What is a risk assessment?
A risk assessment is the systematic identification, analysis and evaluation of risks that could affect the safety, availability, integrity or confidentiality of systems, processes and people, so that an organisation can decide which risks are acceptable and which require action. In an OT context, a risk assessment helps protect industrial installations against technical failures, human error and cyber attacks at the same time. The result is not a report for the shelf but a reasoned set of priorities: which risks come first, which control addresses them, and which residual risk management consciously accepts.
Risk assessment is the core activity within Risk Management: without an assessment, every security measure is a guess.
🧠 What are the steps of a risk assessment?
The generic risk standard ISO 31000:2018 divides risk assessment (clause 6.4) into three sub-steps: risk identification, risk analysis and risk evaluation. It is preceded by establishing the scope, context and risk criteria, and followed by risk treatment. Translated to OT practice:
- Define scope and criteria - which installation, which assets and what risk appetite? Agree up front what counts as “unacceptable”, for example an injury, an environmental release or more than eight hours of production downtime.
- Identify risks - which events could occur? Think of cyber attacks, faults, human error, fire, power outages and sabotage. Use Threat Intelligence, incident history and an up-to-date asset inventory.
- Identify vulnerabilities - which weaknesses make an event possible? Examples include a legacy PLC, insufficient Access Control, outdated Firmware or a flat network without zones.
- Determine impact - what is the damage if things go wrong? Factors include injury, environmental damage, lost production, financial loss and reputation.
- Estimate likelihood - how probable is it? For cyber risks this depends on exposure, attacker capability and existing controls; for technical failures, on failure rates.
- Evaluate the risk - compare the risk level with the criteria from step 1 and decide which risks need treatment, and in what order.
Selecting and implementing controls is formally called risk treatment and follows the assessment. After implementation, you assess the residual risk again. The outcome is recorded in a risk register so that ownership and progress stay visible.
📊 How does a risk matrix work?
A widely used form is semi-quantitative: impact and likelihood each receive a score from 1 to 5, and their product (1 to 25) determines the colour in a risk matrix. That is a practical convention, not a requirement: ISO 31000 does not prescribe multiplication, and process safety more often works with frequencies per year.
| Impact × likelihood score | Risk level | Typical follow-up |
|---|---|---|
| 1–4 | Low | Accept and monitor |
| 5–9 | Medium | Plan a control within the annual budget |
| 10–16 | High | Control within a few months, owner at management level |
| 20–25 | Critical | Act immediately or apply a temporary compensating control |
A common pitfall is that everyone fills in the same matrix differently. Define concrete anchors per score, for example “impact 5 = fatal injury or more than a week of downtime” and “likelihood 5 = expected within a year”. For cyber risks, likelihood is hard to quantify; IEC 62443-3-2 therefore uses unmitigated likelihood, the likelihood without existing controls, to keep an honest starting point.
🔄 What is the difference between a safety and a security risk assessment?
Two traditions coexist in OT. Safety looks at random failure modes and human error, security at deliberate attacks. The methods differ, but the outcomes have to fit together:
| Aspect | Safety risk assessment | Security risk assessment |
|---|---|---|
| Cause | Random failure, process deviation, human error | Deliberate attack, malware, insider |
| Core standards | ISO 12100 (machinery), IEC 61511 (process) | IEC 62443-3-2, ISO 27005, NIST SP 800-30 |
| Typical methods | HAZOP, LOPA, FMEA, risk graph | Threat scenarios, Threat Modeling, MITRE ATT&CK for ICS |
| Likelihood | Failure rates, relatively stable | Depends on the attacker, changes quickly |
| Outcome | Required SIL of a safety function | Target Security Level (SL-T) per zone and conduit |
| Dutch/EU anchoring | RI&E, Seveso rules | Dutch Cybersecurity Act, BIO |
The link matters: an attacker who disables a safety instrumented system invalidates the LOPA calculation. IEC 62443-3-2 therefore explicitly names existing process hazard analyses as input, and a BOW-TIE analysis is a handy way to show safety and security barriers in a single picture.
⚙️ Why is a risk assessment in OT different from IT?
An OT risk assessment follows the same steps as in IT, but the weighting shifts. In office IT, confidentiality often comes first; in OT, safety and availability of the physical process take priority, so the classic CIA Triad is read in reverse order.
| Aspect | Consequence for the risk assessment |
|---|---|
| Industrial processes | A disruption can cause injury, environmental damage or lost production, not just a data breach |
| Legacy systems | Components often run for fifteen to twenty years and cannot always be patched or monitored, so compensating controls carry more weight |
| Physical components | Risks are not only digital but also mechanical and electrical; a mechanical limit can neutralise a cyber scenario |
| Patch Management | Patching requires a downtime window and often vendor approval, so a known vulnerability regularly stays open for months |
| Compliance requirements | IEC 62443, ISO 27001, BIO and NIS2 all require a risk assessment |
🔧 How does a risk assessment work under IEC 62443-3-2?
IEC 62443-3-2 (2020) is the part of the IEC 62443 series for OT cyber risk assessment and defines seven Zone and Conduit Requirements (ZCR):
- ZCR 1 - identify the System under Consideration (SuC), including its perimeter and access points
- ZCR 2 - perform an initial risk assessment based on existing documentation, such as process hazard analyses and the corporate risk matrix
- ZCR 3 - partition the system into zones and conduits following the zones and conduits model
- ZCR 4 - compare whether the initial risk exceeds the tolerable risk
- ZCR 5 - perform a detailed assessment: threats, vulnerabilities, consequences, unmitigated likelihood and risk, and determination of the SL-T
- ZCR 6 - document security requirements, assumptions and constraints
- ZCR 7 - obtain approval from the asset owner, who also sets the tolerable risk
The SL-T then translates into requirements from IEC 62443-3-3 and into controls such as network segmentation and firewalls between zones. A broader treatment of cyber risk is given in Cybersecurity Risk Assessment.
