Cyber-Physical Risk vs Information Risk in OT

An information risk assessment asks what happens to data; a cyber-physical risk assessment asks what happens to people, plant and the environment when a control system does the wrong thing, and using the first method on the second problem produces confident but wrong priorities. NIST SP 800-82 Rev. 3 notes that logic running in operational technology (OT) has a direct effect on the physical world, and lists risks to human health and safety, serious environmental damage and production loss among the consequences of OT incidents. This guide compares the two kinds of risk: consequence types, the shift from CIA to safety-first priorities, the assessment methods each uses (ISO/IEC 27005 and NIST SP 800-30 on one side, ISA/IEC 62443-3-2, cyber process hazard analysis and Consequence-driven Cyber-informed Engineering on the other) and the control trade-offs that follow. It is for risk managers, OT security leads, process safety engineers and CISOs who now own both estates. For the wider OT programme see the OT Security Guide.

Key takeaways

The short answer: information risk is measured in lost confidentiality, integrity or availability of data and services; cyber-physical risk is measured in injury, environmental release, equipment damage and loss of an essential service, and is assessed with the plant's safety case, not beside it.
Priorities invert, but not simply. NIST SP 800-82 Rev. 3 says OT security objectives typically prioritise integrity and availability, followed by confidentiality, with safety as an overarching priority. Read "AIC" as "safety first, then control of the process".
Likelihood behaves differently. Safety studies assume random failures with known rates; an adversary is not random. UK HSE guidance (OG86) says standard hazard studies such as HAZOP generally do not consider multiple simultaneous contingencies or the capabilities of malicious actors.
Methods exist for both and should be joined. Use the enterprise method for the IT estate, ISA/IEC 62443-3-2 for zones and conduits, cyber PHA to bring cyber into the hazard register, and CCE for the handful of events that would be catastrophic.
Controls trade off differently. An information control that blocks or reboots can itself cause a physical hazard; in OT, prefer engineered and non-digital safeguards that work even when the network is compromised.

Two kinds of risk, defined

Information risk: the effect of uncertainty on information assets and the services built on them. Impact is expressed as loss of confidentiality, integrity or availability, and the harm lands on the organisation (fines, fraud, outage cost) or on data subjects. NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments, and ISO/IEC 27005 are the reference methods.
Cyber-physical risk: the risk that a cyber event causes a control or safety system to act, or fail to act, in a way that changes the physical process. Harm lands on people on and off site, the environment, equipment and the communities that depend on the service. NIST SP 800-82 Rev. 3 says OT safety impacts are judged by the potential for injury, illness or death if the system malfunctions after a cyber incident, and that analyses should also cover environmental effects.
Where they overlap: the same intrusion can carry both. The Colonial Pipeline ransomware attack was an IT-side intrusion, yet the company shut its pipeline down as a precaution, and fuel supply along the US eastern seaboard was disrupted for days. An information risk register that rated the billing systems "moderate" would have missed the physical consequence of losing them.

Consequence types compared

Consequence	Information risk view	Cyber-physical risk view
Human safety	Rarely in scope; may appear under health data or life-safety alarms in buildings	Primary: injury, illness or fatality to workers and the public
Environment	Not usually rated	Releases, spills and emissions, rated by size, duration and regulator response
Equipment and plant	Hardware replacement cost	Physical damage with long lead times (transformers, turbines, kilns), which drives recovery time
Service delivery	Outage of a digital service, often hours	Loss of an essential service (power, water, fuel, medicines) affecting society, often days
Data	Primary: theft, exposure, corruption	Secondary, except where stolen data enables an attack (drawings, recipes, set points) or data integrity drives the process
Financial	Fines, fraud, response and outage cost	Lost production, product quality, contractual penalties, plus all the information-side costs
Legal and regulatory	Data protection and sector rules	Safety and environmental regulation (for example COMAH sites in Great Britain), plus network and information systems rules

NIST SP 800-82 Rev. 3 gives example impact level definitions for OT that show the change in scale. For people on site it suggests that a fatality is High, a lost workday or major injury is Moderate and first aid or a recordable injury is Low; for cost, over 25% of revenue is High and over 5% is Moderate; for the environment, a regional agency citation or long-term damage over a large area is High. Calibrate these to your own sector before you use them.

