Cybersecurity best practices for safety instrumented systems (SIS) are essential for preventing threats. This article outlines key risks, assessment requirements under IEC 61511 and practical steps to improve system resilience in industrial environments.
Safety instrumented systems insights
- Safety instrumented systems (SIS), once assumed to be isolated from cyber threats, are increasingly targeted by attackers seeking to compromise safety layers and potentially cause physical harm.
- Standards such as IEC 61511 now require cybersecurity assessments as part of the process safety lifecycle, making cyber risk management a core component of hazard and risk analysis.
- Strengthening SIS resilience requires disciplined cybersecurity practices, including isolation, controlled access devices, patch management, segmentation and monitoring.
Safety instrumented systems (SIS) are engineered to step in when other layers of protection fail. They monitor the process for hazardous conditions and automatically bring equipment to a safe state when the basic process control system (BPCS) can no longer maintain stable operation. In high-consequence environments, this function is often the last barrier between a process upset and a catastrophic event.
To support this role, SIS are designed to be logically and physically separate from other systems. But in practice, that separation is not always perfect. Many SIS share routers, firewalls or maintenance devices with the BPCS. Even systems that are air gapped still require periodic connections for programming, proof testing or troubleshooting. Past incidents like Stuxnet malware showed how removable media can bridge those gaps. Every one of these touchpoints introduces potential pathways for threats to enter otherwise isolated environments.
This design intent — independence, reliability and infallibility — is exactly what makes SIS cybersecurity so critical. A compromise of the safety layer has the potential to reach beyond just the tech realm and into the physical world of equipment damage, environmental release or even loss of life.
The growing risk to safety layers
In the past, safety instrumented systems (SIS) were seen as disconnected fortresses, sealed off from business networks and immune to the growing tide of cyber threats, but some recent incidents have proven otherwise. One such example was the 2017 attack on a Triconex safety system at a petrochemical facility in Saudi Arabia. Though details were not widely publicized, we know the attack targeted the safety layer directly.
While the incident did not result in a major accident, investigators found that the attackers gained control over the safety controller logic and attempted to modify it. If the altered logic had gone undetected, the system may have failed to bring the plant to a safe state during an upset, potentially leading to a catastrophic event. In other words, the attackers weren’t just trying to disrupt operations; they were trying to disable the protections put in place to prevent loss of life and large-scale damage.
This represents a fundamental change in intent. Traditional cyber incidents often focus on data theft or operational downtime, but targeting an SIS is different. It shows a willingness to cause physical harm, not just digital disruption. That’s why the Triconex attack is still seen as a watershed moment. It illustrated that threat actors understand industrial safety functions and are actively exploring ways to compromise them.
This shift in threat posture reveals a hard truth: Cybersecurity for SIS can no longer be treated as optional or out of scope. These systems are often the last line of defense against physical harm in industrial environments. If compromised, they may fail to perform their safety functions, or worse, become a vehicle for harm.
Cybersecurity requirements under IEC 61511
Under IEC 61511, cyber assessments are now a required part of the hazard and risk analysis lifecycle. These assessments are not performed in isolation. They feed directly into the safety case. The presence of cyber vulnerabilities can alter risk assessments and mitigation strategies, making cybersecurity a core element of process safety.
In one recent case, a facility with outdated documentation requested Hargrove’s assistance to evaluate the current state of their systems, conduct a cyber assessment alongside traditional hazard analysis and make the recommended fixes. This kind of dual focus reflects a growing awareness that process safety must now include cyber resilience.
Cyber assessments should be conducted by personnel trained and certified in industrial cybersecurity, such as those certified through TÜV or similar programs. This qualification helps ensure that assessments meet technical standards and that findings can be translated into actionable, risk-informed mitigation steps. Guidance related to SIS security is provided in the following standards: ISA TR84.00.09, ISO/IEC 27001:2013 and IEC 62443-2-1:2010.
Building resilience: cyber hygiene and monitoring for SIS
Protecting SIS begins with disciplined engineering and operational control. At one facility, for example, cyber risk is mitigated by issuing dedicated, internet-free laptops for SIS programming. These machines are not used for email or internet browsing and must be returned after use. Programs are backed up to physical media, adding another layer of access control. While this level of discipline can feel cumbersome, it is highly effective and increasingly necessary.
Below are the core practices that help strengthen SIS cybersecurity and maintain the integrity of the safety layer.
