IT Recommends Isolating the Factory. Does the Board Understand What Stops?

The security team recommends isolating the factory from corporate IT. The board asks whether production can continue. One manager says the PLCs run locally; another points out that operators use a centrally hosted system for visibility. The decision is urgent, but “isolate the factory” does not yet describe an action anyone can assess.

Board-level cyber training should help leaders question the operational consequences of a security measure, not just recognise the threat. Use a specific isolation dilemma to practise that judgement. The outcome should be a clearer decision, supported by named technical and operational authorities, rather than a director attempting to select firewall rules.

The requirement: understand the consequences of measures

NIS2 Article 20(2) requires Member States to ensure training for members of the management bodies of essential and important entities. The intended competence includes identifying risks and assessing cybersecurity risk-management practices and their effect on the entity’s services. National implementation determines the applicable obligations. Owning a PLC does not, by itself, put an organisation within scope.

In the Netherlands, Cyberbeveiligingsbesluit Article 20 explicitly includes assessing the consequences of both risks and measures. It develops the training under Cyberbeveiligingswet Article 24; Articles 21–22 specify training and certificate requirements. The NCSC states that the Dutch Act entered into force on 15 August 2026. Confirm entity scope and each director’s applicable training deadline separately.

The exercise below is a professional recommendation addressing one learning objective. It is not a complete statutory course, a certificate of compliance or a substitute for current legal advice. It concerns the entity’s management, not a product-conformity obligation transferred to the machine manufacturer.

A hypothetical production site with shared visibility

Assume a manufacturing site has local PLC control and local safety functions, but part of the operator visualisation runs on shared infrastructure. Suspected compromise of corporate IT prompts a proposal to disconnect all links between IT and OT. The dependency map has not been checked against the current installation.

This is a fictional scenario. It does not establish that the safety functions are independent or that operation without the central display is permitted. Those are questions for competent engineering and operations personnel. Continuing could leave operators without necessary information; broad isolation could itself remove that information. Doing nothing could also allow the incident to spread.

The board needs a decision that states which boundary is involved, what services may be lost, which operating conditions have been approved and who can act. A binary question about keeping production running conceals all four.

1. Prepare one decision, not a presentation about every threat

The CISO and plant manager should prepare a short exercise brief with a controls engineer and the safety responsible person. Include the proposed isolation boundary, the affected production service, confirmed dependencies and unresolved assumptions. Use an approved, sanitised network sketch; do not distribute credentials or detailed remote-access instructions in a board pack.

Give participants the information available at that moment, including uncertainty. Do not write an exercise where the obvious answer depends on a fact nobody in the room could know. The learning objective is to distinguish a supported claim from an assumption and request the evidence needed for a responsible decision.

Prerequisites include the site’s existing emergency arrangements, delegated incident authority and current operating procedures. The exercise must not introduce a new approval barrier that prevents personnel from taking already authorised protective action.

2. Ask what the proposed measure actually changes

Instead of asking whether isolation is “safe”, ask which communication paths would be interrupted and which operational functions rely on them. Does the proposed boundary affect only a supplier connection, or also operator displays, identity services and engineering support? Who has verified the answer, and against which configuration?

Separate security intent from operating consequence. Blocking a suspected intrusion path is the intent. Losing a shared visualisation service may be a consequence. Neither should be hidden inside a reassuring label such as “network containment”. Directors do not need packet-level expertise, but they need enough understanding to challenge an answer that describes only one side.

The NCSC’s questions for directors and CISOs support a dialogue about risks, decisions and resources. The isolation questions here apply that management principle to an OT dependency; they are not prescribed questions from the law.

3. Compare bounded options with explicit authority

For the exercise, compare options such as targeted containment, continued operation within a verified restricted mode, or controlled shutdown followed by broader isolation. These are possibilities to assess, not universally available alternatives. Engineering and safety specialists determine whether the assumed operating mode exists and is permissible.

For each feasible option, record the threat addressed, remaining exposure, operational consequence, implementation authority and condition for reassessment. Avoid inventing a precise downtime estimate where no recovery evidence exists. An honest range or an unresolved dependency is more useful than a confident unsupported number.

Keep responsibilities distinct. Management approves resources and decision boundaries. Incident command coordinates response. Operations retains its authorised operating responsibilities. The integrator and product developer provide evidence about the actual configuration and dependency behaviour; the manufacturer may need to clarify supported operation. Supplier input does not remove the asset owner’s need to understand the consequence.

4. Test understanding without changing the plant

Run this as a facilitated tabletop. State clearly that no live configuration, connection or operating state is to change. Introduce one hypothetical update, for example that the shared display dependency has now been confirmed. Ask participants to explain whether their earlier choice changes and why.

Look for reasoning rather than the fastest answer. Can participants identify the missing evidence, distinguish a cyber exposure from a safety assumption and name the authorised operational decision-maker? Can they explain what would make their selected option unacceptable? Record unanswered questions as findings, not personal failures.

A tabletop cannot prove that isolation works technically. Any later functional test needs a separate engineering plan, representative conditions, approval and safe rollback. Do not convert a board exercise into an unplanned network-disconnection test.

5. Turn the learning gap into an owned improvement

Suppose the exercise shows that nobody can confirm what the central display depends on. The action is not simply “more awareness”. Assign engineering to verify that dependency, operations to assess the resulting operating limitation, and management to decide on any required investment. Agree a review point and evidence for closing the finding.

For legacy installations, independent local visibility may not be available. A supported local display, a narrower containment boundary or a replacement programme might reduce dependence, but each needs assessment. Until then, record the limitation and the approved response. A verbal assurance that operators can manage manually is not a verified fallback.

Repeat the decision exercise after material changes or when a new dependency changes the available options. Better knowledge supports resilience only if the organisation uses it to correct assumptions, allocate resources and maintain workable response arrangements.

What to retain

Keep the learning objective, participants, scenario assumptions, decisions and reasons, unanswered questions, action owners and follow-up results. Store statutory training evidence separately from exercise notes. Participation in this session does not automatically demonstrate that all required subjects were covered.

• Scope and applicable training obligations are checked.
• The proposed isolation boundary is specific.
• Operational and safety assumptions have named reviewers.
• Delegated emergency authority remains usable.
• Participants can explain consequences and uncertainty.
• Findings lead to verified improvements, not just attendance records.

For broader ownership, see our OT governance article. OT security consulting can help turn an unclear dependency into a decision exercise. Discuss one unresolved isolation decision with OT-Guard.

Reviewed: 11 October 2026. Informational guidance, not legal advice or a complete training programme. The scenario is hypothetical; operational decisions require site-specific expertise.