Cyber PHA Explained: How a Cyber Process Hazard Analysis Works
What a Cyber PHA is, how it builds on HAZOP and LOPA, how it maps to ISA/IEC 62443-3-2, the steps in a typical study, and what you should have in hand when it ends.
Every process plant has a HAZOP on file. It lists what can go wrong, how bad it could get, and which safeguards stop it: the alarm, the interlock, the safety instrumented function, the relief valve. For decades that study assumed one thing it never wrote down. It assumed the safeguards would work as designed, and that nobody would change them on purpose.
Connected control systems broke that assumption. A trip setpoint can be changed from an engineering workstation. A safety function can be bypassed in software. An alarm can be suppressed. If an attacker reaches the right system, the initiating event and the safeguards meant to stop it can fail together. A Cyber PHA is how plants find out where that could happen, and what to do about it.
What Is a Cyber PHA?
A Cyber PHA, or cyber process hazard analysis, is a structured, workshop-based risk assessment that links process safety and cybersecurity. It takes the hazard scenarios your process safety studies already identified and asks which of them could be caused, or made worse, by a cyber attack. It then ranks those scenarios by consequence and likelihood and sets the cyber safeguards each one needs.
The method borrows its format from process safety on purpose. Operators, engineers, and safety specialists already know how a HAZOP runs, so a Cyber PHA uses the same facilitator, scribe, worksheet, and risk matrix. The difference is the question being asked: not only “what if this valve fails?” but “what if someone makes this valve fail?”
Why Process Plants Run One
A traditional cyber risk assessment ranks risk by data and downtime. That misses what matters most in a plant: fires, toxic releases, equipment damage, and harm to people. A Cyber PHA ranks cyber risk by the same consequences your safety team already uses, so the results speak the language of operations and the board.
It also finds the scenarios that matter most. ISA guidance describes the key test as finding hazard scenarios where the initiating event and every control barrier are “hackable”. Where the worst outcome could be a fatality, the recommended answer is to add at least one barrier a cyber attack cannot defeat, such as a mechanical relief valve or a non-programmable trip, or to protect the programmable ones very strongly.
How It Fits With HAZOP, LOPA, and ISA/IEC 62443
| Reference | What it brings to a Cyber PHA |
|---|---|
| HAZOP and other PHAs | The hazard scenarios, consequences, and safeguards the study starts from |
| LOPA | The independent protection layers, and which of them are programmable |
| ISA/IEC 62443-3-2 | The method for dividing systems into zones and conduits and setting a target security level for each |
| ISA/IEC 62443-3-3 | The system security requirements that meet each security level |
| ISA TR84.00.09 | Guidance on building cybersecurity into the safety lifecycle for safety controls, alarms, and interlocks; revised in 2024 |
ISA/IEC 62443-3-2 calls for an initial risk assessment, partitioning into zones and conduits, and a detailed risk assessment where initial risk is too high. A Cyber PHA is a common way to carry out those risk assessment steps in a process plant.
The Steps in a Typical Cyber PHA
- 01Define the system under considerationAgree which control systems, sites, and networks are in scope, and gather the architecture drawings and asset lists.
- 02Collect the safety studiesPull the HAZOP, LOPA, and safety requirement records, so the worst credible consequences are already known.
- 03Divide systems into zones and conduitsGroup assets that share security needs, and list every connection between groups, including vendor and remote access.
- 04Build cyber threat scenariosFor each zone, ask how a threat could use a vulnerability to cause a hazard scenario or defeat a safeguard.
- 05Score consequence and likelihoodUse your existing risk matrix for consequence. Judge likelihood from threats, known vulnerabilities, and the countermeasures in place.
- 06Compare with tolerable riskWhere risk is too high, record extra countermeasures and the target security level the zone needs.
- 07Document and approveConsolidate the worksheet into requirements, assumptions, and actions, and have the asset owner sign them off.
A Cyber PHA tells you which scenarios matter. An OT assessment tells you whether the controls protecting them actually work.
See our OT cybersecurity assessmentWho Should Be in the Room
A Cyber PHA works only with the right mix of people. You need a trained facilitator and a scribe, plus operations, process and control engineering, process safety, IT and OT security, and often the control system vendor. Each brings something the others lack: safety knows the consequences, engineering knows how the system can be changed, and security knows how attackers get in.
What You Should Have at the End
- A worksheet of cyber threat scenarios, each with consequence, likelihood, and risk score
- A zone and conduit model with a target security level for each zone
- A list of scenarios where every safeguard could be defeated by a cyber attack
- Recommended countermeasures, ranked by the risk they reduce
- Cybersecurity requirements that feed design, procurement, and maintenance
When to Run or Repeat One
Run a Cyber PHA for new projects at the design stage, when changes are cheapest, and for existing plants as a follow-on to a HAZOP. Repeat it when the control system or safety system changes, when new remote access is added, after a significant incident, or when the threat picture shifts. Many operators tie it to the same revalidation cycle as their process hazard analysis.
Where Cyber PHAs Go Wrong
The most common mistake is running it as an IT exercise, without process safety in the room. The result ranks risks by data loss and misses the scenarios that could hurt people. The second is treating the worksheet as the end. A Cyber PHA assumes your countermeasures are in place and working; if nobody checks, the risk scores rest on guesses. That is where an OT cybersecurity assessment and careful penetration testing come in.
Check that the safeguards your Cyber PHA relies on really hold.
Accredify Global assesses OT environments against ISA/IEC 62443 and NIST SP 800-82, with passive-first testing agreed with your engineers. Your process safety team keeps ownership of the safety studies.
Book your free scoping review →Frequently Asked Questions
What does Cyber PHA stand for?
Cyber PHA stands for cyber process hazard analysis, sometimes written CyberPHA or cyber HAZOP. It applies the workshop format of process hazard analysis to cyber threats against industrial control and safety systems.
How is a Cyber PHA different from a HAZOP?
A HAZOP looks for deviations from design intent and assumes safeguards work as designed. A Cyber PHA starts from the HAZOP's scenarios and asks which ones a cyber attack could cause, or which safeguards an attacker could defeat, then scores those cyber risks.
Is a Cyber PHA required by IEC 62443?
ISA/IEC 62443-3-2 requires a security risk assessment of zones and conduits, not a Cyber PHA by name. A Cyber PHA is a widely used way to carry out that risk assessment in process industries, because it reuses existing safety studies.
Who should facilitate a Cyber PHA?
A facilitator trained in both process hazard analysis and OT cybersecurity, supported by a scribe. The team should include operations, control engineering, process safety, IT and OT security, and often the control system vendor.
How long does a Cyber PHA take?
It depends on the number of zones and scenarios. A single unit may take a few days of workshops; a large site with many control systems can take several weeks, plus preparation and reporting.
What is a target security level?
Under ISA/IEC 62443-3-2, each zone and conduit gets a target security level from SL 1 to SL 4, set by the risk the Cyber PHA or other risk assessment finds. The system is then designed to meet that level using the requirements in ISA/IEC 62443-3-3.
How often should a Cyber PHA be updated?
Whenever the control or safety system changes significantly, when new remote access is added, after a major incident, or when threats change. Many operators review it on the same cycle as their process hazard analysis revalidation.
Does a Cyber PHA replace an OT security assessment or penetration test?
No. A Cyber PHA estimates risk on the assumption that listed countermeasures exist and work. An OT security assessment and controlled penetration testing check whether they really do.
Sources: ISA InTech: cyber-related process hazard analysis · ISA TR84.00.09-2024 · ISA/IEC 62443-3-2 contents · NIST SP 800-82r3