At a mining operation, defenders should inspect four things first: how people and vendors connect remotely, the engineering workstations that program equipment, the maintenance paths vendors use, and the software and firmware inside control systems. Do this with operations staff, because safety and uptime constrain every change.
Why does mining need a different approach than an office?
NIST SP 800-82 Revision 3 is the guide to operational technology security. It covers systems that interact with the physical environment and says the guidance has to address their "unique performance, reliability, and safety requirements." Its examples include industrial control systems, building automation and physical access control.
A patch that is routine on a laptop may need a planned stop on a haul fleet controller or a ventilation system. So the first job is not scanning. It is knowing what you have and how it is reached. Note that NIST published an initial public draft of Revision 4, with public comments due by 30 November 2026, so check for the current version.
What should you look at, in what order?
Remote access. Mines are remote, so connections to site networks are normal: employees, contractors and equipment makers. List every path in, who owns it, whether it uses multi-factor authentication and whether sessions are logged. Remove paths nobody can explain.
Engineering workstations. These are the machines that program controllers. They carry both the tools and the trust. Check who can log in, what software is installed, how files move onto them and whether they are also used for email.
Vendor maintenance. Equipment suppliers often keep standing access or bring their own laptops. Record which vendors have access, for which systems, and under what approval. A standard such as ISA/IEC 62443 includes a part on patch management, and its asset owner program requirements cover how you run these relationships.
Software and firmware inside equipment. Controllers, gateways and fleet management systems run code with dependencies you did not write. Ask suppliers for a software bill of materials and a way to receive security notices. You cannot assess what you cannot list.
Network boundaries. Check where the control network meets the business network. Document the connections and what is allowed to cross.
Backups and recovery. Confirm you can restore controller configurations, and that the backups are kept somewhere an intruder on the main network cannot reach.
Which standards apply?
ISA describes the ISA/IEC 62443 series as defining requirements and processes for securing industrial automation and control systems, and as bridging the gap between operations and IT and between process safety and cybersecurity. ISA's page names sectors like building automation, power, transportation and process industries. Mining is not named there, but the series is written for control systems in general, so treat it as a reference framework rather than a mining specific rule. Your regulator or customer may require something different, so check local rules.
What are the honest limits?
Nothing here is a complete program. Inventory and access review are the foundation, and the next steps depend on your sites, vendors and risk. Do not scan live control networks with tools designed for offices, since some devices react badly to unexpected traffic. Agree changes with the people responsible for safety.
What to do
- Form a small team with operations, engineering and security.
- List every remote access path and vendor connection with an owner for each.
- Inventory engineering workstations and control systems, with software versions.
- Ask each equipment supplier for a software bill of materials and a security contact.
- Map where the control network meets everything else.
- Test restoring a controller configuration from backup.
- Use NIST SP 800-82 and ISA/IEC 62443 to decide the next layer of controls.
Quick check
Should we patch control systems immediately?
Not blindly. Test, plan around operations and follow the supplier's guidance, since a change can affect safety and uptime.
Is IEC 62443 mandatory for mines?
The sources we read do not say so. It is a reference series, and your regulator or customers decide what is required.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology Security, fetched 18 October 2026
- ISA/IEC 62443 series of standards, fetched 18 October 2026
Last reviewed: 18 October 2026.
