The asset is critical by law. The obligations follow the asset, not the intent.

Control systems, SCADA and industrial networks were built for reliability and safety, on the assumption of isolation. Positive Security Obligations now ask for cyber assurance across systems many operators have never formally assessed.

• Legacy OT with limited native security or logging capability
• IT/OT convergence points added faster than security controls kept pace
• Incident detection tuned for safety events, not cyber events

Risk-management programme obligations and, for the most critical assets, personal director accountability mean the board is now a stakeholder in operational technology risk it may never have reported into before.

• No standing risk-management programme reporting cadence to the board
• Unclear ownership between IT, OT and physical security functions
• Incident response plans that have not been exercised against a realistic scenario

Maintenance contractors, equipment vendors and managed service providers frequently hold privileged access to operational systems, often with less scrutiny than the operator applies to its own staff.

• Vendor remote access without consistent security baselines
• Equipment and firmware supply chains difficult to assess for provenance
• Managed service providers operating outside the operator's own monitoring