Industrial Cybersecurity: A Primer for MSPs With Industrial Clients

Industrial cybersecurity starts where your RMM agent stops installing. Everything past that line runs the physical process: PLCs, drives, sensors, HMIs and the safety systems that trip a machine before somebody gets hurt. Some of it overlaps with the IT security you already sell. The rest is a separate discipline, with a different buyer and a much worse failure mode.

You've probably heard the objection from inside your own team. We already run their IT security, the plant is just more of the same.

It isn't.

An IT outage costs money. An OT outage can hurt somebody, scrap a batch, or leave a furnace cold long enough that restarting it becomes a project of its own. That one difference reshapes every decision downstream of it, and it's why the factory floor sits unsold in most MSP portfolios.

MSP Pentesting is channel-only. We deliver the industrial assessment and the testing under your logo, we never approach your client, and they don't know we exist.

Where industrial cybersecurity starts and stops

The term gets stretched to mean anything with a machine in it, so let's draw the boundary. The standards world describes plant environments using the Purdue Model, the layered reference architecture NIST SP 800-82 leans on. It numbers a site outward from the physical process.

• Level 0 and 1, process and basic control. Sensors, actuators, variable frequency drives, PLCs, and the safety instrumented systems that trip the process when a reading goes out of band. This is where physics happens.
• Level 2, supervisory control. HMIs, SCADA servers, DCS operator consoles and engineering workstations. Humans watch and steer the process from here.
• Level 3, site operations. Historians, batch systems, MES, local domain controllers and plant asset management. This is the layer that quietly grew a link to the business network at some point nobody wrote down.
• Level 3.5 and above, the industrial DMZ and enterprise. The broker layer between plant and corporate, plus the ERP and file services you already manage today.

You almost certainly own Level 4 and up already. The commercial ground you aren't covering starts at 3.5 and runs downward.

One correction worth carrying into client meetings. Don't tell a room that IEC 62443 is built on these levels, because it isn't. 62443 partitions a system by risk into zones and conduits, not by level. The Purdue map is a decent first draft of a zone model. It isn't the finished product, and an assessor knows the difference.

Why it isn't IT security applied to a factory

Some of the technology looks familiar. The constraints around it are close to inverted.

Start with how long the gear lives, because it drives everything else. NIST SP 800-82 puts OT component lifetime at 10 to 15 years and frequently longer. Your client's IT fleet turns over in three to five. On the plants we walk, twenty-year-old equipment in daily production is routine.

Then the priority order. In IT, confidentiality usually leads. On a plant floor safety comes first, availability comes second, and confidentiality lands a distant third, because nobody is exfiltrating the recipe for corrugated cardboard. Get that inversion straight before your first site meeting.

The rest of the differences are the ones MSPs underestimate. Put this in front of an operations manager and watch them nod.

Read the change control rows twice. Touch a controller without OEM approval and your client can lose the support agreement on a machine worth more than the building it sits in. That stops being a security decision and becomes a commercial one. Which means it belongs in your scoping conversation on day one, not in a findings report six weeks later.

The standards your client will be asked about

You don't need to master all of them. You need to know which one the auditor, the insurer or the client's biggest customer is going to name.

• ISA/IEC 62443. The core standard series for industrial automation and control systems. If you take one idea from it, take zones and conduits from 62443-3-2: group assets by risk, define what's allowed to cross between groups, and most of the architecture work follows from there. 62443-3-3 sets out system security requirements and Security Levels 1 through 4 (SL 0 exists, it just carries no requirements). 62443-2-1 covers the asset owner's security program.
• NIST SP 800-82 Rev. 3. Published in 2023 and retitled Guide to Operational Technology Security. It's free, it's readable, and it's the right starting point for your engineers. It applies an OT overlay to the NIST SP 800-53 control families.
• NIST CSF 2.0. The executive-facing wrapper. Most industrial clients already report against it or something derived from it, so use it for the board conversation and 62443 for the engineering conversation.
• IEC 61511. Functional safety for the process industries. You won't own this, but knowing it exists tells the safety engineer you're not a tourist on their floor.

Sector rules stack on top. Water and wastewater utilities, pipelines under TSA security directives, electric utilities under NERC CIP, and defense suppliers under CMMC all carry their own obligations. Ask which ones apply in the first meeting. The answer changes what evidence your client needs from you.

Where the commercial opportunity sits

Here's the honest picture. Industrial work carries better margin than most managed IT. Competition is thin, the buyer isn't the IT director, and the alternative quote usually arrives from a specialist consultancy pricing a mid-market job at enterprise rates.

Four things make it sell.

