What are mitigating measures?
Mitigating measures are technical, organisational or physical measures that reduce the likelihood of an undesirable event or its consequences, so that a risk falls to a level an organisation can consciously accept. In OT environments, they protect industrial installations, networks and processes against cyber attacks, technical faults and human error. Mitigating measures are a fixed part of risk management and usually follow from a Cybersecurity Risk Assessment or a Business Impact Analysis. They rarely eliminate a risk entirely: a residual risk remains, which the risk owner has to accept formally.
🧠 What does mitigation mean within risk management?
Mitigation is one of four ways to deal with a risk. ISO 27005 distinguishes four risk treatment options; ISO 31000 uses a similar, slightly more detailed list:
| Option | What you do | OT example |
|---|---|---|
| Reduce (mitigate) | Take measures that lower likelihood or impact | Place an old PLC behind an industrial firewall |
| Avoid | Stop the risky activity | No longer allow remote access to a critical installation |
| Share | Transfer the risk (partly) | Cyber insurance or contractual agreements with a maintenance supplier |
| Accept | Consciously carry the risk | Run an isolated test rig without patches, recorded in the risk register |
In OT, mitigation is usually the obvious choice, because a plant can rarely stop a process. After implementing measures, you reassess the residual risk and compare it with the acceptance criteria. If it is still too high, another measure follows.
In process safety, “mitigation” often has a narrower meaning. In a bow-tie analysis, the preventive barriers on the left of the top event stop things going wrong, while the mitigating barriers on the right limit the consequences if it does go wrong. A bund or a fire suppression system is then mitigating; pressure control is preventive. In cyber security, the term is used more broadly for any measure that lowers risk.
🧱 What types of mitigating measures are there?
Mitigating measures are classified in two ways: by their nature and by their function.
By nature
- Technical measures - firewalls, protocol filtering, network segmentation, patch management, anomaly detection, SIEM, encryption, access control and Zero Trust. A jump server for remote access with multi-factor authentication also belongs here.
- Organisational measures - an information security policy, an Incident Response Plan, contingency planning, security awareness training, change management, supplier security and periodic audits.
- Physical measures - access control to control cabinets, control rooms and server rooms, locks and cameras, but also safety provisions such as PPE, Lock-out Tag-out (LOTO), the emergency stop, a UPS, cooling and fire protection.
By function
| Function | Purpose | OT examples |
|---|---|---|
| Preventive | Stop an incident from occurring | Whitelisting, MFA, disabled USB ports |
| Detective | Notice an incident quickly | IDS, anomaly detection, logging to a SIEM |
| Corrective | Limit damage and end the incident | Isolate an infected segment, incident response |
| Recovery | Return to normal operation | Offline backups of PLC programs, disaster recovery |
| Compensating | Meet a requirement the system cannot meet itself | A firewall in front of a PLC without authentication |
A good set of measures combines these functions. Prevention alone is fragile: if one barrier fails, nobody notices. That is the essence of defence in depth.
🏭 Which mitigating measures fit typical OT risks?
| Risk | Mitigating measures |
|---|---|
| Ransomware via a USB stick | Disable physical ports, USB control, whitelisting, awareness |
| Unauthorised remote access | VPN with MFA, jump server, ACLs, port security |
| Outdated PLC with known vulnerabilities | Segmentation, protocol filtering, physical isolation |
| Unknown devices on the network | 802.1X with RADIUS, port security, asset inventory |
| Excessive rights for users and suppliers | Least privilege, time-limited accounts, change management |
| Attacks go unnoticed | Anomaly detection, IDS, SIEM, central logging |
| A single connection as a single point of failure | Ring redundancy with MRP or DLR, high availability |
For a structured selection, you can use the MITRE ATT&CK for ICS catalogue. It contains 53 mitigations, each with its own ID, such as M0930 Network Segmentation, M0932 Multi-factor Authentication, M0937 Filter Network Traffic and M0953 Data Backup. For each attack technique, you can see which mitigations help. A notable entry is M0816 Mitigation Limited or Not Effective: for some techniques no good preventive measure exists, so detection and recovery are the only options.
🔐 How do mitigating measures relate to standards and legislation?
Standards and laws rarely prescribe a single measure; they require you to choose measures that fit your risks. Several security standards and laws set the framework:
- IEC 62443 - IEC 62443-3-3 contains 51 system requirements under seven foundational requirements, from identification and authentication to resource availability. For each zone you set a target security level (SL 1 to SL 4). If a component cannot reach it on its own, a compensating countermeasure in the zone may close the gap.
