In September 2025, the Clusif (French Information Security Club) released an updated version of its guide on industrial systems cybersecurity, the result of a collaborative effort that began in 2013. This reference document, developed by CISOs, architects, software vendors, and consultants specializing in industrial IT security, responds to a growing urgency: the multiplication of cyberattacks targeting critical infrastructures and production systems.
For executives, CIOs, and CISOs in the industrial sector, this guide represents far more than a mere technical resource. It provides a structured framework to transform industrial cybersecurity governance from an operational constraint into a true strategic lever. With the growing interconnection between IT and OT, the rise of Industry 4.0, and the tightening of regulatory requirements (NIS2, DORA), mastering industrial systems security has become an imperative for competitiveness and resilience.
Let’s explore the major contributions of this guide and how to leverage it to strengthen your security posture.
Understanding the Challenges of Industrial Cybersecurity
Industrial systems have long operated in isolation, separated from traditional IT networks. That era is over. SCADA, DCS, and other industrial control networks now manage the vital infrastructures of our society: power grids, water treatment, chemical industries, transportation, and building management.
Traditional IT security (InfoSec) approaches cannot be directly applied to SCADA and industrial systems. It is essential to understand the operational context, communicate with automation engineers, know the relevant industrial standards (IEC 62443, NERC CIP), and respect operational constraints that differ radically from enterprise IT.
The Scale of the Industrial Cyber Threat
The surge in cyberattacks targeting industrial environments has significantly increased awareness among businesses and the public. Major incidents have demonstrated that a cyberattack can paralyze entire factories, endanger human safety, and cause massive financial losses.
Colonial Pipeline in the U.S. (2021), JBS Foods, Norsk Hydro, and Saint-Gobain: these well-known cases highlight a worrying trend. Cybercriminals are now deliberately targeting industrial systems, aware of their high-impact potential and the victims’ willingness to pay substantial ransoms to restore production quickly.
Our society’s growing dependence on industrial production systems amplifies the potential consequences. A successful attack against a power plant, water treatment facility, or transportation system can affect millions and trigger cascading effects.
Industrial cybersecurity audits frequently reveal critical vulnerabilities: outdated unpatchable systems, default passwords, lack of network segmentation, and limited visibility on OT traffic. The Clusif guide addresses these blind spots directly.
Key Themes of the Clusif 2025 Guide
Industrial Context–Adapted Cybersecurity Governance
The first major theme concerns cybersecurity governance tailored to industrial environments. Unlike traditional IT, where planned downtime for security maintenance is acceptable, OT always prioritizes availability and operational safety.
Clear distribution of responsibilities: The guide explains how to structure roles among the CIO, CISO, production managers, and automation engineers. This clarification prevents gray areas where each assumes someone else is responsible, leaving vulnerabilities unaddressed.
Alignment with business priorities: Governance recommendations explicitly integrate production constraints (continuous cycles, scheduled maintenance, product certification).
Integration with global governance: The guide shows how to align industrial cybersecurity governance with the company’s overall IT governance, creating coherence and synergy while respecting OT specificities.
This structured governance model facilitates cybersecurity maturity assessment for industrial environments and allows organizations to demonstrate risk control to auditors and regulators.
Inventory and Mapping: Knowing to Protect
A complete inventory and detailed mapping of industrial assets are the foundation of any security effort. The guide outlines a pragmatic methodology for conducting this inventory in complex, heterogeneous environments.
Critical asset identification: Every component must be listed with its technical characteristics, firmware version, and role within the industrial process.
Flow mapping: Identify who communicates with whom, using which protocols, and how frequently. This visibility often uncovers unexpected connections (forgotten remote maintenance links, obsolete connections) that represent potential backdoors.
Dependency documentation: Understanding interdependencies between systems allows anticipation of cascading impacts in case of an incident.
Continuous updates: The guide emphasizes keeping these inventories and maps regularly updated.
This precise knowledge of the industrial landscape facilitates security reviews, vulnerability identification, and prioritization of remediation actions.
Cyber Risk Assessment: Prioritizing Actions
The guide offers a cyber risk assessment methodology tailored to industrial contexts, addressing both cybersecurity and operational safety (safety).
Threat scenario identification: Which cyberattacks could target your systems? The guide provides adaptable reference scenarios.
