Cybersecurity in the Oil and Gas Industry: Securing the OT Environment

In spring 2023, Automation.com collaborated with Fortinet to assess the cybersecurity efforts, priorities, and overall preparedness of companies in the petrochemical industry. Automation and information technology (IT) professionals working for and with upstream, midstream, and downstream oil and gas operations were encouraged to share their views on protecting operational technology (OT) systems and their companies’ cybersecurity activities in specific areas.

Surveys were sent to active names on lists from Automation.com, the ISA Chemical and Petroleum Industries Division (ChemPID), and ISA oil and gas regionally focused sections. We received 207 responses and a survey completion rate of 67%. Respondents who were not in the oil and gas industry or did not have knowledge of their company’s cybersecurity activities were filtered out, leaving 62 highly qualified respondents.

The results show an industry roughly split. About half of companies are well on their way to what might be called a mature cybersecurity stance. They have completed most of the steps and subtasks associated with protecting their OT environments and have systems in place to monitor progress and continuously make adjustments. The other half of respondents seem to be just getting started, having a range of plans and good intentions but few concrete implementations of protective tools and procedures.

Both groups can benefit from the results of this survey by comparing where they are relative to their peers and seeing what they may need to focus on next.