Typical situations
Industrial barrier methodology
If one of these sounds familiar, a structured risk assessment is usually the right next step.
Konsekvensen avhenger av hva den digitale handlingen kan få den fysiske prosessen til å gjøre.
From cyber event to physical consequence
The consequence depends on what the digital action can make the physical process do.
Cyberrisikovurderingen bruker konsekvensene og barrierene fra prosessikkerhetsanalysen som grunnlag.
Basert på IEC 62443-3-2:2020, IEC 61511-1 (8.2.4) og ISA-TR84.00.09-2023. Sektorrammeverk: prosessindustri (ISA-TR84.00.09-2023), jernbane (CLC/TS 50701, IEC 63452 under arbeid).
Lumiar-synteseRisk assessment under IEC 62443-3-2, with process safety
The cyber risk assessment uses the consequences and safeguards from the process safety analysis as its basis.
Based on IEC 62443-3-2:2020, IEC 61511-1 (8.2.4), and ISA-TR84.00.09-2023. Sector frameworks: process industry (ISA-TR84.00.09-2023), railways (CLC/TS 50701, IEC 63452 in progress).
Lumiar synthesisDelivery and method
Credibility over false precision
The analysis is run as a workshop series with your key personnel. Established barrier methodology (HAZOP, LOPA, bow-tie, and others) is combined with interviews with the people who know the systems, and with risk assessment according to IEC 62443‑3‑2. Threats to control and safety systems are assessed in the same framework as process safety, so the result feeds straight into your barrier management. For high-consequence scenarios, we first assess whether the threats are credible, and start with the worst consequence for the essential functions. IEC 62443-3-2 requires such an initial worst-case assessment (ZCR 2.1) and allows methods that consider consequence only (ZCR 5.4). We assess likelihood afterwards, based on national threat assessments or your own assessments. If your organization uses likelihood in its methods, we adapt the assessment to them, including when there is little historical data.
Listen to “Credibility, Not Likelihood” →IEC 61511-1, requirement 8.2.4 (security assessment of the SIS)
ISA-TR84.00.09-2023 (cybersecurity in the safety lifecycle)
Offshore Norge 104, CSBR 2
HAZOP · LOPA · bow-tie
Scope and format
Å telle beskyttelseslag er ikke nok hvis ett cyberangrep kan slå ut flere av dem samtidig.
Basert på ISA-TR84.00.09-2023, vedlegg D og avsnitt 6.6.2.
Lumiar-synteseAttack paths and independent safeguards
Counting protection layers is not enough if a single cyberattack can defeat several of them at once.
Based on ISA-TR84.00.09-2023, annex D and section 6.6.2.
Lumiar synthesisStart med det som ikke må skje. Finn deretter det som ikke må svikte.
Basert på IEC 62443-3-2:2020 (ZCR 2.1 og 5.3) og Offshore Norge 104 rev. 7 (CSBR 2, krav 2-2, og anbefalt kritikalitetsvurdering).
Lumiar-synteseConsequence first
Start with what must not happen. Then identify what must not fail.
Based on IEC 62443-3-2:2020 (ZCR 2.1 and 5.3) and Offshore Norge 104 rev. 7 (CSBR 2, requirement 2-2, and the recommended criticality assessment).
Lumiar synthesisÅ oppfylle grunnkravene betyr ikke at restrisikoen er akseptabel.
Basert på Offshore Norge 104 rev. 7, kapittel 1.1: grunnkravene er minimumskrav for typiske løsninger og erstatter ikke virksomhetens egen risikovurdering.
Lumiar-synteseThe baseline requirements are the floor
Meeting the baseline requirements doesn’t mean the residual risk is acceptable.
Based on Offshore Norge 104 rev. 7, chapter 1.1: the baseline requirements are minimum requirements for typical solutions and don’t replace the organization’s own risk assessment.
Lumiar synthesisSårbarheter prioriteres etter risikoen de gir i det faktiske anlegget.
Grunnlag: Offshore Norge 104 rev. 7, CSBR 7. Nå/Neste/Aldri er en metode som veiledningen foreslår. Kravene i sidefeltet er krav 7-4 og 7-5.
Lumiar-synteseNow, Next, Never
Vulnerabilities are prioritized by the risk they pose in the actual plant.
Basis: Offshore Norge 104 rev. 7, CSBR 7. Now/Next/Never is a method suggested in the guidance. The requirements in the side panel are requirements 7-4 and 7-5.
Lumiar synthesis