Why Cyber-Physical Is a Category — Not an Overlap
Consequence coupling. A cyber event can produce a physical consequence (a tripped SIS, a denied refrigeration loop, a failed emergency egress). A physical event can produce a cyber consequence (a stolen laptop in a secure hall, a tailgated maintenance contractor planting an implant on an engineering workstation). Single-domain controls do not detect, prevent, or recover from coupled failures.
Detection blind spots. The physical-security SOC watches badge anomalies and camera events. The IT SOC watches network and endpoint telemetry. The OT SOC — where one exists — watches ICS traffic. A lateral movement that crosses all three domains is invisible to each of them in isolation. The correlation is where the attack lives.
Regulatory convergence. NIS2 covers operational-resilience measures across physical, OT, and IT. EU CRA covers products with digital elements that include physical-security components. EN 50600-2-5 requires physical security to be engineered alongside cyber. The standards are converging faster than most organisational charts are.
Cyber-Physical Risk Assessment
- Integrated threat modelling across OT, IT, and physical domains — single threat library, single likelihood-consequence calibration, single risk register
- IEC 62443-3-2 risk assessment extended to include physical attack vectors, insider threat, contractor and vendor access, supply-chain compromise, and environmental conditions
- Consequence-class categorisation: what events can produce life-safety, regulatory, financial, reputational, or continuity impact, and through which cross-domain pathways
- Facility-wide attack-path analysis: from external perimeter through to safety-instrumented systems, through to GPU fabric, through to tenant-facing services
- Site-specific threat intelligence: the realistic adversary profile for this asset, this jurisdiction, this tenant mix — not a generic ransomware scenario
- Risk-register output that a board, an insurer, and a regulator can all act on — in the same document
Cyber-Physical Architecture Review
- Physical-security architecture integration with OT: badge, biometric, and access-control systems treated as cyber-physical endpoints rather than as isolated building services
- Video-management and CCTV architecture: network segmentation, firmware integrity, analytics-platform exposure, and forensic-evidence chain-of-custody
- Access-control system architecture: credential lifecycle, revocation latency, PACS-to-IT identity federation, and the critical question of who holds override authority and under which conditions
- Environmental and life-safety system integration: fire-suppression, gas detection, flood detection, and their cyber-physical interlocks with controls
- Perimeter-to-rack attack-surface review: the full physical kill-chain, tested in sequence
- Third-party and contractor access architecture — often the highest-probability cyber-physical attack path on a live facility
- Secure remote-access for physical security systems treated with the same rigour as OT remote access