In a steel mill, inspect the paths into the control network first: remote access, vendor connections and anything that bridges office and plant networks. Then inventory the software on engineering workstations and controllers, and confirm the plant can run safely by hand. NIST SP 800-82 and IEC 62443 give the structure.
Why is a mill different from an office?
NIST's guide to operational technology security describes OT as programmable systems that interact with the physical environment, and it says security measures must account for the performance, reliability and safety requirements of those systems. A mill is a clear example. Heavy equipment and hot process steps mean that a stopped or misbehaving control system is not an inconvenience; it can be a safety event. That changes the order of operations. You cannot patch on a Tuesday evening the way you would patch an office laptop, and you cannot scan every device the way an IT team scans a network without planning.
This article describes no specific incidents in steel plants, because it draws only on sources that were checked. The method below is general to industrial control environments.
Day 1 to 2: draw the connections
Draw every route into the plant network. Include the obvious (a firewall to the corporate network) and the forgotten: a modem on a furnace controller, a vendor's persistent VPN, a laptop that moves between the office and the mill floor, a cloud service that reads production data.
CISA's mitigations from the 2015 Ukraine grid incident are a good yardstick for remote access, because they came from a real operational intrusion. They recommend making remote access operator-controlled and time-limited, avoiding persistent vendor connections into control networks, and using strong multi-factor authentication with dissimilar factor types. They also advise isolating control networks from untrusted networks, especially the internet.
Day 3 to 4: inventory what runs the process
List controllers, human-machine interfaces, historians and engineering workstations, with firmware or software versions and owners. IEC 62443, the industrial security series published with ISA, addresses asset owners, system integrators and product suppliers, and its parts include system requirements with security levels and technical requirements for components. Use its vocabulary when you talk to your integrator, so each party knows what it owes the other.
Include the ordinary software around the controllers: the Windows or Linux hosts, the data collection services, the reporting tools your engineers wrote. These carry dependencies like any other application. A software bill of materials for them is cheap and tells you what to look at when a vulnerability is announced. Reachability analysis helps separate flaws on an isolated, unreachable service from those on something exposed.
Day 5: practice the bad day
Ask the question CISA's Ukraine guidance asks: if the control system is breached, can you operate or shut down the process safely, assuming the system may be working against safe operation? Check where manual controls are, who is trained, and how long a manual run is sustainable. Confirm that backups of controller programs exist, are offline, and have been restored in a test.
What should you not do first?
Do not start with a full-network active scan of live controllers. Some control devices handle unexpected traffic poorly, and NIST's emphasis on reliability and safety exists for that reason. Start with passive observation and documentation, and test changes in a representative lab or during planned outages.
What to do
- Map every connection into the plant network, including vendor and wireless paths.
- Replace persistent vendor connections with operator-approved, time-limited access and strong multi-factor authentication.
- Separate plant and corporate networks and close unused ports.
- Inventory controllers, HMIs, historians and engineering workstations with versions and owners.
- Generate bills of materials for in-house and vendor software around the controllers.
- Store offline backups of controller programs and test a restore.
- Rehearse safe manual operation and shutdown with the operators.
- Use NIST SP 800-82 and IEC 62443 vocabulary in contracts with integrators and suppliers.
Quick check
Which standards should a mill start with?
NIST SP 800-82 Revision 3 for OT security guidance and the IEC 62443 series for roles, system requirements and component requirements. Neither replaces your own safety procedures.
Should we scan the plant network like an office network?
Not without planning. NIST stresses OT reliability and safety needs, so begin with passive discovery and test changes in a lab or planned outage.
Sources
- NIST SP 800-82 Revision 3: Guide to Operational Technology Security
- ISA: ISA/IEC 62443 series of standards
- CISA: IR-ALERT-H-16-056-01 mitigations
- CISA: Industrial control systems
Last reviewed: 18 October 2026.
