ISO

What is an Information Security Officer (ISO)?

An Information Security Officer (ISO) is the officer who monitors, coordinates and improves information security at the tactical level of an organisation, translating the policy set by management and the CISO into risk assessments, controls, checks and reports. In environments with industrial automation, the ISO is a key role bridging IT, OT, compliance and management. The ISO protects data and systems, but also the continuity of critical production processes running on SCADA, PLCs, the control network and the historian.

Mind the acronym: ISO also stands for the International Organization for Standardization, the publisher of standards such as ISO 27001 and ISO 22301. This article is about the job role; the standards body is briefly covered further down.

🧠 What does an Information Security Officer do?

The ISO’s tasks fall into six areas:

1. Policy and strategy
   • Develops and maintains the information security policy and its supporting guidelines
   • Ensures alignment with ISO 27001, IEC 62443, the Dutch government baseline BIO and NIS2
2. Risk analysis and controls
   • Performs risk assessments and a Business Impact Analysis (BIA) and maintains the risk register
   • Determines appropriate technical and organisational measures together with the risk owners
3. Implementation and oversight
   • Advises on the security architecture, such as the Purdue Model and the zones and conduits model
   • Aligns with IT and OT on access control, encryption, backups and patch management
4. Awareness and training
   • Initiates security awareness programmes and phishing exercises
   • Promotes a security culture in which staff report incidents and doubtful situations
5. Assurance and compliance
   • Performs internal reviews and audits and follows up on findings
   • Prepares external audits, such as ISO 27001 certification or the BIO; for US federal contracts also frameworks such as FISMA
   • Reports to executive management or the CISO
6. Incident management
   • Acts during incidents together with the CSIRT or an OT SOC
   • Oversees execution of the incident response plan and forensic investigation

The ISO is therefore not the technician who configures firewalls, but the coordinator who makes sure the right people take the right measures, and that this can be demonstrated.

🔄 What is the difference between an ISO, CISO, OSO and DPO?

Security job titles are often used loosely. The real difference lies in the level at which someone works:

In smaller organisations one person often combines the CISO and ISO roles. The DPO is a statutory role under Articles 37 to 39 of the GDPR: mandatory for public authorities and for organisations whose core activities involve large-scale monitoring of individuals or large-scale processing of special categories of data. The DPO may hold other tasks as long as they do not create a conflict of interest. Someone who designs security measures can hardly supervise them independently, so combining the ISO and DPO roles calls for careful consideration.

🏭 Why is the ISO’s role different in OT?

In an office environment, confidentiality often comes first. In industrial processes, availability and safety take priority: a failed controller can cause lost production, environmental damage or injury. The ISO has to understand that different priority and translate it into policy.

For OT, IEC 62443-2-1 is the ISO’s most important framework. Its second edition, published in August 2024, sets out the requirements for an asset owner’s security programme, organises them into programme elements, removes overlap with the ISMS of ISO 27001 and adds a maturity model. The standard also recognises that old, unsupported systems cannot meet every requirement and allows compensating measures. A good starting point is a complete asset inventory: without an overview of controllers, firmware versions and connections, there is little to secure.

📜 Which standards and laws shape the ISO’s work?

ISO 27001 does not prescribe a job title: it only requires that roles and responsibilities are assigned and communicated. Even so, most certified organisations appoint a named ISO or CISO, because auditors expect a single point of contact for the ISMS. Organisations still certified against the 2013 version had to transition by 31 October 2025.

The standards body ISO is the International Organization for Standardization, founded on 23 February 1947 and based in Geneva. Its members are national standards bodies from more than 170 countries; the Netherlands is represented by NEN. The short name derives from the Greek isos (equal), so the abbreviation is the same in every language. ISO develops information security standards such as the 27000 series jointly with the IEC in committee ISO/IEC JTC 1/SC 27.

🧭 How do you set up the ISO role in practice?