• The budget is one you can't currently see. Plant capital and maintenance budgets sit outside the IT line entirely. A downtime-avoidance argument gets funded from a pocket your existing agreement never reached.
• Customers and insurers are forcing the question. Manufacturers are increasingly asked to attest to plant network segmentation and controlled vendor remote access by their own customers, particularly through automotive and aerospace supply chains. Your client is answering those questionnaires today, badly.
• Incumbency is weak on both sides. The controls integrator understands the process and not security. The IT provider understands security and not the process. Whoever bridges that gap first tends to keep the whole account.
• It's an annuity, not a project. Discovery, then risk assessment, then segmentation, then monitoring, then annual testing. Each phase produces the evidence that justifies funding the next one.

What kills these deals is over-reaching. Don't quote a full 62443 program to a 200-person manufacturer. They'll say no, and you won't get a second meeting.

Sell the first rung.

A service ladder that works

1. Site discovery and asset baseline. Two to five days, fixed price. It's the cheapest thing on the menu, and it produces the findings that justify everything above it.
2. OT risk assessment. Zones and conduits, remote access paths, and a prioritized gap list mapped to 62443 or 800-82. Our risk assessment service covers this under your brand.
3. Segmentation and remote access remediation. Usually the largest single ticket, and the one operations will champion because they understand what it protects.
4. Boundary penetration testing. Test the IT to OT crossing points, the jump hosts, the vendor VPNs and the industrial DMZ. Not the live controller running a press.
5. Annual reassessment and retest. Recurring revenue attached to a deliverable your client will read.

Rung one is the easiest sale you'll make in this category. Every rung after it gets priced off what rung one found.

Testing an industrial environment without breaking it

This is where MSPs get nervous, and they're right to be. Standard practice lifted from the IT playbook is genuinely dangerous on a plant network. Legacy controllers have documented failure modes when they receive malformed or high-rate traffic they were never designed to parse, and CISA advisories regularly describe exactly that class of denial of service.

So the method changes. Five rules.

• The boundary is the target. Most real-world industrial incidents start on the IT side and cross over. The Colonial Pipeline event in 2021 was IT ransomware that led to an operational shutdown. Test the crossing points hard: the industrial DMZ, jump hosts, vendor VPNs and dual-homed engineering laptops.
• Nothing intrusive without a window. Agreed scope, agreed hours, a named abort authority from operations, and somebody standing in the control room while it happens.
• OEM position in writing. Get it before anything touches a controller under warranty or a machine under an active service contract. Email is the minimum.
• Use the bench where one exists. Plenty of sites keep a commissioning rig or an identical spare line. Deep protocol work belongs there, not on a running process.
• Never the safety system in production. The SIS is the last layer between a process upset and an incident. TRITON in 2017 showed what deliberately targeting one looks like. It isn't a test target on a live plant, at any price.

If a testing partner offers to run their standard external methodology across a plant network at full speed, they don't belong in your supply chain. White labeled pentesting only protects your brand if the person holding the keyboard knows what's on the far end of the cable.

Frequently asked questions

What is industrial cybersecurity?

It's the protection of industrial control systems and the physical processes they operate, covering PLCs, SCADA and DCS platforms, safety instrumented systems, historians, and the networks joining them. The defining difference from IT security is consequence. A failure affects physical safety and production output, not only data.

Is industrial cybersecurity the same thing as OT security?

Close enough for most conversations. OT security is the wider term and takes in building management, medical devices and transport systems. Industrial cybersecurity and ICS security usually point specifically at manufacturing, energy, water and process industries. Use whichever phrase the client uses, and don't correct them in a sales meeting.

Do our clients need IEC 62443 certification?

Almost certainly not full certification. Most mid-market manufacturers need to show they've assessed risk, segmented the plant network and brought vendor remote access under control. Using 62443 as the framework for that work is sensible and defensible. Formal site or product certification is a different scale of project, and it's driven by a contract rather than by good practice.

What does our team need to know before the first plant meeting?

Less than you'd think. Learn the Purdue levels well enough to place a device, learn why active scanning is a problem, and learn to ask who signs off on a change to that machine. That's enough to hold a credible first conversation. You keep the relationship, the scoping, the segmentation and remote access work, and the ongoing management. The specialist delivery gets handed to a partner who can't approach your client directly.

Where do we start with an existing manufacturing client?

Ask for their OT asset inventory. Whatever comes back, accurate or otherwise, tells you where you stand. Then walk the plant floor with the maintenance lead rather than the IT manager. You'll find remote access appliances and unmanaged switches nobody documented, and that walk becomes your first proposal.

Start with one plant

Industrial cybersecurity isn't a bolt-on to the stack you already sell. It's a separate discipline with a different buyer, and it protects equipment that'll outlive your current agreement. That's exactly why it's worth entering. The first provider who can speak both languages usually keeps the account.

Start small. Baseline the assets, then sell the remediation the baseline justifies. If you want the assessment and the testing delivered under your own logo, get a pentest quote and we'll scope the first site with you.