// resources · by role
Resources for CISOs who own OT risk
A CISO who owns OT risk has to report it to the board in business terms and fund work at plants they do not run. These resources cover materiality, governance across sites, and the briefings that get OT work funded.
See how we work with this role on our page for CISOs.
Field notes (40)
-
· Roger Hill
Your Capital Plan Is Already a Security Plan
Capital projects set how plants connect, get vendor support, and recover for decades. Four light additions give the CISO a seat in every design review.
-
· Roger Hill
From Asset Inventories to Stop-the-Line Maps
Build a one-page stop-the-line map for each production line: six columns, a named owner per entry, and a restoration time measured with a stopwatch.
-
· Roger Hill
Who Can Still Log Into Your Factory at 2:00 A.M.
Why OT access reviews miss vendor paths like OEM tools, jump hosts, and cellular modems, how Akira bypassed MFA, and why every path needs an expiry date.
-
· Chuck Tommey
The Critical Infrastructure Hat: When Your Asset Belongs to the Grid
Critical infrastructure incident clocks compared: one hour under NERC CIP-008-6, 12 under SOCI, 24 under NIS2, and why to build for the tightest one.
-
· Chuck Tommey
The Operator Hat: The Service You Sell Is the Attack Path You Own
How OEM service access becomes a multi-customer attack path, what NIS2 Article 21 and service contracts demand, and three fixes, from tenant isolation to MFA.
-
· Chuck Tommey
The Product Hat: Every Unit You Shipped Is Still Your Problem
What the EU Cyber Resilience Act means for connected hardware: 24-hour vulnerability reports, an SBOM, five-year support, and the September 2026 deadline.
-
· Chuck Tommey
The Enterprise Hat: When Cyber Risk Reaches the Boardroom
How NIS2 Article 20, SEC Item 1.05, and the SOCI Act moved cyber risk to the board, from turnover-based fines to management bans, and three moves to make.
-
· Hillstrong Group Security
OT Exceptions, Vendor Access, and Connectivity Expose Whether Governance Is Real
A credible OT exception process names a risk owner, documents constraints and compensating controls, sets review dates, and escalates repeat patterns.
-
· Hillstrong Group Security
A Useful OT RACI Starts With Decision Rights, Not Departments
A working OT RACI assigns five decisions: enterprise standards, site implementation plans, exception approval, incident authority, and vendor access.
-
· Hillstrong Group Security
OT Governance Has to Cross Security, Engineering, Operations, and Safety
OT governance works when security, engineering, operations, safety, and risk decide together. Who belongs in the forum, and five failure modes to watch for.
-
· Roger Hill
The Competitive Advantage of Disclosure Readiness: Why the Best Manufacturers Will Embrace Transparency
How OT disclosure readiness wins manufacturers better insurance terms, investor confidence, and customer trust, and five steps that start with materiality.
-
· Roger Hill
Building a Board-Ready OT Materiality Framework Before You Need It
Pre-define OT incident materiality across five dimensions (production, safety, environment, regulatory, insurance) with a four-level escalation protocol.
-
· Roger Hill
Incident Forensics vs. Disclosure Timelines: The Manufacturing Double Bind
OT forensics take weeks, but the SEC expects materiality calls without undue delay. Learn five steps to prepare now, from PLC baselines to forensic retainers.
-
· Roger Hill
The OT Disclosure Gap
Why most manufacturers' 10-K Item 1C omits OT risk, a sample OT-inclusive disclosure, and five steps to close the gap before your next annual filing.
-
· Roger Hill
The Clock Nobody Planned For
Why the SEC's four-business-day Form 8-K clock breaks on OT incidents, and how to score production, safety, environmental, regulatory, and insurance impact.
-
· Hillstrong Group Security
Governance and Reporting That Scales
Scale OT governance with live dashboards, tracked approvals, and cross-framework reports. One manufacturer cut board reporting from three weeks to half a day.
-
· Hillstrong Group Security
Operational Translation for OT Security
Operational translation rewrites OT security controls in terms of uptime, safety, and recovery time, so plant engineers see what each control protects.
-
· Hillstrong Group Security
Agile OT Assessments That Fit Plant Schedules
Agile OT assessments use five-minute micro-sessions, role-based routing, and plain language. One food manufacturer lifted completion from 40% to 95%.
-
· Hillstrong Group Security
OT Framework Alignment with AI
AI framework alignment maps one evidence set across IEC 62443, NIS2, SOCI, and NERC CIP. One energy company cut audit preparation time by 40% through reuse.
-
· Roger Hill
Building Resilient, Explainable AI Systems: The Hard Truth About Trustworthy Autonomy
Industrial AI earns trust through explainability, testability, and recoverability. See the five actions executives should take before scaling AI in plants.
