Chemical Sector Cybersecurity Guide: OT and Process Safety

In a chemical plant a cyber attack is ultimately a process safety event: the worst outcomes are releases, fires and explosions, not data loss. Chemical manufacturers and distributors run continuous and batch processes on distributed control systems, safety instrumented systems and programmable controllers, often across decades-old sites with remote vendor support and shared engineering accounts. They also hold chemicals of interest for theft, diversion and sabotage, which brings physical security regulation into the cyber picture. This guide covers the sector's threat profile, the regulatory picture (US chemical security standards, voluntary CISA programmes and EU NIS2 coverage), how to bring cyber into process hazard analysis, the controls that differ from general OT practice, incident response, metrics and common failure patterns. It is written for site and corporate OT security leads, process safety engineers and control system engineers. For the safety system layer itself, see the Safety Instrumented Systems Security Guide. Regulatory status checked on 27 October 2026; this is not legal advice.

Key takeaways

Consequence drives priority. Rank systems by the process hazard they can cause or fail to prevent, not by IT asset value. The safety instrumented system and the basic process control system that keep a reaction within limits sit at the top.
Cyber belongs in the process hazard analysis. Treat a compromised controller or SIS as an initiating event or a failed safeguard in HAZOP and LOPA, so engineering safeguards that cannot be hacked (relief valves, mechanical trips, physical interlocks) get credit and attention.
Regulation is fragmented. In the US, the cyber performance standard in the Chemical Facility Anti-Terrorism Standards (6 CFR 27.230(a)(8)) addresses unauthorised access to critical process controls, but the programme's operating status depends on congressional authorisation; CISA's ChemLock is voluntary. In the EU, chemical manufacturers and distributors fall under NIS2.
Remote and vendor access is the main door. Licensors, DCS vendors and contract engineers need access to many sites; brokered, recorded, time-limited access with individual identities removes the biggest everyday risk.
Recovery is an engineering task. Restoring a plant needs known-good controller logic, configuration backups, and a safe shutdown and restart procedure that works without the compromised systems.

Threat profile of the chemical sector

Threat	What it looks like	Why it matters in chemicals
Attacks on safety systems	Compromise of SIS engineering workstations and controllers to disable or alter trips	Removes the last automated layer of protection. The Triton malware (2017) targeted Triconex safety controllers at a petrochemical facility; see the ICS Malware History Guide
Ransomware spreading from IT	Encryption of business systems, historians, engineering workstations and HMIs on Windows	Plants often shut down as a precaution when visibility or batch records are lost, and restart is slow and hazardous
Theft or diversion of chemicals of interest	Manipulation of inventory, shipping and ordering systems to divert material	Links cyber to chemical security and terrorism risk
Intellectual property theft	Theft of process recipes, licensed technology and catalyst data	Long-running espionage against speciality and petrochemical producers
Supply chain and vendor compromise	Malicious updates, compromised vendor remote access, infected engineering laptops	A single licensor or integrator may support dozens of sites
Internet-exposed control devices	PLCs, HMIs and remote terminal units reachable from the Internet with default credentials	Common at small distribution terminals, tank farms and water treatment units on site

The relevant impact techniques in MITRE ATT&CK for ICS include T0880 Loss of Safety, T0837 Loss of Protection, T0879 Damage to Property and T0826 Loss of Availability. See the MITRE ATT&CK for ICS Guide and the ICS Malware History Guide.

The regulatory picture

Regime	Cyber relevance	Status note
US Chemical Facility Anti-Terrorism Standards (CFATS), 6 CFR Part 27	Risk-based performance standard 27.230(a)(8) "Cyber": deter cyber sabotage, including by preventing unauthorised onsite or remote access to critical process controls, and covering critical business systems	6 CFR Part 27 still appears in the eCFR, including the 27.230(a)(8) cyber standard. CISA announced that Congress had allowed the programme's statutory authority to expire as of 28 July 2023 and that it could not enforce compliance (as quoted in trade press, August 2023). We found no reauthorisation, but CISA's page could not be reached for this check, so confirm the current position there before relying on it
CISA ChemLock	Free, voluntary assessments, tabletop exercises (including downloadable CISA Tabletop Exercise Packages), training and guidance covering cyber and physical chemical security	Voluntary; CISA states it does not replace any CFATS requirements
CISA Cross-Sector Cybersecurity Performance Goals	Baseline practices for critical infrastructure OT and IT	Voluntary. See the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) Guide
Process safety rules (for example OSHA Process Safety Management and EPA Risk Management Program in the US)	Require process hazard analysis and management of change; many operators now include cyber-initiated scenarios in that analysis	Check how your regulator treats cyber scenarios; the rules are safety rules, not cyber rules
EU NIS2 Directive (EU) 2022/2555	Chemical manufacture, production and distribution is understood to be listed among the "other critical sectors" in the Directive's annexes (Annex II), so in-scope medium and large entities would generally be important entities; check the annex text on EUR-Lex. These entities have risk management and reporting duties	Applies through national transposition laws; incident reporting follows the 24-hour early warning, 72-hour notification and one-month final report pattern
IEC 62443 series	The engineering standard most chemical operators and their suppliers use for OT security programmes, zones and conduits and component requirements	Voluntary standard, often written into contracts. See the IEC 62443 Guide

