OT CYBER SECURITY / AN EVIDENCE BRIEF
The policy says it works.
What does the evidence show?
Reading OG86 in context, and preparing a meaningful operational-security review.
START WITH THE CURRENT SOURCE
HSE links OG86 as
an archived resource.
The live HSE cyber-security page explains the major-hazard context and links to the archived guidance. Confirm the applicable guidance and inspection expectations with the relevant regulator.
Cyber security belongs in the safety discussion.
Where control and safety systems help prevent a major accident, a cyber problem can affect more than information. HSE’s published guidance connects industrial-system security with the overall safety of plant and equipment.
OG86 was first published in 2017 as operational guidance for inspectors. The HSE page now directs readers to the National Archives for that document. Treat that history explicitly rather than assuming an old checklist is the whole current inspection benchmark.
THE EVIDENCE FILE
Make the link from risk
to real arrangements.
Use the following as review prompts with the people responsible for your site. These are suggested evidence headings, not a regulator-issued checklist or a guarantee of an inspection outcome.
FILE 01
The consequence
Describe the process or safety function that could be affected. Explain the consequence in operational terms and record the assumptions behind the assessment.
Look for: a clear scope, an accountable owner, and an assessment grounded in the actual plant.
FILE 02
The arrangement
Choose a control relevant to that risk, such as a supplier-access or change-approval arrangement. Ask the people who operate it to explain what happens in practice.
Look for: approved responsibilities, records of use, and exceptions that someone has assessed.
FILE 03
The result
Identify what has been checked or exercised, what was learned, and how any gap is being addressed. Keep the evidence connected to the risk it is intended to manage.
Look for: results, unresolved issues, and a named person responsible for the next review.
USE THE RIGHT CONTEXT
Several references can inform the work.
They do not remove site judgement.
The NCSC Cyber Assessment Framework and ISA/IEC 62443 provide related assessment and industrial-security references. Their use, scope, and applicability need to be understood for the site and sector involved.
Avoid translating a framework into an automatic pass, or assuming that one set of controls satisfies every safety, cyber, and reporting obligation.
READING DESK
Keep the sources and their status clear.
HSE cyber security
Start with the live explanation of industrial-system cyber risks and HSE’s linked resources.
OG86 archive
Use the archived document as the historical reference linked by HSE; check what applies to your current review.
Trial inspection findings
Read the summary of HSE’s November 2017–May 2018 trial inspections as historical findings, rather than a current survey.
Related references: NCSC Cyber Assessment Framework and ISA/IEC 62443 information.
Bring the evidence back to the process.
CyberSolace can help you organise the cyber-risk discussion and identify the evidence your operational team needs to examine.
SOURCES & REVIEW
HSE cyber-security page · OG86 archive linked by HSE · HSE trial findings. Source status checked 20 October 2026. This briefing does not give a legal opinion or replace regulator-specific, engineering, or safety advice.
Originally published 24 March 2017. Resource links and presentation reviewed 20 October 2026.