| Decision | Operations | Engineering | IT & Security | Executive |
|---|
A reference model. A is accountable — one per row, never more. C is consulted before the decision is made. Convergence does not fail on technology. It fails on rows with no A in them.
Scope
Seven decisions that require both authority and industrial context.
Each area crosses organizational boundaries. The work is to create a shared view of consequence, make ownership explicit and turn the decision into a sequence the operation can execute.
Board and executive reporting
Cyber-physical risk expressed in the terms a board already governs by: production availability, safety, environmental exposure, regulatory standing, delivery commitments and capital sequencing. Not maturity scores without meaning, not alert counts, not a technology roadmap presented as a risk position. The objective is that directors can ask informed questions and record a defensible decision, and that the answer they get next quarter is comparable to the one they got this quarter.
IT/OT governance design
Decision rights, accountability and joint risk ownership, written down. Who approves a change to an industrial firewall. Who owns identity in the OT domain. Who declares an OT incident, who may authorize containment, and who holds stop authority. Where the enterprise standard applies unchanged, where it applies with a documented industrial exception, and who signs that exception. Most IT/OT friction is not cultural. It is the predictable result of two competent groups operating without agreed decision rights.
Program sequencing and budget defense
Turning a list of needed work into a funded, sequenced, multi-year program: what comes first and why, what each item depends on, what it will disrupt, what it costs to delay, and which items can wait without the position getting worse. Then defending that sequence in the rooms where capital is allocated, against competing priorities from operations, reliability and IT, in the language those rooms use.
Vendor, integrator and OEM challenge
Technical scrutiny of what is being proposed, sold, or written into a contract, on your behalf and with no commercial interest on ours. Whether an architecture recommendation serves your operation or the supplier's product line. Whether a support agreement quietly requires a remote access path nobody has governed. What security obligations belong in an EPC scope, an integrator contract or an OEM service agreement before signature rather than after commissioning. Our team has worked on both the asset-owner and the OEM side, which is how we know where the product answer stops being the right answer.
Regulatory posture and audit readiness
Establishing what actually governs you, what evidence a regulator or auditor will expect to see, what you can currently produce, and what the gap costs to close. Preparing your people for the conversation, including how to answer accurately about known gaps rather than defensively. Compliance is treated as a floor and a reporting obligation, not as the definition of the program.
Leadership support to the person who already owns the risk
Direct, confidential support to a CISO, COO, engineering director or plant leader who holds accountability for cyber-physical risk without the industrial background, the OT background without the security mandate, or the mandate without a peer to test a judgment against. This is a working relationship: reviewing decisions before they are taken, rehearsing a board conversation, testing a vendor argument, and building the context so the role is held more strongly a year from now than it is today.
Industrial AI and digital transformation governance
Selecting and governing Industrial AI and digital initiatives against operational consequence. We help leadership prioritize use cases, challenge architecture and vendors, define data and decision authority, design the operating model, and establish the controls required before automation is allowed to influence a consequential process. The objective is value without weakened safety, reliability or accountability.
A risk that two capable teams each believe the other owns is a risk nobody is managing.
Experience behind the role
Engineering depth with executive standing.
This engagement is held by InnovAKT's executive leadership, with experience spanning control systems engineering, global OT cybersecurity operations and executive business leadership across industrial and building environments. Meet the leadership →
A board conversation, a vendor negotiation and a permit-to-work discussion each have their own language. The value of the role is being fluent in all three on the same day.
- EngineeringIndustrial control systems background spanning DCS and SCADA
- Asset ownerControl systems engineering and operations in oil and gas
- Business builderEngineering, product, sales and general-management leadership
- ExecutiveFormer General Manager for global OT cybersecurity managed services
- Global experienceLed multidisciplinary teams supporting critical-infrastructure sectors and regions
- AdvisoryOT cybersecurity, Industrial AI, digital transformation and operating-model design
Fit
When this is the right engagement — and when it is not.
Use OT CISO Advisory when
- Accountability for cyber-physical risk is either unassigned or assigned to someone without the industrial context to exercise it.
- IT and OT are both right, in their own terms, and there is no forum with the authority to settle it.
- A board or audit committee is asking questions nobody can currently answer in business terms.
