At an industrial enterprise, a cyber incident can stop a production line, disrupt a technological process or affect people’s safety. Therefore, ISO 27001 for industry begins with understanding the production environment: which systems control equipment, what their availability depends on, and who is authorised to change their settings.
ISO/IEC 27001:2022 sets out requirements for an information security management system (ISMS): the organisation defines its scope, assesses risks, selects security controls and evaluates their effectiveness. The standard allows the specific characteristics of the enterprise to be taken into account, but it does not in itself replace engineering solutions for industrial control systems. For industrial environments, the approaches set out in the ISA/IEC 62443 series, which focuses on the security of industrial automation and control systems, are also useful.
Start by Defining the OT Boundaries
A common mistake is to include industrial control systems in an existing corporate ISMS with a single line: ‘production network’. This is not sufficient to assess the consequences of an incident or assign responsibility.
Together with process engineers and operations teams, compile an inventory of controllers, operator workstations, engineering workstations, SCADA servers, network equipment and communication channels. Separately identify the systems on which process shutdown and personnel safety depend. For each critical asset, record the owner, supplier, software version, connections to other systems and acceptable downtime.
Then define the ISMS boundary: which workshops, sites, services and connections are included now, and which are planned to be covered later. If the enterprise operates across several sites in Kazakhstan, Uzbekistan, Georgia or Kyrgyzstan, the boundaries and responsibilities should be defined for each location. This helps avoid a situation where the documentation states that the ‘plant’ is protected, while actual access to equipment at a remote site remains outside the assessment.
Assess Risk Through Its Impact on Production
In an office IT environment, an update or restart can often be scheduled for the next maintenance window. In OT, even a brief disruption can have very different consequences. When assessing risk, consider not only data leakage, but also loss of control, incorrect changes to parameters, production stoppages and threats to people’s safety.
A useful question for the CISO and the head of production to discuss together is: what will happen if this node becomes unavailable or starts transmitting incorrect data? The answer determines the priority of security measures. For example, for a legacy engineering workstation that cannot be updated quickly, the organisation may restrict network connections, place it in a separate segment, monitor user activity and prepare a tested recovery procedure. The choice of such measures and any related limitations should be documented, while the residual risk should be escalated to an authorised manager for a decision.
In this way, OT cybersecurity in Kazakhstan becomes part of production risk management rather than a separate list of IT configuration measures.
Make Contractor Remote Access Manageable
Equipment suppliers and service providers often connect to industrial control systems for diagnostics. A permanent shared account or an unregistered communication channel prevents the organisation from answering simple questions: who connected, for what purpose, and what they changed.
A practical process should include a request stating the purpose of the work and the specific equipment involved, approval from the operations team, an individual user account, time-limited and role-limited access, session logging, and access revocation once the task has been completed. Connections should be made through a controlled access point, and any actions that could affect the process should be agreed with the person responsible for the relevant technology. CISA guidance on remote access to industrial systems also treats secure connectivity, monitoring and vendor access as components of the overall protection framework.
Procurement also has a role to play: requirements relating to access, incident notification and completion of work should be included in the contractor agreement from the outset. This ensures that contractor remote access is governed by one clear process rather than by informal arrangements between individual specialists.
How to Verify That the ISMS Works on Site
Start with one critical production line or area. Review the asset inventory and network diagrams, work through two or three realistic risk scenarios, agree on contractor access rules, and conduct an incident exercise together with the production team. Then extend the approach to other areas.
Evidence that the ISMS is working should not be limited to approved policies. It is important to see that access rights are revoked on time, changes go through approval, logs are retained, backups are suitable for recovery, and employees know who is responsible for making decisions during an incident. Management should receive information about unresolved risks and the resources required to reduce them.
For organisations planning to implement or extend an ISMS into OT environments, service can serve as a starting point System Management ISO/IEC 27001:2022. The key practical objective is to link management system requirements with real production conditions and clearly allocate responsibilities between security teams, operations personnel and site management.