What is a Cybersecurity Risk Assessment?
A Cybersecurity Risk Assessment is the systematic identification, analysis and evaluation of cyber threats, vulnerabilities and their consequences for IT and OT environments, so that an organisation can decide which risks are acceptable and which require measures. In an industrial context it determines which digital risks could endanger the production process, physical safety or the environment. It is the cyber-specific form of the general risk assessment and the starting point of every security programme.
A risk assessment is indispensable for an effective cybersecurity strategy, in line with standards such as IEC 62443, ISO 27001 and the NIST CSF: without it, every security investment is a guess.
🧠 What does a cybersecurity risk assessment examine?
A cyber risk only exists when three things come together: a threat (an actor or event), a vulnerability that the threat can exploit, and a consequence that matters. The assessment maps these three for each system and weighs them against the controls already in place.
ISO 27005 (fourth edition, October 2022) distinguishes two ways of identifying risks:
- Asset-based - you start from the assets and look for threats and vulnerabilities per asset. Thorough, but laborious when there are thousands of components.
- Event-based - you start from risk sources and strategic scenarios, such as “ransomware halts batch production”. Faster and easier to discuss with management.
In OT, both are usually combined: scenarios for the overview, an asset inventory for the evidence.
🔧 How do you carry out a cybersecurity risk assessment step by step?
- Define the scope - which systems, networks and processes are included? Think of PLC, SCADA, HMI, Historian, Remote Access and the Engineering Station. Record the boundaries and every access point.
- Inventory assets and data flows - which components, firmware versions and connections exist? An up-to-date network diagram is essential.
- Identify threats - internal and external threats such as insiders, Phishing, Ransomware and human error. Threat Intelligence and MITRE ATT&CK for ICS make attack paths concrete.
- Identify vulnerabilities - for example a missing Firewall, legacy hardware, unpatched software, shared or weak passwords and unencrypted protocols.
- Determine impact - what happens if a vulnerability is exploited? Consider a production stoppage, environmental damage, a safety incident or reputational damage.
- Estimate likelihood - based on exposure, threat level, the knowledge an attacker needs and the existing security measures.
- Determine and evaluate the risk - impact × likelihood gives a score on a risk matrix or heatmap, which you compare with the tolerable risk.
- Recommend and record measures - technical (anomaly detection, Zero Trust, Access Control, encryption) and organisational (Security Awareness, an Incident Response Plan, patch management). Prioritise using Defense in Depth or the IEC 62443 security level, and record everything in a risk register.
Repeat the assessment after major changes, new threats or incidents, and periodically as well; once a year is common practice.
📊 How do you determine the risk score?
Many organisations use a 5 × 5 matrix in which impact and likelihood each receive a score from 1 to 5. The impact scale should be the same as the one used for process safety and corporate risk policy, so that a cyber risk can be compared with other risks. A simplified example for a production site:
| Scenario | Impact (1–5) | Likelihood (1–5) | Score | Decision |
|---|---|---|---|---|
| Ransomware from the office network reaches the SCADA server | 5 | 4 | 20 | Mitigate now: segmentation and backups |
| Supplier logs in through an unmonitored remote connection | 4 | 3 | 12 | Mitigate: jump server and MFA |
| PLC logic changed from the engineering station | 5 | 2 | 10 | Mitigate: access control and monitoring |
| Unauthorised reading of process data | 2 | 3 | 6 | Accept and record |
Two pitfalls are common. First, a CVSS base score is not a risk score: CVSS (version 4.0 since November 2023) describes the technical severity of a vulnerability, not the consequence in your plant. A vulnerability listed in the KEV catalogue of CISA does, however, raise the likelihood. Second, IEC 62443-3-2 first assesses the unmitigated risk, ignoring existing controls, and only then the residual risk. That keeps visible which control actually carries the risk.
🏭 How does an OT assessment differ from an IT assessment?
In IT, confidentiality usually comes first; in OT, safety and availability take priority. That changes both the impact scale and the way of working.
| OT-specific factor | Effect on the assessment |
|---|---|
| Legacy systems | Not designed with cybersecurity in mind; patching can take years |
| Real-time requirements | Not every security measure can be applied without affecting the process |
| Physical safety and environment | Cyber risks can lead to injury, explosions or emissions |
| Protocol diversity | Modbus, OPC UA and S7 each require their own evaluation |
| Fragile equipment | Active scanning can make PLCs hang; use passive monitoring and documentation |
| Long service life | Plants often run for twenty years or more on the same design |
Safety systems deserve particular attention. Since its 2016 edition, IEC 61511 (clause 8.2.4 of part 1) requires a security risk assessment of the SIS, referring to IEC 62443 and ISA TR84.00.09 for guidance. TRITON showed in 2017 that the threat is real, when attackers targeted the safety system of a petrochemical plant. A good habit is to reuse the HAZOP scenarios: which hazardous scenario could an attacker cause deliberately?
