After the Master Plan is accepted, work begins on Program Implementation.

Implementation of the Cybersecurity Program is summarized in the white boxes below:

• Set up Cybersecurity Program Implementation Projects (Note several projects involving equipment and software are typical).
• Set up Corporate Organization, Training Program, KPIs, Program Audit, and Plan Renewal.
• Set up Site Organization, Operating Procedures and Training Program (Note: Implementation details may differ at each Plant).

Example "Deliverables" from the Cybersecurity Master Plan are shown in the light blue box above.

Once these Deliverables have been established by the Cybersecurity Master Plan, they are used by all subsequent projects and operations at Corporate or Plant Levels. This useful for the Implementation projects, and for all Corporate or Plant Site Projects going forward. Use of agreed Policies, Practices, Design Standards, etc., will reduce procurement costs, and project time delays. It should also improve maintainability and facilitate troubleshooting.

More details are provided in the final chapter of "Master Planning Guide for Cybersecurity Program for Owner/Operators in a Process Industry (PDF 1.8 MB).

Cybersecurity Program Implementation Projects

A key deliverable of the Cybersecurity Program is a set of Cybersecurity Program Implementation Projects that are undertaken immediately after approval of the Cybersecurity Program. These projects are defined, justified and budgeted as part of the Cybersecurity Master Plan.

Some typical Plant Implementation Projects are listed below:

• Industrial Network Design for Process Plants
• Secure Interfacing of IT and IACS Networks
• Secure Configuration and Programming of IACS
• Cybersecure Plant Operating Procedures
• Cybersecure Maintenance Procedures
• Cybersecure H/R Procedures.(future)
• Cybersecurity Training for Plant Personnel.(future)

Note that Implementation Projects will typcially contain multiple Opportunites that are combined into a single project. This is done because they share certain Human, System or Facility aspects that mean they are best accomplished together. Thus, Cybersecurity for Plant Personnel might include Control Technicians, a different program for office staff, IT Personnel, H/R personnel, and a LIMS (Learning Management System) to deliver and manage the appropriate SCORM modules.