From CIA to safety first

The CIA triad is a useful checklist in both worlds, but the ordering and meaning change.

Property	What it means in an information system	What it means in a control system
Safety (overarching)	Not usually a security property	The process stays within safe limits and can always reach a safe state
Integrity	Data and records are accurate and unaltered	Commands, set points, logic and sensor values are genuine; the operator's view matches reality
Availability	Services are reachable within agreed hours	Control and view are continuous and deterministic; NIST notes high delay or jitter is unacceptable in OT, and a reboot may not be acceptable
Confidentiality	Usually the lead concern	Lower, but still matters for engineering files, credentials and process recipes that enable later attacks

MITRE ATT&CK for ICS expresses the physical end state as Impact techniques such as T0880 Loss of Safety, T0879 Damage to Property, T0827 Loss of Control, T0831 Manipulation of Control and T0837 Loss of Protection. These are useful scenario labels for a cyber-physical register; the enterprise matrix does not have equivalents for most of them.

Assessment methods side by side

Method	Domain	Unit of analysis	How likelihood is treated	Output
NIST SP 800-30 Rev. 1	Information	Threat events against systems and organisations, across three tiers	Threat source capability, intent and targeting, plus vulnerability	Risk ratings that feed risk response decisions
ISO/IEC 27005	Information	Information assets or events and their consequences	Qualitative or quantitative likelihood	Risk register supporting the ISO/IEC 27001 risk treatment plan
FAIR and cyber risk quantification	Mainly information	Loss scenarios	Frequency ranges from data and expert estimates	Annualised loss in money
ISA/IEC 62443-3-2	Cyber-physical	The system under consideration, partitioned into zones and conduits	Initial assessment on worst-case unmitigated consequence, then detailed threat-based assessment	Target security level (SL-T) per zone and conduit, and security requirements
Cyber PHA (cyber HAZOP)	Cyber-physical	Process nodes and deviations from the existing hazard study	Adversary capability rather than random failure rates	Cyber scenarios in the hazard register, with safeguards and their cyber dependence
CCE (Idaho National Laboratory)	Cyber-physical	A small number of high-consequence events	Assumes a capable, targeted adversary will get in	Engineered mitigations that remove or bound the consequence

ISA/IEC 62443-3-2 in one paragraph

ISA lists ANSI/ISA-62443-3-2-2020 as "Security risk assessment for system design" and describes the series as bridging process safety and cyber security. The method defines the system under consideration, runs an initial risk assessment on worst-case consequences, partitions the system into zones and conduits, compares initial risk with the asset owner's tolerable risk, carries out a detailed risk assessment where needed and records target security levels and requirements for each zone. For the step-by-step method see the IEC 62443-3-2 OT Risk Assessment Guide.

Cyber PHA and the safety case

HSE OG86 Edition 2, written for major accident hazard sites, says risk is assessed at zone level without credit for existing countermeasures, that each zone is classed by consequence (major accident, loss of essential service, or neither), and that a zone able to defeat a safety function, such as a basic process control system able to override a safety instrumented system, makes both zones critical. It also says following the guidance can meet the cyber requirement in clause 8.2.4 of BS EN 61511 for safety instrumented systems. NIST SP 800-82 Rev. 3 similarly suggests adding cyber scenarios to process hazard analysis or FMEA. See the OT Cyber Physical Risk and Safety Guide.

CCE for the events that cannot happen

Idaho National Laboratory describes CCE as starting from an organisation's most critical functions, assuming that a targeted network can and will be penetrated, and "engineering out" risk through design rather than relying only on cyber controls. INL summarises the relationship as Cyber-Informed Engineering being the what and CCE a how. See the Consequence-driven OT Risk (CCE) Guide.

Why likelihood and scoring break when copied across

Random versus intelligent failure: safety integrity relies on probabilities of failure on demand for independent faults. An adversary can cause several "independent" failures at once, which is exactly what OG86 says traditional hazard studies do not consider.
Credit for controls: information risk methods usually rate residual risk after controls. OG86 asks for zone risk without credit for existing countermeasures, then matches countermeasures to threat scenarios, because a control that shares a network with the thing it protects may fail with it.
Heat-map compression: a five-by-five matrix tuned for data breaches places "fatality, rare" and "minor outage, frequent" in similar cells. Use the safety organisation's risk matrix and tolerability criteria for physical consequences.
Money as the only unit: loss quantification is valuable for the business case, but safety and environmental consequences are governed by tolerability criteria and regulation, not by expected loss alone. See FAIR vs NIST SP 800-30 for the information side.
Short time horizons: OT components typically last 10 to 15 years against 3 to 5 for IT, according to NIST SP 800-82 Rev. 3, so a risk accepted today may stand for a decade.