🛡️ Which controls follow from a risk assessment?
The assessment determines which mitigating measures are needed. A balanced package covers four functions:
- Prevention - for example a Firewall, Network Segmentation and Security Awareness
- Detection - for example anomaly detection and a SIEM
- Response - for example an Incident Response Plan
- Recovery - for example a Backup and Disaster Recovery
For safety risks a fixed order applies: ISO 12100 requires inherently safe design first, then safeguarding and complementary protective measures, and only last information for use. A warning sticker is therefore never the first control. A Business Impact Analysis helps to set recovery priorities and maximum tolerable downtime.
🏭 Which laws and standards require a risk assessment?
| Framework | What it requires | Applies to |
|---|---|---|
| Dutch Arbowet (Working Conditions Act), article 5 | An RI&E with an action plan, reviewed by a certified occupational health and safety expert; employers with up to 25 staff using a recognised sector tool are exempt from review | Every employer with staff |
| NIS2 / Dutch Cybersecurity Act | Policies on risk analysis and information system security, following an all-hazards approach; Cbw in force since 15 August 2026 | Essential and important entities |
| ISO 27001:2022 | A defined risk assessment process (clause 6.1.2), performed at planned intervals (clause 8.2) | Certified organisations |
| Cyber Resilience Act | A cybersecurity risk assessment per product, included in the technical documentation; fully applicable from 11 December 2027 | Manufacturers of products with digital elements |
| Machinery Regulation (EU) 2023/1230 | A risk assessment that also covers malicious manipulation; applicable from 20 January 2027 | Machine builders |
| IEC 61511 | Hazard and risk assessment as the basis for SIL allocation | Process industry with a SIS |
In practice it pays to choose one risk methodology that serves several frameworks at once. The CRA even allows the cybersecurity risk assessment to be part of an assessment that other EU rules already require, such as the one under the Machinery Regulation.
🧭 How do you approach an OT risk assessment in practice?
An example: a drinking water company assesses a pumping station with a SCADA connection and remote access for a supplier.
- Assemble the team - operations, process engineering, OT security and the supplier. With only IT at the table, process consequences get missed.
- Map assets and connections - PLCs, HMI, router and the supplier’s access route, arranged according to the Purdue Model.
- Formulate scenarios - for example “an attacker with a stolen supplier password changes dosing setpoints”. Scenarios are more concrete than isolated threats.
- Score without and with controls - first the unmitigated risk, then the effect of existing barriers such as mechanical limits.
- Choose controls - for example MFA and time-limited access for the supplier, plus segmentation between the pumping station and the office network.
- Repeat - after every significant change, after incidents and at least annually.
A small installation takes a few workshop days this way; a complete refinery takes weeks. Start with the processes that have the most severe consequences instead of tackling everything at once.
❓ Frequently asked questions
What is the difference between risk assessment and risk management?
Risk assessment is the identification, analysis and evaluation of risks. Risk management is the complete cycle around it, including establishing context, treating risks, monitoring and communication. A risk assessment is therefore one step within risk management according to ISO 31000.
How often should you repeat a risk assessment?
A risk assessment should be repeated after significant changes to the installation, the network or the threat landscape, and after serious incidents. ISO 27001 requires assessments at planned intervals; in OT, annually is a common minimum frequency. A Dutch RI&E must be updated as soon as work or working conditions change.
Is a risk assessment mandatory under NIS2 and the Dutch Cybersecurity Act?
Yes, the duty of care in the Dutch Cybersecurity Act requires essential and important entities to take risk-based measures, and NIS2 lists policies on risk analysis as the first measure. Without a documented risk assessment, an organisation cannot demonstrate that its measures are appropriate. For OT systems, a zone-based assessment according to IEC 62443-3-2 is a common way to meet this.
Which risk assessment method suits OT?
For cyber risks in OT, IEC 62443-3-2 is the established reference method because it ties risks to zones, conduits and security levels. For process safety, HAZOP and LOPA are common, and for machinery ISO 12100. Many organisations combine these methods so that safety and security scenarios reinforce each other.
What is residual risk in a risk assessment?
Residual risk is the risk that remains after controls have been implemented. A risk assessment ends with an explicit decision by the risk owner to accept that residual risk or reduce it further. IEC 62443-3-2 places that approval with the asset owner.
How long does an OT risk assessment take?
An OT risk assessment of a single installation with a limited number of zones usually takes a few workshop days plus preparation. Large, complex sites require weeks, mainly for the asset inventory and detailed scenarios. Reusing existing HAZOP and LOPA studies saves a lot of time.
📌 In summary
A risk assessment identifies, analyses and evaluates risks, and forms the basis for every well-founded security or safety measure. In OT, safety methods such as HAZOP, LOPA and ISO 12100 meet cyber methods such as IEC 62443-3-2, and legislation from the Dutch Working Conditions Act to the Cybersecurity Act and the CRA makes the assessment mandatory.
A good risk assessment makes choices explicit: which risks you address, with which control, and which residual risk you consciously accept.