In a chemical plant, control software moves pumps, valves and heaters, so a faulty or tampered update is a process safety question as well as a security one. Know every component in the control stack, who supplies it, how changes are approved, and what happens if the system must stop.
What makes this sector different?
CISA describes the chemical sector as one that manufactures, stores, uses and transports potentially dangerous chemicals that other sectors rely on. It converts raw materials into more than 70,000 products and reaches more than 750,000 end users through several hundred thousand facilities. Those numbers explain why a disruption spreads: many other industries sit downstream.
The CISA sector page points to an all hazards playbook and sector profile, which is a useful hint about how the sector frames risk. Cyber problems are one cause among several of the same bad outcomes, such as a release, a shutdown or a loss of product quality. We found no sector page content that goes into control system software, so the rest of this post leans on general operational technology guidance.
How does software supply chain risk show up?
A plant control system is a layered product. Controllers, human machine interfaces, historians, engineering workstations, remote access tools and safety instrumented systems each come from a supplier, and each has its own update stream.
Three weak points recur in the guidance:
- Unknown components. If you cannot list what runs the plant, you cannot tell whether a published flaw affects you.
- Slow patching. NIST SP 800-82 Revision 3 notes that OT has to respect performance, reliability and safety requirements, so you cannot patch the way you patch a laptop. Planned windows and testing come first.
- Open doors. CISA, the FBI, the EPA and the Department of Energy listed exposure to the public internet, default passwords and weak remote access as the primary issues to fix in OT, in guidance published on 6 May 2025.
None of these is exotic. They are inventory, change control and access, the same three topics as any software supply chain program.
Which standards should you read?
- NIST SP 800-82 Rev. 3 (September 2023). A guide to securing operational technology that covers topologies, threats and countermeasures for SCADA, DCS and PLC environments.
- ISA/IEC 62443. A series on industrial automation and control system security. It divides responsibility among asset owners, system integrators, product suppliers and service providers. Part 4-1 sets requirements for secure product development, and a technical report addresses patch management.
- CISA OT mitigations. Five short actions that a small team can start on this month.
We have not cited any chemical specific regulation here. Rules differ by country and facility type, and we did not fetch a primary source for them, so check with your safety and compliance leads.
What to do
- Build an asset list for the control network: device, firmware, supplier, owner, network zone.
- Ask each supplier how they publish security fixes, whether they provide a bill of materials for firmware, and how long they support each version.
- Separate IT and OT networks, and route data between them through a controlled zone.
- Remove public exposure, replace defaults, and require strong authentication on remote access, with least privilege and expiry for vendor accounts.
- Decide in advance how each change is tested and approved, and by whom, including emergency fixes.
- Rehearse manual operation and safe shutdown so a software failure does not decide the outcome.
Where Safeguard fits
For the custom software around a plant, such as internal dashboards, data pipelines and integration services, a dependency inventory plus reachability analysis shows which known flaws are in code that runs. That gives engineering teams a faster answer to "does this advisory affect us". It is a software supply chain tool and it does not replace process safety engineering or control system assessment.
Quick check
Is IT patching advice safe to copy to a plant network?
Not directly. NIST notes OT has performance, reliability and safety constraints, so changes need testing and planned windows. Use the same inventory and risk ranking, but a different schedule.
Who is responsible for supplier software in a plant?
ISA/IEC 62443 splits roles among asset owners, integrators, product suppliers and service providers. The owner still decides what security level the plant needs and holds the risk.
Sources
- CISA, Chemical Sector
- CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
- NIST SP 800-82 Rev. 3, Guide to OT Security
- ISA, ISA/IEC 62443 series of standards
Last reviewed: 18 October 2026.
