HSE inspectors on moving from OG86 to ISA/IEC 62443
What happened
On 9 October 2025, two of the UK Health and Safety Executive's (HSE) HM Principal Specialist Inspectors, Peter Evans and Chris Buttrick of HSE's Chemical, Explosives and Microbiological Hazards Division, gave the HSE keynote at the IET's Cyber Security for Critical Industries Conference at IET London: Savoy Place. The session was titled "Moving from OG86 to ISA/IEC 62443 - A change in regulatory benchmark". A 39-minute recording was published on IET.tv the next day.
OG86 is HSE's operational guidance Cyber Security for Industrial Automation and Control Systems (IACS), published in March 2017. HSE describes operational guidance as aimed primarily at its inspectors, setting out the standards expected so that regulation is consistent, and makes OG86 freely available to operators of sites under the Control of Major Accident Hazards (COMAH) Regulations. HSE trialled it in a series of inspections between November 2017 and May 2018. HSE's cyber security page, last updated on 29 June 2026, still presents OG86 and does not announce a change of benchmark.
Why it matters
OG86 is the guidance written for HSE's inspectors on cyber security at COMAH sites, so a change of benchmark would change the standard inspectors expect. HSE's page lists the systems it means, including control systems such as distributed control systems, programmable logic controllers and supervisory control and data acquisition (SCADA) systems; safety instrumented systems (SIS), from simple logic systems to programmable safety controllers; plant information systems; the networks that connect them; and their connections to corporate networks. HSE says these systems are commonly software-based and may therefore be vulnerable to cyber threats, which could ultimately increase the risk of a major accident.
For functional safety engineers, the link already exists in the process sector standard. IEC 61511-1:2016, clause 8.2.4, requires a security risk assessment to identify the security vulnerabilities of the SIS. Its required outputs include the devices covered, the threats that could exploit vulnerabilities, the potential consequences and their likelihood, any requirements for additional risk reduction, and the measures taken. A note to the clause gives IEC 62443-2-1:2010, on establishing a security programme for industrial automation and control systems, as one source of guidance. HSE's page lists BS EN 61511 (Edition 2) among its technical standards.
The title of a keynote by HSE's own specialist inspectors is a strong signal of where inspection is heading, but it is not a change of guidance. Until HSE publishes one, OG86 remains the guidance HSE's page presents, and duty holders should be cautious of any firm date for a switch that HSE has not published itself.
For sites with a safety instrumented system, the preparation overlaps with work that is already required. The security risk assessment that IEC 61511-1 requires points to IEC 62443 for guidance, so building that assessment on IEC 62443 now is sensible preparation, whichever benchmark inspectors use next. The places to watch for the formal change are HSE's cyber security page and the COMAH Competent Authority's operational delivery guides.