Green hydrogen produced with electricity from renewable sources could slash carbon emissions by several million tonnes per year in Germany alone. Beyond its application in the steel and chemical industries, the energy carrier can also be used for energy storage and in fuel-cell drive systems in the transport sector. Given this, the German Federal Ministries for Economic Affairs and for Digital and Transport have invested a total of over 8 billion euros since mid-2021, funding around 60 large-scale hydrogen projects from hydrogen production to transport and industrial use.¹

Using available infrastructure

With a service life of up to 100 years, pipelines and storage caverns are particularly ecological and economical solutions for gas transport and storage. In addition to roughly 500 000 km of pipelines transporting gas throughout Germany, there are 40 000 km of pipelines for cross-regional and cross-border transport. With diameters of up to 1.4 m and service pressures of up to 100 bar, the pipes are generally also suitable for transporting hydrogen. This is supported by historical fact; up to the mid-20th century, “city gas” contained up to 50 % of hydrogen. Using the existing infrastructure would further increase the sustainability of the transition to hydrogen as an energy carrier.

However, for this approach to be successful, various types of steel must be tested for their resistance to hydrogen, taking into account the current state of the art in this field and appropriately adjusted safety and maintenance strategies.

Hydrogen embrittlement

High-strength steels involve the risk of hydrogen-induced cracking. Minimal flaws in the structure of the material, inclusions, impurities, or cyclic mechanical stresses may cause the protective oxide layers of the metal to corrode, enabling hydrogen atoms to diffuse into the material and accumulate at flaws in the steel’s crystalline lattice structure. Because pipelines in particular, are exposed to pressure fluctuations, permanent avoidance or exclusion of damage in the passive oxide layers is impossible. Fluctuations in the internal operating pressure of a pipeline are due to various factors including injection and withdrawal processes.

Hydrogen deposition reduces the material’s plastic deformation capability and thereby its ductility, resulting in embrittlement and causing microscopic cracks. Continued accumulation of hydrogen atoms at the crack tips and cyclic loading cause these cracks to propagate. The extent of hydrogen embrittlement depends on the grade and structure of the steel and its type of production. Higher strength values and rougher surfaces increase the risk of hydrogen deposition.

Clarifying how H2 influences the material

In the USA, most steel types listed in accordance with the ASME Code have been analysed; in other words, their parameters (material characteristics in a hydrogen atmosphere) are known. However, where some steel types are concerned, fracture (crack) resistance and fatigue crack growth in a hydrogen atmosphere have yet to be determined or may be subject to changes caused by certain alloy elements or heat treatment processes.

For European materials in particular, experts must first determine how hydrogen will impact the relevant parameters before they can complete fracture-mechanics analysis. DVGW, a German recognised standardisation body for the gas and water industry, has launched a research project on this topic. TÜV SÜD is represented on the relevant committees and engages proactively in discussion and development of the pertinent safety concepts, which will be published shortly: DVGW Technical Rule – Code of

Practice G4643 (M) “Fracture-Mechanical Assessment Concept for Steel Pipelines with a Design Pressure of more than 16 bar for the Transport of Hydrogen” is scheduled for publication in March 2023.

Normative basis

All gas pipelines – irrespective of whether they transport natural gas, pure hydrogen or a mixture of the two – fall under the German Energy Management Act (EnGW). Under the German Regulation on High-Pressure Gas Lines (GasHDrLtgV), conversion of existing natural gas lines to hydrogen transport represents a major change and must be reported. The pipeline operator must prove that the conversion was completed expertly, professionally and in accordance with the state of the art. The technical requirements are described in DVGW Technical Rule – Standard G463 and/or DVGW Technical Rule – Code of Practice G409.

Benefiting from third-party expertise Acting on behalf of pipeline operators, TÜV SÜD is currently reviewing the conversion of existing natural gas pipelines to hydrogen. In their review, the experts consider all factors influencing service life as well as all documents on planning, construction and operation. The experts also point out measures that are suitable for determining, evaluating or upgrading the condition of pipeline infrastructure. By providing support in the form of safety strategies and fracture-mechanics analyses, TÜV SÜD is helping to achieve safe, secure and carbon-neutral energy management.

Dr. Johanna Steinbock, Expert Fracture Mechanics Analysis, TÜV SÜD Industrie Service
Jan Sachse, Head of Department Plant Safety, TÜV SÜD Industrie Service
Dr. Albert Großmann, Expert High-Pressure Pipelines, TÜV SÜD Industrie Service

Soft-starting motors reduce utility-demand charges

Soft starters typically ramp up the voltage applied to a motor over a few seconds at start-up, reducing winding heating and starting current. This may extend the life of the winding for motors that start frequently, but it doesn’t affect utility demand charges. That’s because the electric meter averages the kilowatts consumed over each 15 – 30-minute period, not just for the few seconds that the soft starter reduces input power to the motor.

Higher current means a motor is less efficient

Input power is not a function of current alone. Other factors are voltage, power factor and efficiency. As an example, Table 1 shows the key data for two 460-volt motors of the same 75 hp (55 kW) rating.

Table 1. Example of motor current versus efficiency.

