OT/IT Cyber Security Management System

Winner! Cyber Consultant of the Year at the 2026 Australian Cyber Awards Read >

Winner! Cyber Consultant of the Year

Industrial Cyber Security for Water

OT/IT Cyber Security Management System

The client required an OT cyber risk approach that reflected operational reality – not a generic IT-centric compliance exercise..

Client Context

A water utility operating critical SCADA and control systems, subject to regulatory obligations and increasing scrutiny of cyber risk governance..

Ask / Requirement

The water sector client engaged SIS to establish a pragmatic, risk-based Information Security Management System (ISMS) for ICT, SCADA, and control systems – to manage OT cyber risk to business-critical systems and meet regulatory and governance obligations.

Existing security practices lacked the structure needed to demonstrate defensibility across both ICT and SCADA environments.

What We Delivered

SIS delivered an ISO/IEC 27001-aligned ISMS, tailored to the client’s operational context, including governance, risk management processes, incident management, and business continuity considerations.

The ISMS was designed to be practical and maintainable by the client’s team – not a compliance artefact that would sit on a shelf. It reflected the realities of running water infrastructure, not a generic IT security template.

Outcome

The client achieved a defensible, auditable security framework that satisfied regulatory obligations and materially improved OT cyber risk management. The ISMS gave the client a structured basis for ongoing governance and a credible position in the event of an audit or incident review.

If you’d like to know more about our many years of experience in providing industrial cyber security solutions:

 

Get in touch >

Success Stories
Power

AMI & Digital Transformation

The client’s AMI platform was becoming a constraint on performance, cost, and future operating models – rather than an enabler of digital transformation.

View Case Study >
Oil & Gas

OT Asset Visibility Solution

Limited visibility across ICS environments made it difficult for the client to understand and prioritise OT cyber risk.

View Case Study >
Mining

OT Security Strategy & Architecture (Remote Autonomous Mining)

As the client accelerated toward remote autonomous mining, existing security models could not keep pace with the scale, safety, and risk implications of operating critical assets without on-site control.

View Case Study >
Health

Stress & penetration
testing network connected
medical devices

SIS’ specialist industrial cyber security testers applied the latest exploit tools and techniques to perform stress and penetration testing of network connected medical device technologies, to assess risks to the reliability of devices, and ultimately the safety of patients.

View Case Study >
Water

OT/IT Cyber Security Management System

The client required an OT cyber risk approach that reflected operational reality – not a generic IT-centric compliance exercise.

View Case Study >
Transport

Enterprise-Wide Security Architecture (IT and OT)

Major rail technology initiatives were outpacing the organisation’s ability to manage cyber risk consistently across IT and OT.

View Case Study >
Critical Manufacturing

Training helps metals
manufacturer create a
stronger security culture

SIS’ industry-leading industrial cyber security training was able to help a metals manufacturer create a stronger culture of security, harmonising with the organisation’s rigorous safety culture, fostering a commitment to industrial cyber security from plant operators and administrators, encouraging users to act responsibly and thus operate more securely.

View Case Study >
Success Stories
Power

Meeting European Union
NIS Directive obligations

SIS’ bespoke approach towards the assessment of critical infrastructure enabled a UK power company to determine compliance to the EU NIS Directive, and to develop an improvement plan towards strengthening resilience to cyber threats.

View Case Study >
Oil & Gas

Technical vulnerability
and risk assessment of
OT infrastructure

Via a technical vulnerability and risk assessment of OT infrastructure for a gas pipeline company, SIS successfully assisted the gas pipeline company to understand their current-state risk posture in order to determine what an appropriate risk appetite (risk level) is, and the prioritisation of mitigation actions in order to reduce the level of risk exposure to cyber threats.

View Case Study >
Mining

Top-down, enterprise wide
security architecture

SIS adopted a top-down, risk-driven approach to develop an enterprise-wide security architecture for a resources company, driven by, and integrated with the organisation’s broader business strategy, focused on technology optimisation to deliver secure mine operations.

View Case Study >
Health

Stress & penetration
testing network connected
medical devices

SIS’ specialist industrial cyber security testers applied the latest exploit tools and techniques to perform stress and penetration testing of network connected medical device technologies, to assess risks to the reliability of devices, and ultimately the safety of patients.

View Case Study >
Water

Implementing a Cyber
Security Management
System (CSMS)

As a result of SIS’ Operate and Maintain services, a regional water agency in Australia was able to implement a Cyber Security Management System (CSMS) provides the organisational rigour to ensure infrastructure is resilient to escalating cyber threats, and ensuring the right security controls are in place to mitigate risk.

View Case Study >
Transport

Audit identifies
high-risk areas of focus
and remedial priorities

SIS’ industrial cyber security audit services enabled a government statutory authority to benchmark the security posture of state transport agencies, identifying cyber security risks and prioritisation of key actions for risk mitigation.

View Case Study >
Critical Manufacturing

Training helps metals
manufacturer create a
stronger security culture

SIS’ industry-leading industrial cyber security training was able to help a metals manufacturer create a stronger culture of security, harmonising with the organisation’s rigorous safety culture, fostering a commitment to industrial cyber security from plant operators and administrators, encouraging users to act responsibly and thus operate more securely.

View Case Study >
SIS conducted a risk assessment of our operational technology environment and we were very impressed with their approach, methodology, execution, and delivery. They are adaptable, technically astute, and demonstrated a strong ability to fully understand business requirements specific to the oil and gas sector.
PMO and GRC ConsultantOil and Gas
The project provided our organisation with a clear view of our cyber security maturity and highlighted the range of threats that could impact our systems at any time. As a result of the assessment, several mitigation steps have already been implemented based on SIS’ key recommendations.
SCADA and EMS ProgrammerEnergy Interconnection
SIS delivered an Information Security Management System framework that ensured governance was appropriately embedded across ICT operations, including business critical control systems. This significantly strengthened our audit compliance posture against recognised industry standards.
Chief Information OfficerWater Utility
SIS effectively identified the required security controls to ensure essential services such as patching, configuration management, data backup, and secure remote access were available across both IT and OT environments for our new ADMS platform. Their familiarity with OT security is exceptional.
ADMS Project ManagerElectricity Distribution
SIS’ tailored methodology for control systems testing demonstrated a high level of specialist expertise in this domain. They also showed strong flexibility in accommodating changing schedules and efficiently mobilising resources to meet critical production deadlines during a major network management system upgrade.
OT Security LeadEnergy Infrastructure
SIS consultants applied a professional and structured approach to a complex OT enablement scenario. This resulted in comprehensive designs covering key functional and non functional requirements, while also identifying security risks and the supporting process framework. SIS is best in class for IT and OT integration work.
Technology Program ManagerMining and Resources
SIS’ level of expertise in operational technology security is outstanding.
Senior Technology LeaderRail and Freight Transport

See how
your organisation
stacks up against
the benchmark

Put your organisation to the test with the SIS Industrial Cyber Security Assessment Scorecard.
Take the Scorecard
Winner – Cyber Consultant of the Year (SME). Finalist for Cyber Professional of the Year in Industries, Logistics & Critical Infrastructure, and a Finalist for GRC Provider of the Year.
Read more >

Tell us a bit about you

Our workshops are tailored, so please check any specific areas of interest you might have.

Tell us a bit about you

Our workshops are tailored, so please check any specific areas of interest you might have.