How do organisations get started with Cyber PHA?

What Cyber PHA starts with in practice

cyber pha works best when organisations treat it as a focused, cross-functional assessment of a real process rather than a broad compliance exercise. The starting point is to pick a process where cyber failure could affect safety, reliability or physical operation, then define the boundary tightly enough that the team can see how digital controls, operators and equipment interact. For industrial environments, the OT Security Guide is a useful companion when you need to frame the process boundary, segmentation and safety context before the workshop begins.

That boundary matters because Cyber PHA is not just about finding vulnerabilities, it is about understanding which process functions would be affected if integrity, availability or control were lost. The team should map the system in operational terms, including control logic, human actions, remote access paths and dependencies that could turn a cyber event into a physical consequence. Starting with one high-risk process also makes it easier to prioritise the right people and avoid analysis that is too abstract to drive remediation.

How to build the first Cyber PHA workshop

The most effective first workshop brings together operational staff, safety staff and security staff who each understand a different part of the same process. Operations can explain normal and abnormal behaviour, safety can show where consequences become unacceptable, and security can identify plausible threat paths, trust relationships and control gaps. That mix helps the group separate routine reliability issues from cyber-enabled failure modes and keeps the assessment anchored in how the process actually runs.

The workshop should then walk through cyber threats to process functions, existing safeguards and the places where those safeguards can fail or be bypassed. For OT-heavy environments, CISA’s industrial control systems guidance is a practical reference point for thinking about process-aware threats, segmentation and defensive assumptions in critical infrastructure settings. The goal is not to enumerate every possible issue on day one, but to identify the few paths where a compromise would most plausibly disrupt control, visibility or safe operation.

Once those paths are identified, the team should prioritise remediation by consequence and feasibility. A weakness that can affect setpoints, alarms, interlocks, remote operation or recovery from fault conditions usually deserves more attention than a low-impact exposure that does not change process behaviour. The first Cyber PHA is successful when it produces a shortlist of changes that reduce real process risk, not when it produces a long catalogue of findings.

What a good starting scope looks like

A good starting scope is narrow enough to be understood in one workshop, but rich enough to surface meaningful cyber-physical dependencies. Assets with control authority, operator visibility, remote access, engineering workstations, historians and interfaces to business networks often make better starting points than isolated field devices, because they are where cyber compromise is most likely to change process behaviour. The question is always which assets could let an attacker, mistake or outage alter the process in a way that matters physically.

The first scope should also reflect what the organisation can actually fix. If the process is safety-critical, highly regulated or difficult to take offline, the initial Cyber PHA should emphasise high-value safeguards that can be improved without waiting for a major redesign. That usually means clearer segmentation, tighter access paths, better monitoring, better account handling and clearer operational response procedures rather than attempting to rebuild the entire architecture at once.

Risk and Threat Considerations

Cyber PHA can miss the highest-risk issues when the team scopes too broadly or invites only one function to the table. If the boundary is vague, the workshop tends to produce generic findings and understate how a cyber event could affect control, safety or recovery. The other common failure is to focus on IT-style vulnerabilities while overlooking process-specific dependencies such as operator trust, manual fallbacks, alarm handling or remote maintenance paths.

Failure mechanism: A compromise, misconfiguration or misuse of a control asset can change process state, suppress visibility or prevent timely intervention, especially where digital and physical safeguards are tightly coupled.

Impact: The result can be loss of control, unsafe operation, unplanned shutdown, equipment damage or a physical incident that is much harder to contain than a conventional cyber event.

Practitioner Guidance

What to prioritise: Start with one process where a loss of integrity, availability or control would have credible physical consequences, and choose a boundary that the workshop can fully analyse in a single sitting. If the scope cannot be explained simply, it is probably too large for a first pass.

What to verify: Confirm that the team can trace how a cyber issue would propagate into process behaviour, operator actions and safeguards. If you cannot show that chain clearly, the assessment is not yet ready to drive remediation.

Practitioner takeaway: The fastest way to make Cyber PHA useful is to anchor it in one real process and one real consequence path, then use the first workshop to identify where cyber control failures would become physical failures.

Related resources from NHI Mgmt Group

• How do organisations get started with Cyber Range Training?
• How do organisations get started with a Cyber Risk Appetite Statement?
• How do organisations get started with Board Cyber Reporting?
• How do organisations operationalise NHI ownership at scale?