Control trade-offs

Control	Information risk default	Cyber-physical consideration
Patching	Apply promptly, often automatically	NIST notes OT changes need thorough testing and incremental deployment; outages may need planning days or weeks ahead. Compensate with segmentation while waiting
Account lockout	Lock after failed attempts	Locking an operator out of an HMI during an upset is itself a hazard; use monitored shared consoles or physical controls instead
Automated blocking and isolation	Isolate the host on detection	Isolating a controller or HMI can lose view or control; pre-agree which assets may be isolated and by whom
Endpoint agents	Deploy everywhere	NIST notes OT devices may lack memory and compute for added security features; use allowlisting on supported hosts and passive network monitoring elsewhere
Encryption	Encrypt by default	Integrity and authentication of commands usually matter more than secrecy; latency and legacy protocol support must be tested
Safety systems	Not applicable	Keep the safety instrumented system separate from control; NIST warns that combining control and safety functions could let an attacker reach both
Non-digital safeguards	Not applicable	NIST lists analogue displays, manual controls and mechanical devices such as relief valves as limits on attack impact; credit them in the assessment

For the related split between safety and control layers, see Safety Instrumented Systems vs Basic Process Control.

How to run a joined-up assessment

Agree the consequence scale. Extend the enterprise risk matrix with the safety organisation's categories for people, environment, plant and essential service. One scale, signed off by the risk owner and the process safety lead.
Map dependencies across the boundary. List IT systems that OT relies on to operate or to bill and dispatch (historians, scheduling, ERP, identity, remote access). Colonial Pipeline shows why these belong in the cyber-physical view.
Run the initial assessment per zone on unmitigated consequence. Use ISA/IEC 62443-3-2 zones; rate each without credit for countermeasures, as OG86 does.
Bring cyber scenarios into the hazard register. Hold a cyber PHA with operations, process safety and OT security on high-consequence nodes; record which safeguards depend on networked components.
Select the few events for CCE. For events with unacceptable consequences, look for engineered mitigations (mechanical limits, hard-wired trips, physical interlocks) that hold even under compromise.
Set target security levels and controls. Assign SL-T per zone and conduit, then select controls, testing each for safety side effects before deployment.
Pilot, verify and record. Validate on one unit or site first, use passive monitoring before active controls, and keep a rollback for every change under management of change.
Feed the result to both registers. Enterprise risk sees the money and service view; the safety case sees the hazard view. Review on any process change and at least annually.

When to use each approach

Information risk methods alone: corporate IT, OT-adjacent business systems with no route to the process and no operational dependence, and data-centric risks such as theft of engineering IP.
ISA/IEC 62443-3-2: any control system design, upgrade or new project, and when you need defensible zone requirements for suppliers. See the IEC 62443 Guide.
Cyber PHA: process industries with an existing HAZOP and LOPA culture, and major hazard sites where the regulator expects cyber in the safety case.
CCE: critical infrastructure and sites where a single event could be catastrophic or nationally significant; it is resource-intensive, so apply it to a short list.
Small organisations: a manufacturer with one plant can run a one-day joint workshop using 800-82 impact levels and a zone diagram, then act on the top five scenarios. Large operators should formalise the shared consequence scale and run CCE centrally on fleet-wide events.

Worked scenario: chlorine dosing at a water works

An information risk review rates the SCADA historian as "medium": it holds no personal data and has backups. The cyber-physical review asks a different question. The historian sits in a zone with a conduit to the dosing PLC, and an engineering workstation in the same zone can change dosing set points. Unmitigated consequence: overdosing or underdosing of drinking water, which is a public health event (High). Cyber PHA shows that the high-level alarm and the dosing pump interlock both run through the same PLC, so they are not independent of a cyber compromise. The outcome is a separate zone for the dosing controller with a one-way data flow to the historian, an analyser-driven hard-wired trip on the dosing pump, authenticated engineering access through a jump host, and a manual sampling procedure as the last safeguard. The information risk rating of the historian did not change; the cyber-physical rating of the dosing function fell from High to Low.

