What is an Operational Security Officer (OSO)?
An Operational Security Officer (OSO) is the officer in an organisation with industrial automation who handles the day-to-day execution of cybersecurity measures in the OT environment: they apply security policy to PLCs, SCADA, DCS systems and the industrial network, monitor the security status and intervene when something deviates. The OSO is the operational end of a three-tier model: the CISO sets the strategy, the Information Security Officer translates it into policy and risk assessments, and the OSO makes sure the measures actually work on the plant floor. In job advertisements the same role is often called OT Security Officer; no standard prescribes the job title.
The OSO bridges policy and practice and works closely with IT, production, engineering, maintenance and security teams.
🧠 What does an Operational Security Officer do?
An OSO’s tasks fall into five clusters. Together they ensure that security in the OT environment is more than a paper exercise in industrial automation.
- Managing technical measures - configures and maintains security measures, or has them configured, such as firewalls, industrial switches, network segmentation, access control and patch management.
- Monitoring and detection - oversees the real-time security status using SIEM, anomaly detection and security monitoring, triages alerts and analyses log files.
- Supporting incidents - plays an active role in the Incident Response Plan, works with the CSIRT or SOC during OT incidents and contributes to forensic investigation and root cause analysis.
- Overseeing changes and assets - assesses the security impact of system changes through management of change (MOC), and keeps the asset inventory and known vulnerabilities up to date as part of asset management.
- Coordinating and reporting - supports the ISO and CISO with figures and signals from the field, and coordinates planned interventions with production, maintenance and IT.
The difference from an IT security role lies in priorities. In OT, process safety and availability come before confidentiality. An OSO knows that patching often has to wait for a planned shutdown, that an active scan can make an older controller hang, and that every change goes through the MOC procedure.
🔄 How does the OSO relate to other security roles?
Organisations usually assign information security at three levels. The OSO sits at the operational level, closest to the installation.
| Role | Level | Focus | Usually reports to |
|---|---|---|---|
| CISO | Strategic | Security strategy, governance, reporting to the board | Executive board or CIO |
| Information Security Officer | Tactical | Policy, risk assessments, controls and reporting | CISO |
| OSO / OT Security Officer | Operational | Day-to-day execution of measures in OT systems | ISO, CISO or head of engineering |
| OT Security Engineer | Technical | Designing and building segmentation, firewalls, hardening and IDS | OT security manager or OSO |
| SOC analyst | Detection | Triage of alerts and first incident analysis | SOC manager |
| OT engineer | Installation | Operation of controllers, PLC programming, fault finding | Head of engineering |
In smaller organisations the OSO and the OT Security Engineer are often the same person. In larger ones the OSO directs the measures and an engineer or supplier carries them out. The exact split differs per employer, so record it in a role profile or RACI matrix.
🏭 What does an OSO do in industrial networks?
| Activity | OT context |
|---|---|
| Switch configuration | VLANs, port security, redundancy protocols such as MRP |
| Firewall management | Industrial firewalls, zoned architecture, protocol filtering |
| Patching strategy | Coordinating updates on vulnerable but critical systems, aligned with the supplier and the production schedule |
| Logging and detection | Syslog, SPAN and TAP monitoring on the control network |
| Segmentation and access | The zones and conduits model, 802.1X, least privilege |
| Configuration management | Backups of PLC programs and configurations under version control, as part of configuration management |
🔐 Which knowledge and skills does an OSO need?
- Industrial protocols - Modbus, OPC UA, S7 and IP, including their weaknesses: many older protocols have no authentication.
- Networking - VLANs, routing, firewall rules and the structure of an industrial network.
- Tooling - Wireshark for traffic analysis, an OT IDS for passive monitoring, vulnerability scanners (to be used in OT only with great care) and firewall management platforms.
- Standards and legislation - the IEC 62443 series, ISO 27001 at a high level, NIS2 and the Dutch Cybersecurity Act.
- Process understanding - knowing how an installation runs and what you must not touch, such as the safety instrumented system.
