A poll of energy and infrastructure professionals found accountability for industrial control system cybersecurity is currently split three ways – while a quarter of respondents couldn’t say where it sits at all.
Ask a control-room engineer who is responsible for the cybersecurity of the power plant they run and you might find a surprising lack of consensus. At a recent Fortinet-hosted webinar on IT/OT convergence, a live poll of 62 energy and infrastructure professionals found 39% pointing to the CISO or IT team, 18% naming engineering and operations managers, with 26% saying accountability was currently unclear or fragmented. Only 18% named a dedicated, cross-functional IT and OT team, a model many organisations are increasingly adopting to better align cybersecurity and operational requirements.
The results illustrate a challenge many critical infrastructure operators face as IT and OT environments become increasingly interconnected. A power station, a water treatment plant or a substation today runs through a chain of utilities, engineering consultants, systems integrators, equipment manufacturers and cybersecurity vendors. Each party controls one piece of the environment. Three structural habits, built up over decades rather than designed on purpose, explain why the chain still struggles to answer this simple question quite often.
The first habit sits in how equipment changes hands. Thapelo Seepe, managing director of KampfAdlerX and a veteran of 18 years designing OT control systems at ABB, described it on the panel: original equipment manufacturers (OEMs) typically hand over operating manuals and maintenance manuals, protecting their intellectual property, but rarely the engineering manuals underneath. A utility can run the plant day to day. Diagnosing or redesigning what sits beneath the surface still means calling the OEM. Seepe’s description for the result was a black box.
The second sits in the contract. When an OEM installs a system, a service-level agreement usually governs exactly how it can be operated, monitored or changed. Add a security control outside those terms and an organisation risks breaching the agreement that keeps its equipment supported. If a breach happens inside that constrained environment, the OEM carries no obligation for the resulting losses. The organisation running the plant does, whether or not it had the authority to prevent the breach in the first place.
The third sits in regulation. Energy analyst Chris Yelland, managing director of EE Business Intelligence, spoke to the absence of a single South African body with a specific mandate over cybersecurity in the energy sector. The National Energy Regulator of South Africa (NERSA) regulates the price of electricity charged by Eskom and the municipalities; its remit was never extended to the technical security of the systems producing that electricity. South Africa currently lacks a single, energy-sector-specific framework that mandates consistent OT asset inventory management and incident reporting requirements across all operators. Accountability, when something goes wrong, has nowhere predetermined and fixed to land.
The model in Singapore shows us a different route, with the establishment of an independent cybersecurity authority that coordinates across its critical infrastructure sectors, rather than leaving each one to its own devices. South Africa has yet to build an equivalent.
A vacuum this large rarely gets filled through one contract or one piece of legislation. Seepe’s own closing point on the panel gets closer to a working answer: when the company that built a control system and the company securing it operate from the same information, the utility running the plant stops carrying risk it was never equipped to manage alone. That conversation, between OEMs, integrators, utilities and security providers is one most of these organisations have not yet had – and one that is becoming increasingly critical.
Without clear ownership, organisations struggle not only to manage operational risk but also to maintain visibility of OT assets, implement consistent security controls, and respond effectively to cyber incidents. Establishing clear accountability, maintaining visibility across OT assets, and fostering collaboration between engineering, operations and cybersecurity teams are vital first steps.