- A program is funded and running, but sequencing and decisions are contested every quarter.
- You are entering a major contract, acquisition or modernization and need independent technical challenge before signature.
- A capable leader owns the risk and needs a peer with industrial experience to test judgments against.
Do not use OT CISO Advisory when
- What you need is delivery capacity and hands on the work. That is AKTSecure™, not this.
- You have no view of operational exposure yet. Governance applied to an unknown environment produces meetings — start with GoSecure™.
- The organization wants the accountability transferred rather than strengthened. Risk ownership stays with the asset owner.
- The role is expected to endorse decisions already taken. Independent challenge that cannot change an outcome is theater.
- There is no executive sponsor willing to act on the governance decisions the role will surface.
Framework alignment
Two vocabularies, one position.
NIST CSF 2.0 is used as the governance language, because its structure maps cleanly onto how a board already thinks about oversight, accountability and improvement over time, and because the Govern function is precisely where most industrial programs are thinnest.
ISA/IEC 62443 is used as the engineering vocabulary. Zones, conduits, security levels and capability requirements are what your engineers, integrators and OEMs already share, and a governance decision that cannot be expressed in that vocabulary will not survive contact with a plant.
Regulatory obligation is named only where it applies: NERC CIP where you are a registered entity, NIS2 where the European obligation is real, Saudi NCA ECC and the national OT requirements where you operate under them. Mapping is scoped to what actually governs you. Reporting against regimes that do not apply dilutes the position rather than strengthening it.
Outcomes
What is different in the organization afterwards.
Named accountability
Decision rights documented and accepted, so it is clear before an incident who approves a change, who declares, who may contain, and who holds stop authority.
A board that can govern the risk
Reporting in operational and business terms, consistent quarter to quarter, so directors can direct rather than receive a technical briefing they cannot act on.
A program that survives budget season
A sequence with reasoning attached, defensible against competing capital priorities and durable enough that it does not restart each time the organization changes shape.
A stronger internal leader
The person who owns the risk holds it with more industrial context and more confidence than before. The engagement is designed to make itself smaller over time.
Deliverables
What you receive, in writing.
Cadence and intensity are agreed at the outset. These four are present in every advisory engagement.
Executive risk narrative and reporting pack
Cyber-physical risk stated in operational and business terms, with the small set of measures leadership will actually track, the decisions required of them, and a structure that repeats reliably each cycle so movement is visible.
IT/OT governance and decision-rights charter
Accountability model across engineering, operations, IT and security: who decides what, who is consulted, what escalates and to whom, where enterprise standards apply and where a documented industrial exception applies instead.
Sequenced program and investment case
Multi-year sequence with dependencies, operational impact, ownership and the cost of delay per item, written to be taken into a capital discussion without translation and tendered without rewriting.
Regulatory and audit position statement
What governs you, what evidence is expected, what exists today, what the gaps are, who owns closing each one, and the honest answer to give when an auditor asks about a gap that is still open.
Engagement process
Five steps, from orientation to a role you no longer need filled.
Intensity ranges from a standing advisory cadence alongside an existing leader to an interim mandate during a transition. It is agreed before commitment, and reviewed rather than assumed.
Orientation and mandate
What the role is being asked to do, who it reports to, what authority it carries and what it explicitly does not. Structured conversations with operations, engineering, IT, security, risk and leadership, on site where the operation is. A mandate agreed in writing is what separates an advisor from an observer.
Position assessment
Current governance, program status, regulatory obligation, vendor and contractual exposure, and the organizational position: where accountability sits today, where it is contested, and where two groups each believe the other holds it. Delivered as a position, not a maturity score.
Governance and operating-model design
Decision rights, forums, escalation and reporting designed with the people who will have to live inside them. Engineering and IT both contribute and both give something up. A model agreed in a room with neither group present will not be followed.
Operating cadence
The role runs: board and executive reporting cycles, steering forums, program sequencing decisions, vendor and contract reviews, regulatory preparation, and direct support to the internal owner between those points. This is where most of the engagement's value is realized.
Transfer and step-back
Governance documented, reporting repeatable by your own team, the internal owner carrying more of the role each cycle, and intensity deliberately reduced. Success is measured by how little of the role still needs to be held externally.
