Safety & Operational Resilience
Security decisions that must preserve safe degraded operation, physical continuity and engineering authority.
Browse all 10 analyses →Questions this collection helps you examine
- Can containment preserve safe degraded operation?
- Where could shared dependencies undermine safety independence?
- What evidence connects a security change to the operational decision?
Each analysis keeps the incident evidence, deployment assumptions and practical decision together. Use the collection to compare cases across sectors.
Analysis, newest first
All decision collections →NIST SP 800-82 Rev. 4 Moves OT Security Closer to Enterprise Risk Governance
The new draft expands OT scope, aligns the guide with CSF 2.0 and puts greater weight on governance, asset visibility, monitoring and security architecture without ignoring safety and availability constraints.
Use the Rev. 4 draft as a governance signal: connect enterprise cyber risk to plant-level architecture and evidence while preserving OT safety, availability and lifecycle constraints.
R155 and R156 Keep Cybersecurity Inside the Type-Approval Chain
Cybersecurity management evidence, software-update governance and vehicle approval cannot be treated as independent compliance files.
Maintain explicit traceability between CSMS/SUMS evidence, approval authority, vehicle type, software identity and change history.
Trusted Robot Code Does Not Prove Trusted Motion
USENIX Security 2026's TAT research makes a cyber-physical integrity gap explicit: verifying software execution is not the same as proving an industrial robot followed the authorised trajectory.
Use consequence-based, independent evidence to close the gap between trusted robot execution and trusted physical motion; do not assume software integrity proves process integrity.
The Bendix EC80 Recall Shows Why Safety Fixes Need a Cybersecurity Handoff
VehicleSec 2026 research found exploitable flaws in legacy J2497 processing removed by a safety-driven EC80 firmware update. The governance question is when safety corrective action should trigger adversarial review.
Define a safety-to-cyber handoff trigger based on affected interfaces and adversarial reachability, rather than adding cybersecurity review to every safety corrective action.
An OT Alert Is Not Protection Until It Becomes a Safe Physical Action
The Minnesota water attacks show why detection, manual operation and cyber-physical decision handoffs must be rehearsed before the process forces the decision.
Treat cyber-physical exercises as an operational control: rehearse the evidence, authority and manual-operation handoffs that turn OT detection into safe process action.
Safety Independence Must Survive a Cyber Compromise
If control and safety share the same identities, engineering paths or infrastructure, a cyber incident can turn nominal independence into common-mode failure.
Test safety independence against cyber common-mode failures, not only against equipment faults.
Legacy Rail Assets Do Not Become Secure Because the Policy Improved
New cybersecurity requirements have to be translated into compensating architecture around assets that cannot be patched, authenticated or replaced quickly.
Use zoning, conduits and controlled maintenance to reduce authority around legacy rail assets without destabilising the certified core.
Industrial 5G Makes Radio Availability Part of the Safety and Production Model
Private 5G can provide strong identity and segmentation while still remaining physically vulnerable to selective interference.
Design private 5G as an OT resilience dependency with spectrum monitoring and explicit degraded modes.
EV Charging Security Is Becoming Grid Resilience
The risk is not one compromised charger. It is coordinated control across an ecosystem that can aggregate into material grid behaviour.
Measure EV charging cyber risk in controllable megawatts and recovery time, not only in compromised endpoints.
When a Security Patch Collides with the Safety Case
A security patch can be technically urgent and still require a safety-aware assurance path before it reaches signalling or other safety-related railway functions.
Pre-classify cyber mitigations by their impact on the safety case and define the approval path before a critical CVE creates operational urgency.