DNV GL launches cybersecurity RP geared toward operational technologies

DNV GL has launched a globally applicable recommended practice (RP), DNVGL-RP-G108, “Cybersecurity in the oil and gas industry based on IEC 62443,” addressing how oil and gas operators, together with system integrators and vendors, can manage emerging cyber threats.

Critical network segments in production sites, which used to be kept isolated, are now connected to networks, making the operational technology (OT) more vulnerable. According to recent research, 59% of oil and gas companies surveyed believe there is greater risk in the OT than the IT environment. Managing threats toward OT requires knowledge beyond general information security, such as oil and gas operational domain competence, in particular related to automated, unmanned, integrated and remote operations which are accessible online.

The new RP is the result of a nearly two-year-long joint industry project (JIP) together with partners Shell Norge AS, Statoil, Woodside, Lundin Norway, Siemens, Honeywell, ABB, Emerson and Kongsberg Maritime. The Norwegian Petroleum Safety Authority has observed the work and exchanged experiences with the JIP group from a regulatory perspective. The RP is based on the IEC 62443 standard, international practice and professional experience. It takes into account HSE requirements and the IEC 61511 functional safety standard. It outlines a tailored approach for the oil and gas industry on how to build security, with the emphasis on OT.

Pål Børre Kristoffersen, JIP Project Manager, DNV GL – Oil & Gas, said, “Industry players need confidence that security countermeasures can deal with more frequent and sophisticated cyber-attacks, which are becoming increasingly costly and harder for companies to recover from. Dealing with cybersecurity challenges has become a key focus area for the oil and gas sector, and there is greater awareness of the requirements that need to be in place. There has, until now, been a lack of guidance for the oil and gas industry on how to implement these requirements. The new RP, developed in collaboration with key players, puts OT, together with IT, in the limelight, so the oil and gas industry can protect their operations.”

The scope of the RP is guidance on how to use the IEC 62443 series of standards for projects and operational phases, including good practice and a reusable approach. It is tailored for oil and gas onshore and offshore operations. The IEC standards define what to do, while the RP describes how, and implementation will result in:

• A reduced risk of cybersecurity incidents;
• Cost savings for operators by reducing the resources needed to define requirements and follow up;
• Cost savings for contractors and vendors based on standardized design requirements from operators; and
• Simplified audits for authorities and auditors due to common requirements and common conformance claims.

Julie Fallon, Senior Vice President Engineering at Woodside, said, “Aligning our operational technology cybersecurity approach to IEC 62443 enables us to learn from and contribute to industry knowledge and capability. The recommended practice provides practical guidance on applying the standard to oil and gas. The OT convergence between IT and engineering is critical to ensuring successful OT security management. The JIP process leading to this RP has enabled our team to leverage industry best practices, share learnings and grow capability.”