-
· Roger Hill
When Cyber-Physical Systems Collide with Privacy and IP: Preparing Manufacturing for AI’s Next Chapter
How AI turns plant data into privacy and IP exposure, from vision systems that capture biometrics to PLC files sent to vendors, and five board guardrails.
-
· Roger Hill
OT Security Meets AI: Blind Spots in the Plant Floor
AI anomaly detection works like a flashlight. It sees only the data you collect. Find where OT monitoring goes blind and how to report those gaps to the board.
-
· William Noto
Resilion is the OT Security Execution Engine that Scales People & Process
Learn how Resilion turns OT visibility into action with tier-based work streams, RACI mapping, and evidence aligned to IEC 62443, NIST CSF 2.0, and NIS2.
-
· Hillstrong Group Security
Resilion in Practice: From Plant Floor Strategy to Executive Confidence
Resilion helps manufacturers carry an OT security plan into each plant with shared task threads, playbooks set by site tier, and evidence logged as work runs.
-
· Hillstrong Group Security
How Resilion Puts OT GRC Into Practice Across Your Sites
Resilion runs OT GRC in three pillars (Build, Execute, Manage) that produce IEC 62443 artifacts, site workflows, and audit evidence in days, not months.
-
· Hillstrong Group Security
Hillstrong Launches Resilion, an AI Execution Platform for OT Cybersecurity
Hillstrong launched Resilion, an AI platform that turns OT security roadmaps into site-level work with RACI, evidence capture, and audit-ready reports.
-
· Hillstrong Group Security
What Is Operational Risk Costing You?
The five cost categories of OT operational risk, from downtime to lost contracts, and a simple method to build a risk-adjusted exposure estimate in dollars.
-
· Hillstrong Group Security
12 Plants, 12 Programs: Why Site-Level Risk Can’t Scale
Separate OT security programs at each plant leave leaders unable to compare risk across sites. A tiered governance model with shared metrics fixes that.
-
· Hillstrong Group Security
The Silent Drift: Operational Gaps That Compound Into Crisis
How operational drift builds OT risk through forgotten firewall exceptions, live vendor accounts, and USB workarounds, and what plant and CISO leaders can do.
-
· Roger Hill
When Patching Won’t Protect Your Factory
Why patch metrics miss most OT outages: in most disruptions Hillstrong reviewed, an operational failure caused the outage. Map dependencies instead.
-
· Roger Hill
The Value Gap in OT Security: From Telemetry to Trust
Why OT visibility tools produce findings but not decisions, how one team reframed 280 high-risk findings by consequence, and how to make telemetry useful.
-
· Roger Hill
The OT Risk the CFO Can’t See
Why patch counts and scan stats fail at the executive table, how one contractor credential caused a $3.1 million outage across four sites, and what to report.
-
· Roger Hill
How to Build a Sustainable OT Vulnerability Management Program
A lasting OT vulnerability management program needs an OT-specific RACI, central governance with site flexibility, tracked exceptions, and a steady cadence.
-
· Roger Hill
Jump Boxes and Workarounds Become Risk Nobody Owns
Improvised OT controls like jump boxes and ad hoc segmentation turn into risk nobody owns. Four steps bring them back: inventory, tier, assign, and retire.
-
· Hillstrong Group Security
Mapping OT Business Risk Using the QUICK Framework
The QUICK framework scores OT assets on Quality, Uptime, Information Integrity, Compliance, and Key Deliverables to rank vulnerabilities by business impact.
-
· Roger Hill
The RISE Model: Prioritizing OT Vulnerabilities Where It Matters Most
The RISE model (Risk, Impact, Scoring Improvement, Effort) ranks OT vulnerabilities when CVSS misleads. A five-device example shows how the order changes.
-
· Roger Hill
Passing the Audit Does Not Mean the Plant Will Keep Running
A plant can pass every cyber audit and still stop when cloud identity or a VPN fails. Map IT-OT dependencies, test failover, and ask the board three questions.
-
· Roger Hill
How to Recalculate CVSS Scores in an OT Context
Raw CVSS base scores mislead in OT. Recalibrate them in five steps using asset role, network context, compensating controls, and business process impact.
-
· Roger Hill
What CFOs Wish CISOs Knew
How CISOs keep OT security funded in a recession: show downtime cost per facility tier and day 1, 3, and 10 exposure, and pitch uptime risk reduction instead.
-
· William Noto
OT Security Execution Checklist
A five-part checklist for evaluating any OT security execution platform: framework alignment, plant-paced assessments, translation, collaboration, and reporting.
Talk it through with a practitioner
Book a 30-minute consultation with a senior OT security practitioner about your plants.