What is a cybersecurity strategy?
A cybersecurity strategy is a planned, organisation-wide approach spanning several years that sets out how an organisation manages its digital risks, which goals it pursues and which technical, organisational and human measures it uses to get there. In an industrial context (OT), the strategy focuses on protecting the production, safety and availability of installations against cyber threats. A good strategy is aligned with risks, business goals and compliance requirements, and translates them into a concrete programme with priorities, budget and owners.
Since the Dutch Cybersecurity Act (Cyberbeveiligingswet) came into force on 15 August 2026, such a strategy is no longer optional for more than 8,000 Dutch organisations: the management body must approve the security measures and oversee their implementation. The same principle applies across the EU under NIS2.
🧠 What does a cybersecurity strategy contain?
A complete strategy has seven building blocks:
- Vision and policy - goals, principles and responsibilities, aligned with the existing security policy, the information security policy and risk management.
- Risk-based approach - priorities based on a cybersecurity risk assessment and a business impact analysis, weighted by impact on production, safety and compliance.
- Technical measures - firewalls, network segmentation, access control, patch management and a SIEM; specific to OT, also anomaly detection, an industrial firewall, protocol filtering and target security levels per zone.
- Organisational measures - roles such as the CISO (strategic), the Information Security Officer (tactical) and the Operational Security Officer (operational), plus processes for incident management, change management, audits and monitoring.
- Human element - security awareness training, codes of conduct and an open reporting culture, also to counter insider threats, human error and social engineering.
- Compliance and standardisation - alignment with IEC 62443 for OT cybersecurity, ISO 27001 for information security and laws and regulations such as NIS2 and the Dutch government baseline BIO.
- Continuous improvement - periodic review through the PDCA cycle, feeding lessons from incidents, audits and exercises back into the strategy.
🔄 What is the difference between strategy, policy and programme?
The terms are often used interchangeably, but each has its own level and time horizon:
| Level | Question | Typical horizon | Owner | Example |
|---|---|---|---|---|
| Strategy | Where are we going and why? | 3–5 years | Board, CISO | ”By 2029 all production sites are segmented and monitored” |
| Policy | Which rules apply? | Reviewed annually | CISO, ISO | Information Security Policy, policy for remote access |
| Programme | Which projects, in what order? | 1–3 years | Programme manager | Segmentation project per site, SOC onboarding |
| Measure | What do we actually do? | Ongoing | IT and OT operations | Firewall rules, MFA on remote access |
IEC 62443-2-1 calls the combined policies, procedures and measures of an asset owner a security program. The strategy sets the direction and priorities of that programme.
🏭 How does an OT cybersecurity strategy differ from an IT strategy?
In OT, physical safety and availability come first, but the integrity of control signals and measured values matters just as much: a manipulated measurement can make a plant unsafe. Confidentiality still plays a role too, for example for recipes and process know-how.
| Characteristic | IT strategy | OT strategy |
|---|---|---|
| Priority | Confidentiality and integrity of data | Safety, availability and integrity of the process |
| System lifetime | 3–5 years | 15–30 years, many legacy systems |
| Patching | Monthly, automated | Only during maintenance stops, after vendor testing; often compensating controls |
| Architecture | Identity and Zero Trust at the centre | Purdue Model and zones and conduits as the basis |
| Protocols | Modern, encrypted | S7 and Modbus without authentication; OPC UA with built-in security |
| Standard | ISO 27001, NIST CSF | IEC 62443, NIST SP 800-82 |
An OT strategy therefore requires close collaboration between IT, OT, process safety and management. That collaboration is exactly what OT convergence is about.
🧱 Which frameworks and laws shape the strategy?
| Framework | Type | What it asks of your strategy |
|---|---|---|
| NIS2 / Cybersecurity Act | Law (EU / NL) | Duty of care with ten categories of measures, management accountability, early warning within 24 hours; fines up to EUR 10 million or 2% of worldwide turnover for essential entities (EUR 7 million or 1.4% for important ones) |
| Cyber Resilience Act | EU regulation | For manufacturers: reporting obligations from 11 September 2026, full application from 11 December 2027 |
| IEC 62443-2-1 (2024 edition) | Standard | Security programme for asset owners in eight elements, assessed with maturity levels |
| ISO 27001 | Standard | Certifiable ISMS with risk assessment and an improvement cycle |
| NIST CSF 2.0 (February 2024) | Framework | Six functions from Govern to Recover; Govern embeds cybersecurity in how the organisation is run |
| BIO | Government baseline | Mandatory baseline for Dutch government organisations |
| FISMA | US law | Applies only to US federal agencies; useful as a reference, not an obligation in the Netherlands |
The Dutch Cybersecurity Act explicitly makes cybersecurity a board responsibility. The management body approves the measures, oversees their implementation and must demonstrably follow training on cyber risks. A documented strategy is the logical starting point for that.
