In pursuit of excellence in its digital transformation, Engro faced the challenge of securing its OT-IT convergence where the potential interconnection of isolated plant systems with the outside world poses vulnerability to cyberattacks capable of disrupting production. Engro institutionalized cyber governance by adopting global frameworks such as IEC62443, ISO27001 and NIST; conducted comprehensive consultant-led risk assessments of infrastructure; developed a three-tier strategy to improve cyber resilience; and cascaded these in the enterprise risk register for board-level visibility. Further, it reinforced the “Human Firewall” concept into the organizational culture by frequent cyber awareness campaigns and phishing simulations, and partnered with ISA (International Society for Automation) for human skill development. 

Active engagement from the shop floor to top management led to the development of comprehensive OT security policies to integrate cyber resilience in the organization’s DNA, promising “security-by-design” in the production life cycle. Ongoing integration of its IT and OT security operation centres will further enhance threat detection, investigation and incident response. By implementing these measures, Engro has embarked on the journey of creating a secure digital environment for its people, process and products to boost the confidence of stakeholders to launch and further transform their business services while maintaining cyber resilience.