Criticality evaluation: Not all systems pose the same level of risk. A halted office air-conditioning system is inconvenient; a halted chemical reactor cooling system could be catastrophic.
Technical vulnerability analysis: Unpatched systems, weak authentication, insecure protocols, lack of encryption. The risk assessment identifies and evaluates these concrete weaknesses.
Business-critical prioritization: Cross-referencing likelihood and business impact allows rational prioritization of security investments.
This structured risk management approach aligns naturally with NIS2 compliance, which mandates risk-based security management for essential and important entities.
Secure Architecture and Network Segmentation
Network architecture is the cornerstone of industrial security. The guide details the principles of designing resilient, defensible architectures.
Segmentation by trust zones: Isolate networks based on their criticality and exposure, critical production zone, supervision zone, administrative zone, DMZ.
Least privilege principle: Each system can only communicate with those strictly necessary for its function, limiting attack surface and lateral movement.
Defense in depth: Multiple protection layers (firewalls, intrusion detection, strong authentication, logging) ensure that no single failure compromises the entire system.
Resilience and redundancy: Recommended architectures integrate fault tolerance and attack resistance, redundant critical components, automatic failover, degraded modes maintaining essential functions during incidents.
These architecture principles apply to both new and existing installations, with adaptable approaches depending on budget, downtime constraints, and equipment obsolescence.
Practical Implementation: From Guide to Action
A particularly innovative aspect of the guide is the integration of cybersecurity from the design and development phases of industrial systems. This “security by design” approach avoids costly retroactive fixes.
The guide explains integration into the V-model lifecycle, cost and schedule impacts, and the setup of dedicated cybersecurity testing environments.
Special attention is given to managing subcontractors and third parties, a critical link in overall security. The guide includes model security clauses for supplier contracts, third-party cybersecurity maturity qualification processes, access control management, and continuous security monitoring of subcontractors.
This extended security control over third parties directly addresses NIS2’s explicit requirement for managing supply chain cybersecurity risks.
Regulatory Compliance and Industrial Standards
Alignment with NIS2 and Sector Requirements
The NIS2 Directive, effective since October 2024, enforces strengthened cybersecurity obligations for essential and important operators, including many industrial sectors (energy, transport, critical manufacturing).
The Clusif guide greatly simplifies NIS2 compliance by structuring all expected elements: risk management, clear governance, technical measures, incident handling, business continuity, and supply chain security.
For organizations already engaged in certification programs (ISO 27001, ISO 22301), the guide eases extension of these management systems to industrial environments. It also includes a roadmap toward GDPR compliance.
Business Benefits and Return on Investment
Protecting Industrial Capital and Production
Investing in industrial cybersecurity yields direct and measurable benefits far beyond avoiding regulatory penalties.
These include high production availability, protection of intellectual property (trade secrets, technical innovations), and product quality and compliance.
Beyond direct protection, industrial cybersecurity maturity becomes a business differentiator and a trust factor. Clients, especially in regulated sectors, increasingly demand cybersecurity guarantees from their suppliers. Communicating about cybersecurity initiatives strengthens the company’s image as responsible and innovative.
A proven ability to withstand cyberattacks reassures investors and partners about long-term viability, facilitating strategic partnerships and fundraising.
Conclusion: A Guide to Drive Your Security Transformation
The industrial systems cybersecurity guide published by Clusif in September 2025 is an invaluable resource for all industrial security stakeholders. Resulting from field experts’ collaboration, it provides a pragmatic, actionable framework to structure cybersecurity governance, prioritize investments, and demonstrate regulatory compliance.
For executives, the guide transforms a complex technical topic into a structured strategic approach aligning cybersecurity with business goals. For CIOs and CISOs, it delivers proven methodologies, IT governance best practices, and practical tools for operational implementation.
In a context of escalating threats, IT/OT convergence, and stricter regulations, mastering industrial cybersecurity is now a strategic necessity.
The Clusif guide provides a clear roadmap for this transformation, freely accessible on their website.
Is your industrial organization protected against modern cyber threats? Our cybersecurity governance experts can help assess your industrial cybersecurity maturity and regulatory compliance.
Contact us to conduct a full OT cybersecurity audit and develop a customized action plan.
Leverage our NIS2 compliance expertise and IT governance best practices to accelerate your industrial security transformation and strengthen your position as a resilient market leader.