The gap left by CFATS: facilities that built their cyber controls around a CFATS site security plan should not let them decay while the programme's status is uncertain. Keep the controls, map them to IEC 62443 and the CPGs, and use ChemLock or an independent assessment to keep them tested. If the programme resumes, the evidence will already exist.

Bringing cyber into process safety

Process safety teams already have the method for thinking about consequence. The aim is to add cyber as a cause and as a potential failure mode of safeguards.

Identify the worst credible consequences from the existing HAZOP and LOPA studies: toxic release, runaway reaction, overpressure, fire.
Ask which safeguards are digital. For each scenario, mark the protection layers that depend on programmable systems (BPCS control loops, alarms, SIS functions) and those that do not (relief devices, bursting discs, dikes, mechanical overspeed trips).
Add cyber-initiated scenarios. Consider an adversary who can change setpoints, suppress alarms or bypass a SIS function at the same time. A cyber attack can defeat several digital layers at once, so they may not be independent.
Prefer engineered, non-hackable safeguards for the highest-consequence scenarios. This is the core idea of consequence-driven engineering; see the Consequence-driven OT Risk Guide.
Feed the result into the OT risk assessment. Use the scenarios to set target security levels for zones under IEC 62443-3-2. See the IEC 62443-3-2 OT Risk Assessment Guide.
Bring cyber into management of change. Any modification to control or safety systems, including logic downloads and firmware updates, gets a cyber review alongside the process safety review.

Who does the work: cyber process hazard analysis works best as a joint session with the process safety lead, a control systems engineer who knows the DCS and SIS configuration, and an OT security specialist. Security staff alone tend to miss which safeguards are independent of the control network, and process engineers alone tend to assume that digital layers fail randomly rather than together under an adversary's control.

Controls that differ from general OT practice

SIS separation: keep the SIS on its own network zone, with its engineering workstation dedicated and physically secured, and use controller key switches or equivalent so logic cannot be changed remotely while in run mode. Monitor key switch position.
Integrated control and safety systems: where the DCS vendor provides an integrated SIS, check how the two are separated at network and engineering-tool level; integration can remove independence that the safety case assumes.
Batch and recipe integrity: recipe management and manufacturing execution systems decide what goes into a reactor. Restrict who can change recipes, sign or hash approved versions and alert on change outside management of change.
Tank farms and terminals: remote sites and loading terminals often have cellular modems and remote telemetry units with weak authentication. Inventory and lock them down; they are where Internet-exposed devices are most often found.
Laboratory and quality systems: lab instruments and LIMS sit between IT and OT and feed release decisions. Segment them and control the data path.
Chemical inventory and logistics systems: protect ordering, inventory and shipping systems against manipulation that could hide theft or diversion of chemicals of interest, and reconcile them with physical counts.
Segmentation: zones and conduits between enterprise, site DMZ, BPCS, SIS and package units. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.

Where identity fits

Identity failures account for much of the practical risk in chemical OT, because so many people and organisations need access to so many sites.

Identity	Typical problem	Better practice
Vendor and licensor remote users	Shared accounts on a VPN or remote desktop tool that is always on	Brokered access with individual named accounts, MFA, approval per session, recording and automatic expiry. See the OT Remote Access Guide
Engineering workstation accounts	Shared local administrator and DCS engineer logins used by every shift	Named accounts, role-based access in the DCS, privileged access controls for logic changes
Service accounts	Historian, OPC and backup services running with domain administrator rights and passwords that never change	Least privilege, vaulted credentials, rotation where the vendor supports it, monitoring of interactive use. See the OT and ICS Identity and Access Guide
Controller and device credentials	Default or no passwords on PLCs, HMIs and remote terminal units	Change defaults at commissioning, enable controller passwords and secure modes where available
Contractors during turnarounds	Hundreds of temporary staff given broad access that is never removed	Time-bound accounts tied to the turnaround schedule and reviewed at close-out