- ISO 27001 - Annex A of the 2022 edition contains 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. In the Statement of Applicability you record which ones you apply and why. Guidance on each control is in ISO 27002.
- NIST CSF - version 2.0 (February 2024) organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Mitigating measures fall mainly under Protect, Detect, Respond and Recover; Respond even has its own Incident Mitigation category (RS.MI).
- NIS2 - Article 21 requires appropriate and proportionate measures based on an all-hazards approach, with ten minimum topics such as incident handling, business continuity, supply chain security, cryptography and MFA. In the Netherlands this applies through the Cybersecurity Act, which entered into force on 15 August 2026.
- Arbowet - for physical safety, the Dutch Working Conditions Act prescribes the occupational hygiene strategy: tackle the hazard at source first, then collective measures, then individual ones, with PPE as a last resort.
🔧 How do you select and embed mitigating measures in practice?
A workable approach for a production site:
- Map your assets - without an asset inventory you do not know what you are protecting.
- Assess the risks - with a Cybersecurity Risk Assessment per zone, for example according to IEC 62443-3-2. Record likelihood, impact and risk owner.
- Choose a treatment option per risk - reduce, avoid, share or accept.
- Select complementary measures - combine preventive, detective and recovery measures, and check that they do not affect process availability. An aggressive virus scanner on an HMI can do more harm than the risk it covers.
- Test before rollout - preferably on a test rig or during a planned shutdown, via change management.
- Determine the residual risk and have the risk owner accept it formally.
- Measure effectiveness - with indicators such as patch level, number of open firewall rules, mean time to detect and the percentage of successful restore tests.
- Repeat periodically - at least annually and after every major change or incident.
An effective measure is appropriate to the risk, measurable, workable for the people who use it and embedded in policy and procedures. A measure that exists only on paper, or that operators bypass because it gets in the way of their work, does not lower the risk.
❓ Frequently asked questions
What is the difference between preventive and mitigating measures?
Preventive measures reduce the likelihood that an incident occurs, while mitigating measures in the strict sense limit the consequences if it does happen. Process safety and bow-tie analysis make this distinction explicitly. In cyber security, all risk-reducing measures are usually called mitigating measures.
What is a compensating measure?
A compensating measure meets a security requirement that a system cannot meet by itself. A common OT example is an industrial firewall in front of an outdated PLC that does not support authentication. IEC 62443 explicitly allows this, provided the target security level of the zone is demonstrably achieved.
When is a risk sufficiently mitigated?
A risk is sufficiently mitigated when the residual risk is below the acceptance criteria the organisation set in advance. The risk owner accepts that residual risk formally, for example in the risk register. Zero risk does not exist, certainly not in installations that remain in service for decades.
Why can’t you simply apply IT measures in OT?
In OT, availability and safety come first, and many systems run on outdated operating systems that cannot tolerate patches or agents. Mitigating measures must therefore be tested first and must not disrupt the process. Network segmentation and passive monitoring are often more suitable in OT than active scanning or automatic patching.
Does NIS2 require specific mitigating measures?
NIS2 does not prescribe specific products in Article 21, but it does list ten topics every organisation must address, such as incident handling, backups, supply chain security and multi-factor authentication. The measures must be appropriate and proportionate to the risk. In the Netherlands, this has been laid down in the Cybersecurity Act (Cyberbeveiligingswet) since 15 August 2026.
How do you measure whether mitigating measures work?
You measure the effectiveness of mitigating measures with concrete indicators, such as patch level, time to detect an incident, the number of firewall rule exceptions and the results of restore tests. Audits and penetration tests on a test rig provide additional insight. NIS2 also explicitly requires policies for assessing the effectiveness of security measures.
📌 In summary
Mitigating measures reduce the likelihood or impact of an incident to an acceptable residual risk, and in OT environments they are at the heart of risk management.
They are technical, organisational or physical in nature and work in a preventive, detective, corrective, recovery or compensating way. Standards such as IEC 62443, ISO 27001 and NIST CSF help you choose, while NIS2 and the Dutch Cybersecurity Act require the measures to be appropriate. By combining measures, testing them before rollout and checking their effectiveness periodically, you build a layered defence that holds even when one barrier fails.