Risky Business: Maturing OT Security With Executives

This Dragos guidance argues that industrial cyber risk must be framed and measured in business-relevant terms rather than IT-centric qualitative "traffic-light" formats, and provides an OT-specific risk management process to do so. It details preparatory cyber risk characterization, threat profiling, customized impact analysis, qualitative and quantitative risk evaluation, treatment options, continuous monitoring via a risk register, and risk communication tactics aimed at improving executive understanding and aligning cyber risk with safety, reliability, and business continuity programs.