Implementation roadmap

Inventory and consequence ranking. List control and safety systems per site, map them to process hazards and rank by consequence. Passive network monitoring helps where documentation is poor.
Close the obvious doors. Remove Internet exposure, replace always-on vendor access with brokered access, change default credentials and separate the SIS network.
Back up for recovery. Take and verify offline backups of controller logic, DCS and SIS configurations and engineering project files, and test a restore on spare hardware. See the OT Backup, Recovery and Golden Image Guide.
Integrate with process safety. Add cyber scenarios to the next HAZOP or LOPA revalidation and cyber review to management of change.
Monitor. Deploy OT network monitoring at the DMZ and key conduits, collect engineering workstation and remote access logs, and alert on logic downloads, mode changes and new devices.
Exercise. Run a joint cyber and process safety tabletop (ChemLock offers exercise packages) that ends with a safe shutdown decision.
Roll out by site. Pilot at one representative site, then roll out in waves aligned to turnarounds so changes needing downtime are done safely. Any control change has a tested backout under management of change.

Small versus large operators: a single-site speciality producer can achieve most of the risk reduction with steps 1 to 3 and a managed monitoring service. A multi-site major needs a corporate OT security function, common standards based on IEC 62443, and site-level owners who report into both engineering and security.

Incident response and detection

Decision authority: the shift supervisor or operations manager decides on safe shutdown, not the security team. Playbooks give them clear criteria (loss of view, unexplained setpoint changes, SIS faults) and an escalation path.
Detection priorities: logic or firmware downloads outside a work order, controller mode or key switch changes, new remote sessions, new devices on control networks, alarm suppression, and authentication failures on engineering workstations.
Evidence: preserve engineering workstation images, controller logic snapshots (compare with the known-good backup), network captures and remote access logs.
Reporting: follow the duties that apply to you: NIS2 national rules in the EU and any national or sector requirements elsewhere.

Metrics

Metric	Target
High-consequence scenarios with at least one non-digital safeguard	All, confirmed in LOPA
Vendor remote sessions through the broker with named accounts and recording	100%
Controllers and SIS with a verified offline logic backup less than one change old	100%
Internet-exposed control devices across sites	Zero, checked monthly
Logic downloads matched to an approved management of change record	100%
Sites that completed a joint cyber and process safety exercise in the last year	All

Framework mapping

Area	References
Remote access	NIST SP 800-53 AC-17; ATT&CK for ICS T0822 External Remote Services, T0886 Remote Services; CFATS 27.230(a)(8)
Segmentation	NIST CSF 2.0 PR.IR-01; SP 800-53 SC-7; IEC 62443-3-2 zones and conduits
Exposure and vulnerabilities	CSF 2.0 ID.RA-01; ATT&CK for ICS T0883 Internet Accessible Device
Supply chain and vendors	CSF 2.0 GV.SC-07; ATT&CK for ICS T0862 Supply Chain Compromise
Recovery	SP 800-53 CP-9 System Backup; CSF 2.0 RS.MA-01 for coordinated response
Safety impact	ATT&CK for ICS T0880 Loss of Safety, T0837 Loss of Protection

Common failure patterns

SIS on the control network. The safety system shares a flat network and engineering workstation with the BPCS, so one compromise reaches both.
Controllers left in program mode. Key switches stay in remote or program position after maintenance, allowing logic changes from the network.
Vendor access that never closes. A permanent VPN account for a licensor or integrator, shared by its staff, with no session approval.
Cyber missing from management of change. Firmware updates and logic changes are reviewed for process impact but not for security, and new devices arrive with default credentials.
Backups that cannot restore. Logic backups are old, incomplete or stored on the same network that ransomware encrypts.
Letting CFATS-era controls decay. When the regulatory driver weakened, budgets and assessments stopped; the threat did not.

Practitioner checklist

Rank control and safety systems by process consequence using existing HAZOP and LOPA studies.
Add cyber-initiated scenarios and cyber review to process hazard analysis and management of change.
Separate the SIS network and engineering workstation and monitor controller mode and key switches.
Replace always-on vendor VPNs with brokered, recorded, time-limited individual access.
Remove Internet exposure and default credentials across plants, tank farms and terminals.
Vault and scope historian, OPC and backup service accounts.
Keep verified offline backups of controller logic and configurations and test restores.
Confirm the current status of CFATS and the NIS2 national law that applies to each site.
Run a joint cyber and process safety exercise at every site each year.

Standards and references

Related NHI Mgmt Group resources: Safety Instrumented Systems Security Guide · OT Security Guide · IEC 62443 Guide · OT Remote Access Guide. This guide summarises the chemical security and cyber security rules as checked on 27 October 2026 and is not legal advice.

Chemical Sector Cybersecurity Guide: Protecting Process Safety, Control Systems and Chemical Security