- Communication - explaining risks in process terms to operators, maintenance staff and management.
Scripting and automation skills are a plus. Certifications such as GIAC’s GICSP or the ISA/IEC 62443 certificate programme make knowledge demonstrable; an overview is in OT Security Certifications.
⚖️ Is an OSO required by IEC 62443 or the Cybersecurity Act?
No, no law or standard requires a position called OSO. Responsibilities do have to be demonstrably assigned, however, and day-to-day execution in OT is exactly the gap the OSO fills.
| Framework | What it asks | Meaning for the OSO |
|---|---|---|
| IEC 62443-2-1 (2024 edition) | Asset owner security programme with eight security program elements; SPE 1 (ORG) requires roles and responsibilities | The OSO is a logical owner of operational requirements in configuration management, component security and event management |
| ISO 27001 | Clause 5.3: assign roles, responsibilities and authorities | The OSO role is defined within the ISMS |
| Dutch Cybersecurity Act (Cbw) | Duty of care and reporting obligation, in force since 15 August 2026; the board is ultimately accountable | The OSO provides evidence that measures work and spots incidents early |
| Incident reporting | Report significant incidents within 24 hours, 72 hours and one month | The OSO makes sure OT incidents reach the reporting process quickly |
🛠️ How do you set up the OSO role in practice?
- Define the mandate - record which systems fall under the OSO, which decisions they may take on their own (such as isolating a suspicious device) and when they must escalate.
- Link the role to the information security policy - so that the policy of the ISO and CISO has a permanent executor on the plant floor.
- Give access to the right information - the asset inventory, network drawings, firewall rules, IDS alerts and the change calendar.
- Set a working rhythm - for example, review alerts daily, align changes with production weekly, prioritise vulnerabilities and patches monthly, and review firewall rules and access rights quarterly.
- Exercise incidents - include the OSO in tabletop exercises together with production, IT and the SOC.
- Measure and report - report to the ISO or CISO on indicators such as asset inventory coverage, the number of open critical vulnerabilities and incident lead times.
An example: a Dutch water board with dozens of pumping stations and treatment plants appoints an OT Security Officer who reports to the CISO. They review every change to the SCADA network, keep track of PLCs and suppliers’ remote access connections, and are the first point of contact for the CSIRT when a suspicious alert comes in.
❓ Frequently asked questions
What is the difference between an OSO and an ISO?
An Information Security Officer (ISO) works at the tactical level, translating policy into risk assessments, measures and controls. An Operational Security Officer (OSO) works at the operational level and makes sure those measures are actually applied and monitored in the OT environment.
Is an Operational Security Officer the same as an OT Security Officer?
In practice, yes: both titles describe the officer who carries out and monitors day-to-day OT security. Dutch job advertisements, for example at water boards and energy companies, often use the title OT Security Officer.
What is the difference between an OSO and an OT Security Engineer?
An OSO is responsible for execution and oversight, including coordination, reporting and incident follow-up. An OT Security Engineer designs and builds the technical measures themselves. In small organisations one person often combines both roles.
Who does an Operational Security Officer report to?
An OSO usually reports to the ISO or the CISO, and sometimes to the head of engineering or the site manager. What matters is that the OSO also has a line to the security organisation, so that OT risks end up in the overall risk reporting.
What background does an OSO usually have?
An OSO often has a bachelor’s-level background in computer science, electrical engineering or process automation, supplemented by knowledge of networking and security standards such as IEC 62443. Experience with SCADA and PLCs counts heavily, because the OSO has to earn the trust of operators and maintenance staff.
Does every organisation need an OSO?
Not as a separate position, but every organisation with an OT environment needs someone who carries out and monitors day-to-day security. For organisations covered by the Dutch Cybersecurity Act, demonstrably assigning that task is especially important.
📌 In summary
The Operational Security Officer is the operational OT security role that ensures security policy is actually applied, monitored and improved on the plant floor. The OSO works close to production, manages measures such as segmentation, patching and monitoring, and together with the ISO and CISO forms the backbone of the cyber resilience of industrial networks.