Where identity fits

Many cyber-physical scenarios start with an identity: a vendor remote access account, a shared engineering workstation login or a service account the historian uses to pull data from controllers. Rate these accounts by the consequence of the zone they reach, not by the data they touch. See the OT and ICS Identity and Access Guide.

Detection and measurement

Coverage of high-consequence functions: share of functions rated High for safety or environment that have a completed cyber PHA or CCE review.
Cyber-independent safeguards: share of High scenarios with at least one safeguard that does not depend on a networked component.
Zones with agreed SL-T: percentage of zones and conduits with a documented target security level and gap list.
Cross-boundary dependencies registered: count of IT systems whose loss would force an operational shutdown, each with an owner and recovery plan.
Monitoring of safety-relevant conduits: share of conduits to safety and control zones covered by passive network monitoring with alerts reviewed by operations.
Gap closure: justified and approved gaps tracked to closure, as OG86 expects for major accident consequences.

Common failure patterns

Rating OT assets by the data they hold: a controller with no sensitive data scores low on CIA, yet can cause a release. Rate by consequence.
Leaving IT dependencies out of the OT view: the physical disruption at Colonial Pipeline came from a containment decision after an IT intrusion, not from attackers touching pipeline controls.
Crediting safeguards that share the attack path: an alarm and a trip in the same programmable controller are not two independent layers against a cyber cause.
Running the assessment without process safety: security teams alone miss hazards; safety teams alone miss adversary capability. Hold joint workshops.
Importing IT response playbooks unchanged: automatic isolation or forced password resets during an upset can create the hazard you are trying to prevent. See the OT Incident Response Guide.
One-off assessments: a process change, new remote access path or controller upgrade alters the risk; tie reassessment to management of change.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-82 Rev. 3	Section 4 OT risk management; Table 3 impact levels	Safety, environmental and physical consequences in OT risk
ISA/IEC 62443	Part 3-2 security risk assessment for system design; Part 3-3 system security requirements and security levels	Zone and conduit risk, SL-T
IEC 61511 (BS EN 61511)	Clause 8.2.4 security risk assessment for SIS, as referenced by HSE OG86	Cyber risk in the safety lifecycle
NIST CSF 2.0	GV.RM-01; ID.AM-05; ID.RA-04; ID.RA-05; PR.IR-03	Risk objectives, criticality, impact, prioritisation, resilience
NIST SP 800-53 Rev. 5	RA-2 Security Categorization; RA-3 Risk Assessment; SA-8 Security and Privacy Engineering Principles; SC-7 Boundary Protection	Categorisation, assessment and engineered boundaries
MITRE ATT&CK for ICS	TA0105 Impact: T0880, T0879, T0827, T0831, T0837	Physical consequence scenarios
UK regulation	HSE OG86 Edition 2; NCSC Cyber Assessment Framework 4.0, objective A Managing security risk	Major accident hazard sites and operators of essential services

Decision checklist

Does the system, directly or through a dependency, affect a physical process or essential service? If yes, a cyber-physical assessment is required.
Is there one consequence scale covering people, environment, plant, service and money, signed by risk and process safety?
Are zones rated on unmitigated consequence before controls are credited?
Has every High scenario been through cyber PHA, and the worst through CCE?
Does each High scenario keep at least one safeguard that works under network compromise?
Has each proposed control been tested for safety side effects and given a rollback?
Is reassessment tied to management of change?

Practitioner checklist

Adopt a shared consequence scale using the NIST SP 800-82 Rev. 3 impact categories as a starting point.
Register IT systems whose loss forces an operational shutdown.
Partition control systems into ISA/IEC 62443 zones and conduits and assign SL-T.
Add cyber scenarios to the hazard register through a joint cyber PHA.
Keep safety instrumented systems separate from control networks and check that separation holds.
Credit mechanical and hard-wired safeguards; do not credit layers that share an attack path.
Pre-agree which OT assets may be isolated during an incident and who decides.
Rate OT access accounts by the consequence of the zone they reach.

Cyber-Physical Risk vs Information Risk: Assessing Consequences in OT