Cyber Risk Management for Cyber-Physical Systems (CPS)

All cybersecurity disciplines and personnel in all sectors share the same overarching goal: to reduce cyber risk. But for those in industrial, healthcare, and other critical infrastructure sectors where cyber-physical systems (CPS) underpin operations, that goal is spiraling out of reach.

Here’s one reason why: simply assessing and prioritizing — much less reducing — cyber risk in CPS environments requires a departure from many of the conventional methods and solutions that have long enabled chief information security officers (CISOs) and their teams to manage cyber risk in information technology (IT) environments. And with an estimated 95% of CISOs in critical infrastructure sectors now responsible for securing not only IT but also CPS, more and more are coming face-to-face with the harsh realities of this highly consequential situation.

The remainder of this guide will draw from Claroty’s firsthand experience working with CISOs and other cybersecurity practitioners to support their CPS security journey. Our primary focus will be on the basics of a core objective of that journey: CPS cyber risk management.