An effective ISO depends on mandate and position. A proven approach:

1. Define mandate and position — the ISO belongs in the second line of the IIA’s Three Lines Model (2020): the first line (management and operations) owns the risks, the ISO advises and oversees, and internal audit provides independent assurance as the third line. Make sure there is a direct escalation route to executive management.
2. Make responsibilities explicit — a RACI matrix for policy, risk acceptance, changes and incidents stops IT and OT from pointing at each other.
3. Run a fixed annual cycle based on PDCA — risk assessment and treatment (ISO 27001 clause 6.1), an up-to-date statement of applicability, internal audit (9.2) and management review (9.3).
4. Link to continuity — align with business continuity and ISO 22301, so that recovery plans also cover OT.
5. Prepare for incident reporting — under the incident reporting duty of the Dutch Cybersecurity Act, an early warning goes to the CSIRT and the supervisor within 24 hours, an incident notification within 72 hours and a final report within one month. The ISO makes sure this chain works, including outside office hours.
6. Involve the board — since 15 August 2026, the management body of an entity in scope of the Dutch Cybersecurity Act must approve the measures, oversee their implementation and complete training itself. The ISO supplies the reports and training material.

A typical quarterly report to executive management covers the status of the top risks, open audit findings, incidents and near misses, progress of the patching and awareness programmes, and the risks that have been formally accepted.

🎓 Which knowledge and certifications does an ISO need?

An ISO combines knowledge of standards and risk management with enough technical understanding to talk to engineers. Commonly held certifications:

• CISSP (ISC2) and CISM (ISACA) — broad, management-oriented security certifications
• ISO 27001 Lead Implementer or Lead Auditor — for setting up and auditing an ISMS
• GIAC GICSP — since 2013 the best-known vendor-neutral certification for industrial control systems
• ISA/IEC 62443 Cybersecurity Certificates — four specialisations, from fundamentals to risk assessment

A comparison is available in the article on OT Security Certifications. Communication skills matter just as much: the ISO must be able to explain a risk in euros and production hours to the board, and in technical terms to a maintenance technician.

❓ Frequently asked questions

Is an Information Security Officer mandatory?

An Information Security Officer is not a legally required job title in the Netherlands or the EU. ISO 27001, the BIO and the Dutch Cybersecurity Act do require that responsibilities for information security are demonstrably assigned, and in practice an ISO or CISO fulfils that task.

What is the difference between an ISO and a CISO?

The CISO holds ultimate accountability and works at the strategic level: vision, budget and governance towards the board. The Information Security Officer works at the tactical level and translates that policy into risk assessments, controls, checks and reports. In smaller organisations one person fulfils both roles.

Can the ISO also be the data protection officer?

Only if no conflict of interest arises, because the GDPR requires the data protection officer to supervise independently. An ISO who designs security measures or decides on the processing of personal data would then be assessing their own work. Many organisations therefore keep the two roles separate.

Who does an Information Security Officer report to?

An Information Security Officer usually reports to the CISO, or directly to executive management if there is no CISO. What matters is an independent escalation route to top management, so that risks do not get stuck in the IT or production department that has to resolve them.

What does an ISO do during an OT incident?

During an OT incident, the Information Security Officer coordinates between operations, IT, the OT SOC and external parties, and oversees execution of the incident response plan. The ISO also makes sure reportable incidents reach the CSIRT and the supervisor on time. The decision to shut down a plant stays with operations, because process safety comes first.

What training does an Information Security Officer need?

An Information Security Officer usually has a degree in computer science, information management or engineering, complemented by certifications such as CISSP, CISM or ISO 27001 Lead Implementer. Those working in industry add OT knowledge, for example through GICSP or the ISA/IEC 62443 certificates.

📌 In summary

The Information Security Officer (ISO) monitors and coordinates information security at the tactical level, in both IT and OT, translating the policy of management and the CISO into risks, controls and demonstrable checks. With knowledge of ISO 27001, IEC 62443-2-1, the Dutch Cybersecurity Act and how industrial plants operate, the ISO is the link between the office and the plant floor.