◇ OpenCyber Academy
Postgraduate · Chapter 9 · English

Chapter 9 — OT, IoT and cyber-physical security: leadership and assurance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — OT, IoT and cyber-physical security: leadership and assurance

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Claims, arguments, evidence"]
  N2["9.2 Reading the check"]
  N3["9.3 Assurance is not compliance"]
  N4["9.4 Evidence freshness"]
  N5["9.5 Reporting to a board"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Claims, arguments, evidence"]
  N2["9.2 Reading the check"]
  N3["9.3 Assurance is not compliance"]
  N4["9.4 Evidence freshness"]
  N5["9.5 Reporting to a board"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 Claims, arguments, evidence]
    |
    v
[9.2 Reading the check]
    |
    v
[9.3 Assurance is not compliance]
    |
    v
[9.4 Evidence freshness]
    |
    v
[9.5 Reporting to a board]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) structure an assurance argument from a top claim down to evidence; (2) find unsupported claims mechanically; (3) distinguish assurance from compliance; and (4) present assurance status to a board without overstating it.

9.1 Claims, arguments, evidence

An assurance case states a top claim ("BWRP's OT risk is acceptable"), decomposes it into sub-claims, and supports each leaf with evidence: test reports, configuration reviews, drill records. Goal Structuring Notation is a common graphical form. The value is that every gap becomes visible as a claim with nothing beneath it.

"""Lab 09: check a synthetic assurance argument: every claim needs evidence or fully supported sub-claims."""
arg = {
    "G1 BWRP OT risk is acceptable": ["G2 remote access controlled", "G3 dosing integrity protected", "G4 recovery tested"],
    "G2 remote access controlled": ["E1 broker config review 2026-09", "E2 session log sample"],
    "G3 dosing integrity protected": ["G5 setpoint limits enforced", "G6 writes monitored"],
    "G5 setpoint limits enforced": ["E3 bench test report"],
    "G6 writes monitored": [],
    "G4 recovery tested": ["E4 restore drill 2025-11"],
}
def supported(node, path=()):
    if node.startswith("E"): return True
    kids = arg.get(node, [])
    return bool(kids) and all(supported(k, path + (node,)) for k in kids)
for g in arg:
    print(f"{g:34} {'supported' if supported(g) else 'UNSUPPORTED'}")

Run with python3 lab_assure.py. Verified output:

G1 BWRP OT risk is acceptable      UNSUPPORTED
G2 remote access controlled        supported
G3 dosing integrity protected      UNSUPPORTED
G5 setpoint limits enforced        supported
G6 writes monitored                UNSUPPORTED
G4 recovery tested                 supported

Writing the argument this way makes the board's question precise. Instead of asking whether OT security is good, it asks which claims are supported and which are not. Each piece of evidence also needs an owner and a date, so the case can be refreshed. BWRP's argument in Lab 9 is deliberately small, to show the structure before it grows.

9.2 Reading the check

G6 "writes monitored" has no evidence and no sub-claims, so it is unsupported. G3 depends on G6 and therefore fails, and the top claim G1 fails with it. G2 and G4 are supported. The check is strict on purpose: a top claim cannot be partly true for a board.

The check only tests structure. It cannot tell whether E3's bench test was the right test, or whether E2's sample of session logs was large enough. Those are judgements for a reviewer. Use the mechanical check to find gaps quickly, then read each piece of evidence to see whether it really supports its claim.

9.3 Assurance is not compliance

Compliance shows that required controls exist. Assurance argues that risk is acceptable given the system's actual threats and consequences. A plant can be compliant with a checklist and still have an unsupported claim on its most important loop — dosing integrity here.

BWRP could pass a checklist that asks whether remote access is controlled and recovery is tested, because G2 and G4 are supported, while the claim that matters most to residents, dosing integrity, remains unsupported. Assurance puts that gap at the top of the board paper, where a compliance report would have hidden it among passed items.

9.4 Evidence freshness

Evidence ages. A restore drill from 2025-11 supports G4 today; in two years it will not. Mature assurance cases attach a validity period to each item and fail claims whose evidence has expired.

Set the validity period by how quickly the evidence could become wrong. A broker configuration review may need repeating after every major change, while a restore drill might be valid for a year. Add the expiry dates to the argument itself, so that the check in Lab 9 can mark a claim unsupported when its evidence lapses.

9.5 Reporting to a board

Report: top claim status (not yet supported), which sub-claim blocks it, what evidence is planned and when. Avoid red-amber-green colours without the underlying claims; colour hides reasoning.

Daniel's board paper follows this structure. It says plainly that G1 is not yet supported, names G6 as the blocking claim, gives the date by which evidence will exist and identifies the compensating evidence until then. A board member can ask a sharper question of that paper than of a single amber light.

Worked example (synthetic BWRP)

Daniel's board paper: "G1 is not yet supported because write monitoring on PLC-D (G6) has no evidence. Planned: deploy passive monitoring on the dosing network by January and attach the first month's alert review as evidence E5. Until then, compensating evidence is E3 (setpoint limits bench test)."

Synthetic case — Bayside Water Reclamation Plant. The argument structure and evidence identifiers are invented.

Errors and limits

A supported tree is only as good as the evidence's relevance; a test report can attach to the wrong claim. Mechanical checks do not judge evidence quality.

Exercises

Synthesis

Assurance makes leadership claims auditable: every top claim decomposes to fresh, relevant evidence, and gaps are reported as gaps.

Continue studying — chapter 09 of 12

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →