HAZOP is a systematic workshop method that studies how a process can deviate from its intended design by using guide words such as more, less or none. The team traces each deviation to causes, consequences and safeguards, then assigns actions. For cyber-physical systems, it should also consider malicious changes to logic, setpoints and instrumentation data.
What HAZOP Is Designed to Find
HAZOP is built to expose where a system can drift away from intended operation in ways that matter to safety, reliability, or control. The method is strongest when the team understands the design basis first, because the value comes from comparing the intended state with plausible deviations, not from brainstorming every possible failure.
For cyber-physical environments, that means the review is not just about random equipment faults. It is also about whether process variables, alarms, operator instructions, logic, or instrumentation readings can be altered in ways that change behaviour, hide a condition, or trigger unsafe actions.
How the Workshop Actually Works
A HAZOP session usually walks through the process in small, well-defined nodes, then applies guide words such as more, less, none, reverse, or other. Each guide word forces the team to ask what deviation could occur, what could cause it, what would happen next, and whether existing safeguards are enough.
The team normally includes people who know operations, engineering, instrumentation, and control behaviour, because the method depends on combining different viewpoints. The result is a structured set of deviations, causes, consequences, safeguards, and follow-up actions, rather than a generic risk list.
That structure makes HAZOP useful for design reviews, change reviews, and periodic reassessment after modifications. It works best when the team has a clear process diagram, a shared understanding of normal operation, and enough technical detail to judge whether a safeguard is truly independent and effective.
Why Cyber-Physical HAZOP Needs a Security Lens
In cyber-physical systems, the same deviation logic can be used to test malicious interference. A threat actor does not need to break the whole process if they can alter setpoints, controller logic, alarm thresholds, sensor values, or operator displays in a way that creates unsafe but plausible-looking conditions. One useful way to structure that review is to anchor the exercise in OT Security Guide, because the security question is usually inseparable from process behaviour.
The practical value is in asking whether a safeguard still works if the data feeding it is wrong, delayed, spoofed, or suppressed. That shifts the review from simple process deviation analysis to resilience against manipulation, denial of visibility, and loss of trustworthy control input.
HAZOP therefore complements, rather than replaces, security-focused threat modelling. It is especially useful where a change in one variable can cascade into interlocks, alarms, shutdown logic, or operator response, because those are the places where malicious or accidental deviations become operationally significant.
Risk and Threat Considerations
HAZOP can underestimate risk if the team treats process deviation as an equipment problem only. In cyber-physical environments, the same adverse outcome may be caused by spoofed measurements, altered control logic, weak segregation between operating layers, or misleading alarm conditions, which means the review must consider both failure and deliberate manipulation.
Failure mechanism: A deviation is analysed without challenging whether the input data, logic path, or operator view can be corrupted, so the team may overestimate the protection provided by a safeguard that depends on trusted telemetry or intact controller behaviour.
Impact: The organisation can miss attack paths that create unsafe operation while preserving the appearance of normality, leading to delayed detection, incorrect operator action, or a missed opportunity to install an independent safeguard.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | RA-3 — Risk Assessment | HAZOP is a structured deviation and consequence review method. |
| AU-2 — Event Logging | Cyber-physical HAZOP depends on observable control and alarm events. | |
| Recommendation — Use RA-3 to identify deviations, causes, consequences and safeguards during process reviews. Ensure control and alarm events are logged so deviations can be reviewed and investigated. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | HAZOP often feeds follow-up actions for weak or exposed control components. |
| Recommendation — Prioritise remediation of control-path weaknesses revealed during HAZOP reviews. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset vulnerabilities are identified and documented | HAZOP identifies where process design and safeguards can fail. |
| Recommendation — Document process deviations and safeguard weaknesses identified in the workshop. | ||
| MITRE ATT&CK | T0831 — Manipulation of Control | Cyber-physical HAZOP should consider malicious changes to control behaviour. |
| Recommendation — Map HAZOP scenarios to control-manipulation techniques and hunt for related indicators. | ||
Practitioner Guidance
What to verify: Check that every safeguard in the HAZOP worksheet is specific, independent, and tied to a real failure mode. If a safeguard depends on the same sensor, logic, or HMI path that could be compromised, treat it as weaker than it first appears.
Decision rule: If the process deviation could be created by both accidental fault and deliberate manipulation, record both in the same node review. That usually produces better action items than running separate safety and security conversations that never meet.
What practitioners underestimate: Teams often focus on obvious process upset and overlook manipulated setpoints, alarm suppression, or view changes that delay recognition of the upset. Those are the cases where HAZOP adds the most value beyond a conventional checklist.
Practitioner takeaway: HAZOP works best when the team treats the process model as something that can be wrong, not just the equipment, because the most important deviations are often the ones that look operationally normal until the safeguard fails.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org