Many small energy companies and industrial contractors have an IT security policy, and almost none have a policy that addresses operational technology. The equipment that moves oil, regulates pressure, controls pumps or manages substations is governed by habit, vendor instructions and the memory of long-tenured operators. That works until a key person retires, a vendor changes, or an incident exposes the gaps.
A policy does not secure anything by itself. It does set expectations, assign responsibility and create a baseline that you can improve. Here is an outline you can adapt, written for organizations without a large compliance staff. It draws on general concepts from NIST CSF 2.0 and ISA/IEC 62443.
Keep it short and usable
Aim for a document that operators can read in a few minutes. Use plain language, specific actions and named roles. Separate the policy, which states rules, from procedures, which explain how to carry them out.
1. Purpose and scope
State what the policy protects and which facilities, systems and people it covers. Define OT in your context, for example "control systems, instrumentation, safety systems, and supporting networks used to operate physical processes." Note any systems excluded and why.
2. Roles and responsibilities
Name who is responsible for:
- Overall accountability, usually an executive
- Day-to-day OT security coordination
- Operations and engineering decisions
- IT support for networks and endpoints
- Vendor and contractor management
- Incident response leadership
Specify that safety and reliability take priority, and that security changes affecting operations require operator approval.
3. Asset inventory
Require a current inventory of OT assets with ownership, location, function and connectivity. Assign a review schedule and a rule that new equipment is added at installation.
4. Network separation
State that OT networks must be separated from corporate IT and the internet, that connections between them must be documented and approved, and that unused paths are removed. Require default-deny rules on boundary firewalls.
5. Access control
Include requirements for:
- Individual accounts, no shared logins where the system permits
- Least privilege based on job role
- Multifactor authentication for remote and administrative access where feasible
- Prompt removal of access when people change roles or leave
- Secure handling of passwords, including changing defaults
- Periodic access reviews
6. Remote access and third parties
Require that all remote access use approved methods, with authentication, logging and time limits. Vendors must use individual accounts and be approved before sessions begin. Include contractual security expectations for vendors and a process for reviewing them.
7. Change management
Define how changes to control logic, configurations and devices are requested, reviewed, tested, approved and documented. Include backups of configurations before a change and a rollback plan.
8. Patching and vulnerability management
Acknowledge that OT patching differs from IT. Require that you track vendor advisories, evaluate relevance, test where possible and schedule updates during planned windows. When patching is not possible, require compensating controls such as segmentation, and record the exception with an owner and review date.
9. Backup and recovery
Require backups of controller programs, configurations, historian data and network device settings. Store copies offline or in a protected location, and test restoring them on a schedule.
10. Removable media and portable devices
Set rules for USB drives, engineering laptops and diagnostic tools: approved devices only, scanning before use and separation from general-purpose computers.
11. Monitoring and logging
State which events must be logged, such as remote sessions, configuration changes and failed logins, who reviews them and how often. Where active monitoring tools exist, define who receives alerts.
12. Incident response
Require an OT-specific incident response plan that covers detection, escalation, safe operating modes, communication, evidence preservation, recovery and notification obligations. Require a tabletop exercise at least annually, with operations present.
13. Training
Provide role-based awareness for operators, engineers, maintenance staff and contractors. Cover phishing, removable media, reporting suspicious behavior and remote access rules.
14. Compliance and exceptions
List applicable regulations and customer requirements. Provide a documented exception process with approval, expiration and compensating controls.
15. Review and update
Require review at least yearly and after significant incidents or operational changes. Record the version history and approvals.
Putting it to work
Start with sections that bring the largest immediate benefit: inventory, remote access and backup. Add detail as your program matures. Have operations leaders co-author the document, since policies written without them are often ignored.
How Ironfield Cyber helps
Ironfield Cyber helps energy and industrial operators draft practical OT security policies and procedures and align them with their operations. If you want a starting draft tailored to your facilities, we can work with your team to produce one.