PDF · free download, no form
Want the next one?
Optional. The download above never asks for your email.
Get the OT briefing
By subscribing, you agree to receive the OT briefing by email from Hillstrong Group Security, Atlanta, GA. Unsubscribe at any time with the link in every email. See our privacy policy.
// ebook
The OT Governance Playbook for Manufacturing CISOs
Roger Hill ·
The OT Governance Playbook is Roger Hill’s guide for manufacturing CISOs who have OT standards, committees, and org charts but still lose control of plant risk. It argues that OT governance works when someone above the plant sees the risk, named people own each decision, and the exception process holds up under production pressure.
What is inside
- Chapter 1. OT cyber risk needs senior visibility above the plant level
- Chapter 2. Named leadership and named system ownership matter more than the org chart
- Chapter 3. OT governance has to cross security, engineering, operations, and safety
- Chapter 4. A useful OT RACI starts with decision rights, not departments
- Chapter 5. OT exceptions, vendor access, and connectivity expose whether governance is real
Local exceptions become enterprise exposure
Roger opens with a familiar pattern. One site grants an OEM remote access. A second site does the same, and a third inherits it during a line expansion. Nobody hides it, and by the time corporate security sees it, the company has standardized its exposure. That is his case for putting material OT risk in front of senior leaders and directors.
Ownership and the forum
The org chart tells you where people report. It does not tell you who makes a costly call when the line is running hot and the vendor needs access. Roger asks for an enterprise owner for standards and reporting, and a site owner for local facts and execution. The cross-functional forum then reviews major exceptions, resolves cross-site issues, ranks shared initiatives, and sponsors exercises and post-incident reviews. Roger notes that a tabletop can expose weak governance in thirty minutes.
Five decision rights
The RACI chapter replaces department boxes with five decisions, ending with incident authority and third-party access. The final chapter treats exceptions as evidence of where the standard does not fit the plant and where vendors shape your trust boundary.
To turn these decisions into owned work at each site, see OT governance operationalization. For the vendor access model, see third-party vendor risk management.
Download the free PDF from this page. No form, no email required.