5 questions board should ask

The better board question

The board does not need to become a firewall engineering team. But the board does need to ask better questions.

Not: “Are we compliant?”

Better: “Can we prove what is exposed?”

Not: “Has the OEM assessed it?”

Better: “Who independently owns the residual-risk judgement?”

Not: “Is the system old?”

Better: “Is the system exposed, unmonitored or unrecoverable?”

Not: “Do we need an upgrade?”

Better: “Have we compared upgrade, virtualisation, isolation and monitoring as risk-treatment options?”

Not: “Do we have a cybersecurity dashboard?”

Better: “Who acts when the dashboard shows something important?”

Beyond Purdue means accountability

The Purdue model helps us describe industrial architecture. But cybersecurity maturity begins when the organisation can answer these questions:

• What do we actually have?
• What is visible from outside?
• What is reachable from inside?
• What is obsolete but isolated?
• What is modern but exposed?
• What is monitored?
• What can be restored?
• Who owns the risk?
• Who is trained to respond?
• Who has authority to decide?

That is the real architecture.

• Not only levels. Ownership.
• Not only zones. Assurance.
• Not only conduits. Accountability.

The future of OT cybersecurity is not another drawing of the Purdue model. It is the discipline to prove that the real plant behaves as the drawing claims.

And when it does not, to fix the exposure before the attacker, the auditor or the board finds it first.

• OEM input is necessary.
• OEM-owned assurance is conflicted.
• Old is not automatically unsafe.
• Exposed, unmonitored and unrecoverable is unsafe.
• Virtualise. Isolate. Monitor. Educate.

That is where the conversation goes beyond Purdue.