By Luke Molyneux
In today’s interconnected industrial landscape, whether or not cybersecurity threats are increasing is no longer up for debate. The most valuable discussion now centers on how we collectively address them.
As someone who interacts with companies across the energy landscape from power generation to fuel transportation, I’ve seen firsthand how the conversation around industrial cybersecurity has evolved from an afterthought to a boardroom priority.
The reality is stark. We’re operating in an environment where the collective cost of cybercrime is approaching trillions globally, with “IBM’s Cost of a Data Breach Report 2024” putting the global average cost last year at over $4.88 million.
While the cost is staggering, the potential impact of an attack on critical infrastructure extends far beyond financial repercussions. If, for example, a major power station goes offline due to a cyber incident, the ripples are felt across society, national security and long-term reputation.
What I find encouraging is, rather than simply reacting to threats, our industry is taking proactive steps to build robust defenses. Across the industry, companies have been on this journey for decades, and there are valuable lessons that continue to shape best practice for the broader energy sector.
Certifications Evolving
In the UK, companies have long relied on frameworks such as ISO 9001 – the foundation for quality management systems – and, as the threat landscape has evolved, so too have certifications. Today, organizations pursue ISO 27001:2022 certification, NCSC Cyber Essentials Plus and certifications across the ISA/IEC 62443 family of industrial cybersecurity standards, amongst others.
These certifications represent a commitment to independent, third-party validation of our security practices. They are verification that policies, procedures and security mechanisms meet internationally recognized baselines.
Initial certification typically requires up to a year of preparation, followed by annual surveillance audits and full recertification every three years. For our ISO 27001 certification alone, we must demonstrate compliance with over 100 specific security controls covering everything from threat intelligence and access control to identity management and physical security.
Rather like the analogy of painting Edinburgh’s Forth Bridge, it’s a huge, and ongoing, task that never ends. But what drives this investment and commitment? Increasingly, our customers require evidence of cybersecurity compliance as part of their procurement processes.
Whether it’s a power generation company regulated by Ofgem or an offshore oil and gas operator overseen by the Health and Safety Executive (HSE), these organizations face their own regulatory requirements and need assurance their entire supply chain remains equally committed to security.
This shift reflects a broader understanding cybersecurity is fundamentally about business continuity. A power generation company’s primary goal is to generate electricity reliably. An offshore platform’s mission is to extract resources safely and efficiently. When cybersecurity threats put these core objectives at risk, robust protection becomes critical.
Regulations and Cybersecurity
The regulatory environment has also responded to the growing digital threat. In the UK, Ofgem requires power generators to meet the Cyber Assessment Framework (CAF), while the HSE mandates compliance with standards like OG086 for safety-critical systems. These frameworks, largely derived from the global ISA/IEC 62443 standard, create a comprehensive approach to industrial cybersecurity.
What’s particularly interesting is how these standards have evolved beyond simple compliance. They now emphasize concepts like “defense in depth,” which is the idea that effective cybersecurity requires multiple layers of protection rather than relying on any single control. This mirrors how many engineering and technology providers now approach system design, building in components and mechanisms ensuring continuity even when individual elements fail.
Cybersecurity is increasingly seen less as a product to purchase and more as a collaborative effort. Certified systems end up designed with constant event monitoring capabilities, feeding into security information and event management (SIEM) platforms that apply intelligence to identify potential threats. Organizations can also benefit from cybersecurity risk assessments and architecture gap assessments and training for staff who, unfortunately, remain the weakest link in the security chain.
This consultative approach extends to helping customers navigate the evolving regulatory landscape. Industry experts within organizations also contribute to the ISA/IEC 62443 standards development process, offering insights into current requirements and how these are likely to evolve to address emerging threats.
Modern industrial cybersecurity isn’t just about preventing attacks. It’s also about building systems that can maintain operations, even under stress. This means redundant network infrastructure, segmented networks that limit the potential impact of any single breach, and comprehensive backup and recovery capabilities.
Resilient Approach
We’ve found users value this holistic approach. They want systems not only secure but also resilient, with the ability to continue operating even if individual components fail. This requires careful architecture design, rigorous testing, and ongoing monitoring – all of which are supported through the systematic approach that our certification frameworks provide.
The cybersecurity landscape will continue to evolve, and so will the standards that govern our industry. What won’t change is the fundamental need for trust that systems protecting our critical infrastructure end up designed, implemented and maintained to the highest standards.
Certification provides this trust through independent verification. It gives customers confidence that when they work with certified partners, they’re collaborating with organizations that takes cybersecurity seriously enough to submit to rigorous, ongoing scrutiny.
In an industry where the stakes end up measured not just in financial terms but through the lens of national security and public safety, a commitment to certification is essential. Certifications represent more than compliance; they are a collective commitment to safeguarding what matters most.
Luke Molyneux is the cyber and information security officer for ABB Energy Industries in the United Kingdom.