirement |
The Dutch Cyberbeveiligingswet replaces the 2018 Network and Information Systems Security Act (Wbni) and covers more than 8,000 organisations in 18 sectors, compared with a much smaller group of critical providers under the Wbni. The NCSC keeps the register, and management bodies are personally accountable for the duty of care. Fines reach up to 10 million euros or 2% of worldwide annual turnover for essential entities, and up to 7 million euros or 1.4% for important entities.
🧭 How does an organisation build cybersecurity step by step?
A maturity model helps you see where you stand. A practical sequence for a manufacturing company:
- Map your assets - an up-to-date asset inventory of IT and OT systems, including firmware versions
- Carry out a risk assessment - which processes are critical and what is the impact of an outage? IEC 62443-3-2 offers a method
- Segment the network - separate office and production with a DMZ in line with the Purdue Model and Defense in Depth
- Secure access - MFA on all remote access, a jump server for suppliers and least privilege
- Detect and respond - passive OT monitoring, central logging in a SIEM and a rehearsed incident response plan
- Recover and practise - offline backups of PLC programs and configurations, and regular crisis exercises
👥 Who is responsible for cybersecurity?
- Management board - ultimately accountable and, under NIS2, required to approve measures and follow training
- CISO - sets policy, reports on risk and coordinates IT and OT security
- SOC - monitors alerts, often 24/7, and investigates incidents; an OT SOC understands industrial protocols and processes
- OT engineers and process owners - know the installation and judge whether a measure affects the process
- Suppliers - must meet security requirements through contracts and IEC 62443-2-4
🧩 What is the difference between cybersecurity and information security?
| Cybersecurity | Information security |
|---|---|
| Focuses on digital threats against systems and networks | Broader: also covers paper information, physical and administrative aspects |
| More technical in nature | Often policy- and process-driven |
| Embedded in an ISMS as part of the whole | Governed through an ISMS in line with ISO 27001 |
❓ Frequently asked questions
What does the CIA triad mean in cybersecurity?
The CIA triad stands for confidentiality, integrity and availability. Every cybersecurity measure contributes to at least one of these three goals. In OT the order is often reversed, because availability and safety weigh more heavily than confidentiality.
Is cybersecurity mandatory for my organisation?
For organisations covered by the Dutch Cyberbeveiligingswet, cybersecurity has been a legal duty of care with reporting and registration obligations since 15 August 2026. Whether your organisation is covered depends on sector and size; medium-sized and large companies in sectors such as energy, water, food and manufacturing are often in scope. Organisations outside the law also face requirements from customers and insurers.
What is the difference between IT security and OT security?
IT security mainly protects data and office systems, with confidentiality as the top priority. OT security protects control systems that drive physical processes, where safety and availability carry the most weight. OT systems often run for decades and cannot simply be patched or scanned.
Which standard should I choose: ISO 27001 or IEC 62443?
ISO 27001 is the certifiable management system standard for information security across the whole organisation. IEC 62443 was written specifically for industrial automation and sets requirements for asset owners, integrators and suppliers. Many industrial companies combine both: ISO 27001 as the framework and IEC 62443 for the OT environment.
Why is ransomware so dangerous for manufacturing companies?
Ransomware encrypts the systems that planning, recipes and logistics depend on, so production can stop even when OT itself is not hit. The Colonial Pipeline case shows that companies shut down operations as a precaution. Separated networks and offline backups limit the damage.
What does a CISO do?
A CISO (Chief Information Security Officer) is responsible for cybersecurity policy and reports on risk to the board. The CISO coordinates measures, incident response and compliance with laws such as NIS2. In industrial companies, OT security increasingly falls under the CISO as well.
📌 In summary
Cybersecurity protects systems, networks and data against attacks, errors and misuse by safeguarding confidentiality, integrity and availability, and in OT above all the safety and continuity of physical processes. It requires a combination of technology, policy and behaviour, underpinned by frameworks such as NIST CSF, ISO 27001 and IEC 62443, and since 15 August 2026 a legal obligation for more than 8,000 Dutch organisations under the Cyberbeveiligingswet.