Questions we are actually asked
The questions a CISO and a plant manager each ask, separately.
Is this going to undermine our existing CISO?
It should not, and in most engagements the CISO is the person who asked for it. The role being filled is industrial context and the standing to arbitrate between engineering, IT and the business, alongside an accountable leader rather than over one. Reporting lines and the limits of the mandate are agreed in writing at the outset for exactly this reason.
Where it does become a problem is when an organization wants accountability transferred rather than strengthened. Risk ownership stays with the asset owner. If the intention is to move it to a supplier, this is the wrong engagement and no contract wording would make it the right one.
How many days a month is this, really?
It ranges from a standing cadence built around a reporting cycle and a steering forum, to an interim mandate during a transition or a major program. Intensity is agreed before commitment and reviewed at each cycle rather than assumed to continue at the level it started.
The engagement is designed to get smaller. If the same intensity is still required in year three, either the transfer is not working or the organization has a resourcing problem that an advisory arrangement is quietly masking. Both are worth naming rather than renewing around.
You are going to tell us to buy things.
There is no resale margin, no referral fee and no product line behind any recommendation. Frequently the advice redirects planned spend rather than adding to it, because sequence and configuration turn out to matter more than additional capability.
The structural safeguard matters more than the statement. Advisory is scoped and staffed separately from delivery, so the person advising on a priority is never the person whose utilization depends on that priority being funded. Where an engagement needs both, you contract them separately and you can put the delivery work out to someone else entirely.
Our engineering team will not accept an outsider setting security rules.
They are right not to, and a governance model designed without them will not be followed regardless of who signs it. Decision rights are designed in a room with engineering, operations, IT and security present, and both sides give something up. That is what makes the result durable.
The role arbitrates between positions; it does not impose one. Where engineering has a well-founded operational objection to an enterprise standard, the output is a documented industrial exception with a named signer, not a quiet deviation that nobody has accepted in writing.
What if your advice conflicts with our corporate security standard?
Sometimes it will, and the conflict is usually real rather than a misunderstanding. An enterprise patching cadence, an agent deployment requirement or an automated containment policy can each be correct on the corporate estate and consequential on a process network.
The answer is never to ignore the standard on site. It is to raise the exception formally, state the operational reasoning, define the compensating control, and have it accepted by whoever owns the standard. Undocumented deviation is how organizations discover during an audit that half the estate has been out of policy for years.
We need this kept confidential, including from our own board for now.
Confidentiality around a working position is normal and we work inside it. Early findings, contested judgments and draft governance positions are not board material, and forcing them upward before they are settled produces worse decisions rather than better ones.
There is a boundary. We will not help construct a position for a board, a regulator, an insurer or an auditor that misstates something we know to be the case. If a gap is open, the reporting says it is open and says who owns closing it. An advisory role that can be directed to produce a favorable answer is worth nothing to the person relying on it.
Next step
Start with one reporting cycle.
A single board or executive cycle is enough to establish whether the role adds something your organization does not already have. It produces a reporting position you keep either way, and it commits nothing beyond the cycle.
- Senior-led — leadership that has worked on the operator side, the OEM side and the service side
- Vendor and platform independent — no resale, no referral fees, no product to defend
- Accountability stays with you — the role strengthens ownership, it does not assume it
- IT and OT treated as partners — enterprise governance and engineering context are both required, and neither absorbs the other
Questions buyers ask
The three things we are asked before we start.
What is a fractional OT CISO?
A senior OT cybersecurity leader who carries the leadership role part-time — setting strategy, owning the program, governing risk, answering to the board and the regulator, and directing internal teams and vendors — without the organization having to hire a full-time executive it may not yet need or be able to recruit.
Why would an organization use OT CISO Advisory rather than hire?
Because the role is hard to fill and expensive to fill badly. Industrial organizations often need the judgement immediately and the headcount later. InnovAKT's OT CISO Advisory supplies the judgement now, builds the function while it is in place, and is designed to hand over to a permanent hire rather than to become permanent itself.
What does an OT CISO Advisory engagement actually cover?
Strategy and roadmap, governance and policy, risk reporting to executives and the board, program and vendor direction, regulatory and audit response, incident readiness and escalation authority, and the development of the internal people who will eventually hold the role.