Your Capital Plan Is Already a Security Plan

The capital plan may be the biggest security budget you don’t control. Each year your company funds new lines, expansions, retrofits and control system upgrades. Every one of those projects decides how your plants will connect, how vendors will support them and how fast they’ll recover, for decades.

Most CISOs aren’t in the room when those decisions get made. Nobody is keeping them out. Nobody thought to invite them. This series is about changing that without taking over anyone’s job. Over five parts we’ll follow a plant asset through design, procurement, commissioning and handover, then on to upgrade and retirement. At each stage we’ll show where a CISO can step in with little effort and get lasting results.

Design decisions outlast the project

Control systems stay in service for a long time. The network design, remote support path and controller platform approved this year will likely still be running when your successor presents to the board. The posture you’ll report on years from now is being set in this year’s project reviews.

That’s good news. While a project is still on paper, changing it costs an eraser and a conversation. Get a few decisions right at design and the plant benefits every shift, with no ongoing effort from your team. It’s the best return on security effort you’ll find anywhere in OT.

Earn a seat without taking the wheel

Engineering owns capital projects, and it should. The CISO’s role is to set the standard, supply the expertise, and make sure the right questions get asked. In practice, that means getting four light additions into your company’s capital project procedure once, so every project picks them up by default:

1. A named security owner on every project team. Usually the lead controls engineer, backed by your OT security team. In our post on OT RACI, we argued that decision rights matter more than department names, and that holds here too.
2. A security line in the basis of design. One paragraph committing the system to defined security requirements (Part 2 covers those). Written early means budgeted early.
3. A zone sketch next to the P&IDs. A simple drawing that groups assets by function and criticality and shows the few approved paths between them. IEC 62443-3-2 calls these zones and conduits.
4. One question at every stage gate: “What did we decide about security since the last gate, and who signed off?”

None of this asks engineering to become security experts. It gives your expertise a regular, expected place in their process.

Three decisions to make sure get made

When your team joins a design review, steer the conversation to three questions.

How will this line connect to everything else? The paths to historian, MES, ERP and quality systems should be drawn on purpose, not discovered later. Our post Your ERP Is a Plant Floor Control System shows why those dependencies belong in scope from the start.

How will vendors support it? Every new line comes with OEMs and integrators who’ll need to connect after go-live. One approved, logged route, designed now, keeps that access predictable. (See Who Can Still Log Into Your Factory at 2:00 A.M.)

How will it get back up? Backups, spares and a target rebuild time, designed in, are the start of a stop-the-line map for the new line.

What you get back

For the CISO, the payoff goes beyond the plant floor. You get a live view of every in-flight project and its security status, and fewer exceptions to manage after go-live. You also get a simple story for the board: new assets come in secure by design, so overall risk falls as the plant renews itself.

What you can do now

Ask engineering or finance for your current capital plan and find one project that hasn’t reached detailed design. Meet its project sponsor and offer one of your OT security people for a one-hour design review covering the three questions above. Then talk to whoever owns the corporate capital project procedure and propose adding the stage-gate question. It’s a one-line change, and once it’s in, every future project asks it without you being in the room.

Next in the series: Part 2, “Write It Into the Spec,” shows how to turn your OT security standard into requirements suppliers can quote, build and prove.

If you want a second pair of eyes on a project before detailed design, book a consultation with one of our practitioners.