Physical and network isolation
Keep SIS off the internet entirely, and, where feasible, use dedicated hardware and network paths that are separate from the BPCS. Even air-gapped systems can be at risk. Removable media or maintenance laptops often become unintended bridges between isolated systems and the broader network. Strong hygiene procedures must apply even to standalone or “offline” systems.
Controlled access devices
Use clean, dedicated laptops or terminals for programming and diagnostics. Avoid devices that also connect to email, the internet or other corporate systems. The approach used at the facility mentioned above — assigning internet-free programming laptops that are checked in and out and backed up to physical media — illustrates how targeted controls can significantly reduce exposure.
Patch and vulnerability management
Keep SIS and related components up to date with vendor-provided patches. Monitor technical advisories closely, as newly discovered vulnerabilities are often weaponized quickly. Outdated software or unsupported devices increase the likelihood that an attacker can exploit known weaknesses.
Antivirus and endpoint protection
Many SIS are deployed without basic protections such as antivirus software. Ensure these tools are installed, regularly updated and actively monitored. Even a single unprotected endpoint can offer an entry point for malware.
Segmentation and DMZs
Use network segmentation to isolate SIS from plant-wide and business systems. A DMZ can help manage limited, necessary communications while reducing overall exposure. Segmentation also limits the spread of cyber incidents. In another example, one of our clients recently experienced an incursion affecting parts of their server infrastructure. Because segmentation had been properly implemented, the threat was contained before moving deeper into the plant, avoiding a full operational shutdown.
Monitoring and anomaly detection
Monitoring plays a crucial role in maintaining cyber hygiene. Some tools analyze network traffic down to the packet level, flagging anomalies such as unfamiliar ports or unexpected communication paths. These systems can be deployed inside SIS networks or externally, depending on the architecture. Available solutions range from information technology (IT)-focused platforms like Microsoft’s Defender for Internet of Things (IoT) to operational technology (OT)-native tools from providers such as Nozomi, Claroty and others. Effective platforms detect the digital equivalent of suspicious behavior; for instance, a device suddenly sending traffic it has never sent before. Some tools alert plant personnel. Others initiate automated containment actions.
Legacy systems: a persistent risk
Legacy systems pose a unique challenge in SIS cybersecurity. Once a device or software package reaches unsupported status, it stops receiving security updates, even as new vulnerabilities continue to emerge. At that point, defenders are essentially frozen in time while attackers evolve.
While immediate replacement isn’t always feasible, legacy systems require additional safeguards. Compensating controls may include restricted access, enhanced monitoring, tighter segmentation or isolated hardware pathways. These measures can help reduce exposure, but they do not eliminate the underlying risk. Long term, replacement becomes a necessary step to maintain both safety and cyber resilience.
Embedding cyber resilience into process safety
It is a common misconception that cybersecurity and functional safety are competing priorities. In reality, they reinforce each other. Modern platforms and architectures can support robust cybersecurity without compromising response time, reliability or the ability of an SIS to perform its required functions.
The real shift is philosophical. Cybersecurity is now part of the safety lifecycle. It belongs in early design discussions, in risk evaluations, in documentation and in day-to-day operational practices. For years, cybersecurity was added late in the process, if at all. That era is ending.
In high-consequence environments, the safety layer must be defensible not only against process failures but against human-driven threats. A resilient SIS depends on the strength of both its engineering and its cybersecurity.
When the safety layer is compromised, the consequences reach far beyond operational disruption. They touch equipment protection, environmental responsibility and the safety of people. Ensuring SIS are designed, operated and maintained with cyber risk in mind is now essential for modern process safety.
Author
Chet Barton, process safety director, and Heath Stephens, automation solutions director, Hargrove Controls & Automation; edited by Gary Cohen, Control Engineering senior editor, [email protected].
Learning objectives
- Understand why safety instrumented systems (SIS) are increasingly vulnerable to cyber threats and why protecting the safety layer is critical in modern industrial environments.
- Learn how cybersecurity requirements in standards such as IEC 61511 integrate cyber risk assessments into the broader process safety lifecycle.
- Identify practical cybersecurity best practices — such as network isolation, access control, monitoring and legacy system mitigation — that strengthen SIS resilience.
Consider this
How can cybersecurity be fully integrated into the safety lifecycle through risk assessments, network segmentation and strict access controls to ensure safety instrumented systems remain reliable and protected from cyber threats?
