Description

This curriculum spans the equivalent of a multi-workshop program typically delivered during the integration of cybersecurity into capital project lifecycles, covering strategic planning, procurement, deployment, and long-term sustainment across industrial and operational technology environments.

Module 1: Strategic Alignment of Security with Capital Projects

Integrate network security requirements into capital project charters during the feasibility phase to ensure funding and accountability.
Conduct joint risk assessments with engineering and finance teams to prioritize security controls based on asset criticality and lifecycle.
Define security performance indicators (SPIs) that align with capital project milestones for governance reporting.
Establish a security review gate at each stage of the capital project lifecycle (concept, design, execution, commissioning).
Negotiate security scope inclusion in engineering, procurement, and construction (EPC) contracts to enforce vendor compliance.
Balance upfront security investment against long-term operational risk reduction in business case evaluations.

Module 2: Secure Design Principles for Industrial and OT Networks

Implement zone and conduit models in network segmentation for process control systems based on ISA/IEC 62443 standards.
Select between air-gapped architectures and monitored demilitarized zones (DMZs) based on operational availability and data exchange needs.
Specify secure-by-design network topologies (e.g., ring, star) that support redundancy without compromising traffic inspection capabilities.
Enforce secure remote access protocols (e.g., IPsec, TLS-terminated jump hosts) for distributed capital assets.
Design network addressing schemes that support asset tracking and facilitate intrusion detection through predictable traffic patterns.
Integrate secure time synchronization (e.g., authenticated NTP or PTP) to support logging integrity and forensic analysis.

Module 3: Procurement and Vendor Risk Management

Require vendors to provide Software Bills of Materials (SBOMs) for network equipment and embedded systems during procurement.
Enforce contractual obligations for vulnerability disclosure timelines and patch delivery schedules in equipment supply agreements.
Conduct pre-deployment security validation of network devices using independent lab testing or third-party certification.
Assess vendor cybersecurity maturity using frameworks such as NIST CSF or SIG questionnaires before awarding contracts.
Restrict use of end-of-life or unsupported network hardware in capital projects to reduce long-term maintenance risk.
Define secure configuration baselines in procurement specifications to prevent default or weak settings in delivered systems.

Module 4: Secure Deployment and Commissioning

Perform network configuration audits prior to system handover to verify alignment with security hardening standards.
Implement change control procedures that require security sign-off for any network modifications during commissioning.
Deploy network monitoring sensors at project handover to establish baseline traffic profiles for anomaly detection.
Validate encryption implementation for data in transit across critical network segments (e.g., SCADA to historian).
Conduct penetration testing on newly deployed network infrastructure before operational release.
Document network architecture, firewall rules, and access control lists as part of the asset security baseline.

Module 5: Integration with Legacy and Brownfield Systems

Map legacy protocol traffic (e.g., Modbus, DNP3) to modern network zones using protocol-aware firewalls or data diodes.
Deploy inline security appliances to inspect and filter traffic between legacy OT systems and new IT networks.
Assess the risk of protocol translation gateways introducing covert channels or single points of failure.
Implement compensating controls (e.g., network behavior analytics) where encryption or authentication cannot be natively supported.
Coordinate network cutover schedules with operations to minimize exposure during integration phases.
Retain physical network access controls (e.g., locked cabinets, port security) when extending connectivity to legacy systems.

Module 6: Asset Lifecycle and Sustainment Planning

Establish a network asset register that tracks hardware age, firmware versions, and support status for refresh planning.
Define end-of-support migration paths for network infrastructure to avoid unplanned capital outlays.
Integrate security patching windows into maintenance schedules without disrupting production operations.
Conduct periodic network architecture reviews to address obsolescence and evolving threat landscapes.
Allocate capital reserves for unplanned security upgrades triggered by critical vulnerabilities in deployed systems.
Enforce decommissioning procedures that include secure data erasure and network configuration removal.

Module 7: Governance, Compliance, and Audit Readiness

Align network security controls with industry-specific regulations (e.g., NERC CIP, TSA directives) in capital project documentation.
Maintain version-controlled network security architecture diagrams for audit and incident response purposes.
Implement automated configuration compliance checks using tools like SCAP or custom scripts for continuous validation.
Prepare network access logs and change records to support forensic investigations during regulatory audits.
Coordinate internal and external audit schedules with capital project timelines to avoid operational disruption.
Document risk acceptance decisions for deviations from security standards with executive and legal review.

Module 8: Incident Response and Resilience for Capital Assets

Design network segmentation to contain cyber incidents without triggering full production shutdowns.
Pre-stage forensic toolkits and network packet capture devices at critical capital facilities for rapid response.
Integrate network detection and response (NDR) systems with existing security operations centers (SOCs) for centralized monitoring.
Conduct tabletop exercises simulating ransomware attacks on OT networks to validate response playbooks.
Ensure backup network paths and manual override capabilities are available during cyber incidents.
Define criteria for when to isolate compromised network segments versus maintaining operational continuity.