For the most critical functions, Cyber-Informed Engineering goes a step further. The CCE method from Idaho National Laboratory works in four phases (consequence prioritisation, system-of-systems analysis, consequence-based targeting, mitigations and protections) and starts from the worst consequence rather than from vulnerabilities.
OT risk assessments require close collaboration between security, operations, process safety and engineering.
🔐 Which methods and standards can you use?
| Standard or framework | Version | Role in the assessment |
|---|---|---|
| IEC 62443-3-2 | Edition 1.0, June 2020 | Security risk assessment for system design; yields an SL-T per zone and conduit |
| ISO 27005 | 2022 | Risk management for information security, aligned with ISO 27001 |
| NIST SP 800-30 | Rev. 1, September 2012 | Guide for Conducting Risk Assessments: prepare, conduct, communicate, maintain |
| NIST SP 800-82 | Rev. 3, September 2023 | OT-specific application of NIST risk management |
| NIST CSF | 2.0, February 2024 | Category ID.RA (Risk Assessment) within the Identify function |
| BIO | BIO2 | Dutch baseline for government bodies, linked to the duty of care |
| COBIT | 2019 | Governance framework that links IT risk to business goals |
IEC 62443-3-2 is written specifically for industrial automation: it partitions the system using the zones and conduits model and translates the risk per zone into technical requirements from IEC 62443-3-3. A business impact analysis provides the business consequences and recovery times beforehand.
⚖️ What does the law require of a risk assessment?
Since 15 August 2026, the Dutch Cybersecurity Act (Cyberbeveiligingswet), the national implementation of NIS2, has applied. Its duty of care requires essential and important entities to identify the risks to their network and information systems and to take appropriate measures. The Cybersecurity Decree explicitly asks for a risk analysis method and criteria for risk acceptance. NIS2 (Article 21) requires an all-hazards approach, so power outages and physical threats count too.
The management body approves the measures, oversees their implementation and must itself follow training to identify and assess cyber risks (NIS2 Article 20). The duty of care also covers SCADA systems and PLCs in critical processes. For Seveso (Brzo) sites, the assessment also touches safety management, see Seveso and Cybersecurity. A documented assessment according to IEC 62443-3-2 is a convincing way to show supervisors that OT measures are risk-based.
❓ Frequently asked questions
Is a cybersecurity risk assessment mandatory?
For organisations under the Dutch Cybersecurity Act, a cybersecurity risk assessment has effectively been mandatory since 15 August 2026, because the duty of care requires a risk analysis with a defined method and acceptance criteria. In addition, the IEC 61511 standard requires a security risk assessment of safety instrumented systems. For other companies it is not a legal obligation, but it underpins standards such as ISO 27001 and IEC 62443, and insurers often ask for it.
How long does a cybersecurity risk assessment for an OT plant take?
The duration of a cybersecurity risk assessment depends on the scope and the quality of the asset inventory. For a single production line or pumping station the work can often be done in a few weeks; a complete site with several zones usually takes a few months. Most of the time goes into the inventory and the multidisciplinary workshops.
Who should be involved in a cybersecurity risk assessment?
A cybersecurity risk assessment in OT needs at least OT engineering, operations, process safety and IT security, led by the owner of the plant. Suppliers and integrators contribute knowledge of components and remote access. Management sets the tolerable risk and accepts the residual risk.
What is the difference between a risk assessment and a penetration test?
A risk assessment determines which risks exist, how large they are and which measures take priority. A penetration test technically demonstrates whether a specific vulnerability can actually be exploited. In OT, a penetration test should preferably follow the assessment and take place in a test environment or during a shutdown.
How often should you repeat a cybersecurity risk assessment?
A cybersecurity risk assessment must stay current, but standards such as IEC 62443-3-2 do not prescribe a fixed interval. Common practice is an annual review plus a new assessment after major changes, new vulnerabilities or threats, and incidents. The risk register is the living document that ties these reviews together.
Can a cybersecurity risk assessment use an IT method?
A cybersecurity risk assessment for OT can use an IT method such as ISO 27005 or NIST SP 800-30, provided the impact scale includes safety, environment and production. IT methods often lack zone partitioning and the link with process safety, however. Many organisations therefore combine an ISO 27005 framework with IEC 62443-3-2 for the OT part.
📌 In summary
A Cybersecurity Risk Assessment maps threats, vulnerabilities and consequences, so that you focus security on the risks that really matter in your OT environment. With a defined method such as IEC 62443-3-2, an impact scale that weighs safety and production, and a living risk register, you justify investments and demonstrate compliance with the duty of care under the Dutch Cybersecurity Act.