Getting Started in OT/ICS Cybersecurity (Module 10): Compliant Does Not Mean Secure

Getting Started in OT/ICS Cybersecurity (Module 10): Compliant Does Not Mean Secure

by Mike Holcomb · View the channel on PSI

Humanities, Social Sciences & Thought Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Mike Holcomb 👥 28K 📅 October 19, 2026 ⏱ 119 min 👁 417 📄 tutorial 🧭 2026-10-20
Available in: English (current) Français

Keywords

governancecomplianceOT/ICScybersecurityregulation

Summary

This educational module addresses governance and compliance within OT/ICS cybersecurity, challenging the misconception that being compliant equates to being secure. The speaker, an experienced practitioner, begins by contrasting the limited adoption of formal GRC processes in OT compared to a few mature industries, and emphasizes that most plants still lack basic protective measures. He outlines the fundamental challenges: legacy systems like Windows XP with no security patches, the complexities of patching without disrupting production, and third-party risks from contractors introducing unmanaged devices. The video then provides a historical review of cybersecurity regulation, from early IT laws like GLB and PCI to sector-specific OT rules such as NERC CIP for power, TSA directives for pipelines, and emerging European regulations like NIS2 and the Cyber Resilience Act. The core message is that knee-jerk regulations, often crafted without understanding OT environments, can harm plant safety and availability. The module highlights the importance of involving plant engineers and operators in cybersecurity decisions, and presents two key standards: NIST SP 800-82 and ISA/IEC 62443, explaining their use as guidance rather than law. It also introduces the concept of Security Levels (SL1-4) in IEC 62443, mapping them from ransomware attacks to nation-state threats. The concluding emphasis is on continuous improvement and the certainty of eventual incidents, urging proactive engagement.

213 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video delivers strong practical value by translating regulatory and standards language into actionable insights for OT environments. It argues persuasively that compliance alone is insufficient, using vivid examples like the Colonial Pipeline shutdown and anecdotal cases of rogue Starlink dishes, to illustrate real-world pitfalls. The argumentation is coherent, moving from general challenges to specific regulatory and standards frameworks, and always ties back to the priority of safety and operational availability. The speaker’s credibility is enhanced by his willingness to critique overly prescriptive regulations and to stress the need for interdisciplinary cooperation between IT and OT teams.

Scientific Rigor, Source Quality, Title Accuracy

The content is scientifically rigorous in that it relies on established standards and frameworks, referencing NIST SP 800-82, ISA/IEC 62443, NERC CIP, and EU regulations accurately. While no external sources are hyperlinked in the description, the named references are authoritative and the speaker’s explanations align with common industry understanding. The title is fully appropriate: the video systematically demonstrates that passing an audit does not guarantee security, reinforcing this with multiple case studies and technical explanations. The structure is logical and the speaker occasionally notes his own experience, which adds to reliability.

203 words

Title / Content Match

The title accurately captures the core message: compliance frameworks and regulations are not synonymous with a secure industrial environment. The content strongly supports this assertion throughout.

Quality & Reliability

8/10

The video provides a well-structured, expert-led overview of OT/ICS governance and compliance, grounded in practical experience and referencing authoritative standards. It distinguishes between mere compliance and true security, with a focus on safety and availability, without overclaiming or introducing unverifiable data.

Chapters

Cited Sources

  • NIST SP 800-82 Rev 3 — Mentioned as the best free resource for OT/ICS security, providing guidance on securing industrial control systems.
  • ISA/IEC 62443 Standard Series — Described as the engineering gold standard for industrial cybersecurity, covering security levels and system requirements.
  • Implementing IEC 62443: A Pragmatic Approach — Referenced as a resource for practical application of the IEC 62443 series.
  • Steve Mustard's Industrial Cybersecurity — Listed as a resource for further learning on industrial cybersecurity.
  • OT Threat Feed — Mentioned as a resource for staying current on OT threats and vulnerabilities.

Contribution & Novelties

The video adds value by demystifying the relationship between compliance and actual security in OT environments, a topic often misunderstood. It provides a clear overview of the regulatory landscape and offers a balanced perspective on how to use standards as actionable guidance rather than inflexible rules. The speaker stresses the necessity of adapting measures to the specific operational context, a message that is often lost in generic compliance discussions.

Pour aller plus loin :

  • NIST SP 800-82 Rev. 3 — The primary reference for OT/ICS security guidance, covering threats, vulnerabilities, and security controls.
  • ISA/IEC 62443 Series — The international standard for industrial automation and control systems security, including definitions of security levels.
  • NERC CIP Standards — The North American Electric Reliability Corporation’s critical infrastructure protection standards, directly relevant to the video’s discussion of grid security.

135 words

Radar Profile

The radar profile would show high scores in information quantity and quality, indicating a well-packed and reliable tutorial. The technical level is moderate, suitable for a broad audience, while the global reliability is strong due to the use of established standards and practical examples.

Reliability 8/10