Security PHA Review for Consequence-Based Cybersecurity (International Society of Automation)

Security PHA Review for Consequence-Based Cybersecurity presents a practical, process-centric method that uses existing process hazard analysis (PHA) outputs, such as hazard and operability (HAZOP) studies, to determine appropriate cybersecurity requirements for industrial process plants. The objective of the security PHA review (SPR) is to identify process hazard scenarios that could be caused by malicious cyber actions and then either recommend non‑hackable safeguards to remove the cyber vector or assign an appropriate ISA/IEC 62443 security level (SL) to guide cybersecurity design and implementation. This approach emphasizes assessing initiating events, reviewing all safeguards (both cyber and non‑cyber) and evaluating consequences in the context of an organization's risk tolerance criteria.

This book explains how SLs apply to security zones and how conduits inherit the highest SL among connected zones and situates SPR within the ISA/IEC 62443 lifecycle. It emphasizes a process‑hazard perspective rather than equipment‑only vulnerability listings, describes practical documentation methods (highlighter annotations, dedicated SPR reports or PHA‑software integration) and highlights common non‑hackable safeguards (such as mechanical relief devices, buckling pins, motor overload relays and external current monitors) that can reduce required SLs when feasible.

Written so that process engineers, control systems professionals, IT professionals and cybersecurity specialists can learn to integrate IT security with process-safety practices without unnecessary duplication of effort. It provides practical, implementable methods, centered on the SPR approach, to identify cyber-enabled process hazards and to assess and reduce risk in real industrial settings.

Edward M. Marszal, Professional Engineer (PE) and ISA84 Safety Instrumented Systems Expert, is the president and chief executive officer of Kenexis. Kenexis is an engineering consultancy dedicated to assisting process industry customers with assessing the risks that are posed by their plant operations and then reducing those risks to a tolerable level by the specification of instrumented safeguards, such as safety instrumented systems (SISs), fire and gas systems (FGSs), critical alarm systems, and cybersecurity. Marszal is a longtime practitioner and pioneer of the techniques and tools associated with technical safety and the performance-based design and implementation of instrumented safeguards.
Marszal started his career after receiving a BA in chemical engineering, with an emphasis on process controls and artificial intelligence, from The Ohio State University. After graduating, Marszal took a position with UOP in Des Plaines, Illinois where he worked as an instrumentation and control field advisor, performing functional safety assessments of control systems and safety instrumented systems at customer sites worldwide. At UOP, he designed and managed the development of custom control systems and SIS projects.

James McGlone is the chief marketing officer of Kenexis. McGlone has more than 30 years of experience in the development and deployment of many of the embedded control systems used in industrial automation, building automation, Internet of Things (IoT), and cybersecurity.
McGlone started his career in the US Navy as an electronics technician and nuclear reactor operator on fast attack submarines. McGlone was on the pre-commissioning crew of two submarines during construction and shakedown, eventually taking the boats to sea as operational platforms. While in the Navy, McGlone acquired computers and began programming in various languages including BASIC, COBOL, and FORTRAN. After 9 years of maintaining and operating nuclear power plants in submarines, McGlone decided to pursue a civilian career as a technical specialist for a Rockwell Automation (Allen-Bradley) distributor in Akron, Ohio where he solved challenging applications for drives and motion control systems and learned to program programmable logic controllers (PLCs).