In the 16+ years Arcanum has been operating, we have done all sorts of cyber security jobs for all sorts of clients. Some have been large organisations, some small. Some have been in the Public Sector, some in the Private Sector. Some have been very profitable businesses, and some have been very small charities and not-for profit organisations. What did they have in common and why did they come to us? In a series of posts, we will explore the question ‘Why hire a cyber security consultancy?’ Looking back at our records, we’ve worked out that, although there is no single reason, there are some common themes; specialist expertise required, fear, incident response, frameworks, training, compliance and risk management. In this post, we outline the specialist expertise required to secure operational technology. .
Navigating the Landscape: Maturity Review and Collaborative Planning
Where to begin? At Arcanum, we encounter a variety of challenges when helping organisations enhance their cybersecurity posture. While there’s no one-size-fits-all solution, some common themes emerge: the need for specialised expertise, fear, incident response, compliance, and risk management. Let me share a typical engagement with an OT client—a UK-based manufacturer—who approached us in 2021. Their Senior Engineer recognised the importance of securing their industrial environment but, as is common with many of our clients, they didn’t know where to start.
The Starting Point: The ISA/IEC 62443 Standards Our initial conversation for securing their OT revolved around the Cyber Assessment Framework (CAF) developed by the UK’s National Cyber Security Centre (NCSC). This tool helps organisations achieve and demonstrate an appropriate level of cyber resilience. We delved into the client’s business, sites, legal responsibilities, and regulatory compliance requirements. Together, we agreed that adopting the ISA/IEC 62443 Standards would be the best approach for their industrial environments and would achieve measurable and demonstratable cyber security improvements across all four CAF Objectives. The 62443 Standards are specifically designed for securing industrial environments across sectors and sizes, with proven effectiveness.
Understanding the Landscape: Maturity Review and Collaborative Planning To kick off the risk management journey, we conducted an initial maturity review. Understanding the client’s current situation, business objectives, and existing cybersecurity practices was crucial. We collaboratively drafted a customised cyber security improvement roadmap to appropriately secure their operational environment, following a methodical, multi-phase pathway aligned with 62443’s cyber security lifecycle. Together, we identified the threats, vulnerabilities, and consequences across their ICS environments and provided prioritised recommendations and improvements, ensuring effective risk mitigation.
Client Empowerment: Mentorship and Tools Initially led by Arcanum, we gradually handed over responsibilities of the project to the client. We believe in empowering our clients to succeed. If appropriate, we mentor them and provide the necessary tools for ongoing risk management. Our goal is to equip them to handle the project independently when they’re ready.
Tailored Solutions: Beyond Corporate Norms While some projects are complex and span years, we also handle smaller, bespoke engagements. As an NCSC-assured cybersecurity consultancy, we tailor our activities and deliverables to each client’s unique needs. No rigid corporate approaches—just practical solutions. Remember, cybersecurity isn’t a solo journey; it’s a collaborative effort. Let’s secure your digital landscape together!
— Arcanum is a Cyber Security Consultancy, a team of cyber security professionals who, although many have a deep specialisation in one area or another, like incident response, operational technology or security testing, all have a core of extremely competent knowledge of cyber risk management. If you’d like to talk to us about any aspect of managing your cyber risks, please get in touch. Read more from this series: Incident response planning Employee training