🔧 How do you draw up a cybersecurity strategy?
A practical eight-step approach for a manufacturer or water authority:
- Determine scope and obligations - are you an essential or important entity under the Cybersecurity Act? Which sites, processes and systems are in scope, including OT?
- Map crown jewels and assets - start with an asset inventory of PLCs, SCADA, historians and network connections. You cannot protect what you do not know.
- Assess risks - combine a BIA with a risk assessment following IEC 62443-3-2 and record the results in a risk register.
- Baseline your maturity - score the current situation with a maturity model or a NIST CSF Current Profile.
- Choose a target state and priorities - set measurable goals for three to five years and tackle the measures with the greatest risk reduction first, such as segmentation, secure remote access and backups.
- Assign roles, budget and a roadmap - give each measure an owner and make explicit who carries OT security: IT, engineering or a dedicated OT security engineer.
- Include suppliers and the supply chain - set requirements for integrators and suppliers through IEC 62443-2-4 and third party risk management.
- Exercise, measure and adjust - test the incident response plan in a tabletop exercise and report to the board at least once a year.
🔐 Which strategic measures belong in an OT strategy?
- Segmentation - network segmentation along zones and conduits, with microsegmentation where critical systems require it
- Access - least privilege, MFA and a Zero Trust architecture for remote access by suppliers
- Detection - security monitoring with a SIEM and OT-specific anomaly detection, hosted in a SOC or by an MSSP
- Response and recovery - a tested incident response plan, offline backups and business continuity plans for manual operation
- Exercises - threat simulations and red team exercises in a test environment, never on the running plant
- Vulnerabilities - vulnerability management that prioritises actively exploited vulnerabilities
🎯 How do you measure whether the strategy works?
A strategy without measurement points is a wish list. Common ways to track progress:
| Instrument | Scale | Use |
|---|---|---|
| IEC 62443-2-1 maturity levels | ML1–ML4 per requirement | Maturity of the OT security programme |
| C2M2 v2.1 (June 2022) | MIL1–MIL3 across ten domains | Free self-evaluation from the US Department of Energy, widely used in energy and utilities |
| NIST CSF 2.0 tiers | Tier 1–4 | How rigorous governance and risk management are |
| Operational KPIs | Percentages and lead times | For example asset inventory coverage, share of remote access with MFA, time to detect |
Choose a small set of indicators the board understands and link them to the goals in the strategy.
❓ Frequently asked questions
Is a cybersecurity strategy mandatory?
A document called a cybersecurity strategy is not literally required by law. The Dutch Cybersecurity Act and NIS2 do require an adopted security policy, risk management and appropriate measures approved by the management body, and a cybersecurity strategy is the most common way to meet those requirements coherently and demonstrably.
Who owns the cybersecurity strategy?
The board is ultimately responsible for the cybersecurity strategy; under NIS2 and the Dutch Cybersecurity Act it approves the measures and can be held accountable for them. The CISO usually drafts the strategy and monitors its execution, together with the OT, IT and production managers.
How often should you review a cybersecurity strategy?
A cybersecurity strategy typically has a horizon of three to five years but is reviewed at least once a year. An interim review is also wise after a major incident, an acquisition, new legislation or a significant shift in the threat landscape.
Does OT need a separate cybersecurity strategy?
A separate OT cybersecurity strategy is not necessary, but OT should get its own chapter within the organisation-wide strategy. OT has different priorities, lifetimes and standards, such as IEC 62443, and two separate strategies often leave gaps at the boundary between IT and OT.
What is the Netherlands Cybersecurity Strategy?
The Netherlands Cybersecurity Strategy (NLCS) 2022–2028 is the Dutch government’s national cybersecurity strategy, presented on 10 October 2022 and coordinated by the NCTV. It has four pillars: digital resilience of government, businesses and civil society; secure digital products and services; countering threats from states and criminals; and sufficient cybersecurity talent and resilient citizens.
Which framework is the best starting point for a cybersecurity strategy?
For a cybersecurity strategy that covers both IT and OT, NIST CSF 2.0 works well as the overarching structure, complemented by IEC 62443 for OT requirements and ISO 27001 for the management system. Dutch organisations under the Cybersecurity Act should also check that choice against the ten categories of measures in NIS2.
📌 In summary
A cybersecurity strategy is the multi-year blueprint an organisation uses to manage its digital risks: from vision and risk assessment to measures, roles, metrics and continuous improvement. For industrial organisations, the strategy gives heavy weight to process safety and availability, builds on IEC 62443 and aligns with NIS2 and the Dutch Cybersecurity Act, which make cybersecurity a board responsibility.