Note that Motors A and B have the same full-load efficiency despite a difference of more than 3 amps in their ratings. If you want to fact-check this, use the formula in Figure 1.

Power factor correction capacitors can reduce the energy consumption of a motor

Applying power factor capacitors at the motor terminals increases the power factor on the supply cables but does not change the motor’s power factor. Increasing the power factor on the supply lines reduces current in them, causing a corresponding but typically insignificant reduction in I²R losses (energy) in the supply wiring. The primary reason for reducing supply circuit current is to add electrical loads without rewiring a facility.

A motor can be loaded up to its service factor current

An example of this would be loading a 1.15 service factor motor up to its service factor current (typically ~1.15 × rated current). That would be a problem, according to clause 14.37.1 of NEMA Stds. MG 1-2016: Motors and Generators (MG 1): “A motor operating continuously at any service factor greater than 1 will have a reduced life expectancy compared to operating at its rated nameplate horsepower. Insulation life and bearing life are reduced by the service factor load.”
Further, the service factor only applies to Usual Service Conditions (MG 1, 14.2). These include operation at an ambient temperature of 5°F to 104°F (-15°C to 40°C) and at an altitude of less than 3300 feet (1000 meters) when rigidly mounted in areas or supplementary enclosures that do not seriously interfere with the machine’s ventilation.

A 230-volt motor can be used on a 208-volt electrical system

Per MG 1, 12.45, motors can operate successfully at ±10 percent of their rated voltage. Since 10 percent below 230 volts is
207 volts, a 230-volt motor would appear to be acceptable for use on a 208-volt system. But ANSI Std. C84.1 permits service entrance voltage for 208-volt power systems to be as low as 191 volts. Since there will be additional voltage drop in the building wiring, the voltage supplied to the motor could be less than 191 volts–well below the 207-volt minimum required for the 230-volt motor.

If the motor has a nameplate rating of 208-230 volts, ask the manufacturer for a suitable voltage range. Said another way, ask if the manufacturer’s warranty will apply if the motor is used anywhere between 187 volts (208 volts minus 10 percent) and 253 volts (230 volts plus 10 percent).

Oversized motors, especially motors operating below 60% of rated load, are not efficient and should be replaced with appropriately sized premium efficiency (IE3) motors

On the contrary, matching motor horsepower (kW) rating to the load will usually mean a slightly lower efficiency at that load than using the next larger size motor. The reason is that motors tend to peak in efficiency between 75-80 percent load. Motors that drive, supply or return air fans in heating, ventilation and air-conditioning (HVAC) systems generally operate at 70 to 75 percent of rated load, making them candidates for use with oversized motors.

Further, even at 60 percent of rated load (which more than one industrial motor study found to be the average load level), the next higher power rating motor could be more efficient at that load than the appropriately sized power rating. Some high-inertia loads also require more HP/kW to start than to run the load. Reducing the HP/kW to match the running load could result in the motor being unable to start the load.

It doesn’t matter which of the three line-to-line voltages in a three-phase system you measure to see if a motor is supplied with the proper voltage

It does matter. Voltage unbalance negatively affects three-phase motors. Even modest differences among the three line-to-line voltage levels can increase motor heating considerably. Voltage unbalance is expressed as a percent and determined by the formula in Figure 2.

It’s always best to check sources and verify facts before accepting consequential statements as true.

The formula for percent additional temperature rise in a motor winding due to unbalanced supply voltages is 2 × (% voltage unbalance)2, so a mere 3.5 percent unbalance would cause a substantial increase: 2 × 3.52 = 24.5%. For many motors, that would be an additional temperature rise of about 36°F (20°C).

According to a well-accepted guideline, motor winding life decreases by half for each 18°F (10°C) increase in temperature. Thus the 36°F (20°C) additional temperature rise due to a 3.5 percent voltage unbalance can cut a motor’s insulation life to about a quarter of what it should be.

Hand contact on a motor surface is a reliable way to judge operating temperature

Never check a motor’s surface temperature by hand! Modern motors can have surface temperatures near or above the boiling point of water during normal operation. Appropriate devices for measuring these temperatures include thermometers or pyrometers, thermocouples and thermal imagers.

Note that MG 1 sets specific limits for internal winding temperatures but not for motor surfaces. Where it does address parts other than windings (e.g., clause 12.43), it says the temperature of such parts “shall not injure the insulation or the machine in any respect.” So, unless the motor surface temperature exceeds the winding’s rating or something on the surface is damaged or otherwise degraded, MG 1 would not consider it too hot.

Winding burnout is the most common cause of motor failure

Although a winding failure usually results in a more costly repair and longer downtime, bearing failure is the most common cause of motor failure (see Table 2).

Table 2. Summary of motor failure surveys for motors rated up to 4 kV.

Click Image to Enlarge

Survey references
1. P.F. Albrecht, J.C. Appiarius, and D.K. Sharma, “Assessment of reliability of motors in utility applications – Updated.” IEEE Transactions on Energy Conversion, vol. EC-1, no. 1, pp. 39-46, March 1986.
2. O.V. Thorsen and M. Dalva, “Failure Identification and Analysis for High-Voltage Induction Motors in the Petrochemical Industry,” IEEE Transactions on Industry Applications, vol. 35, no. 4, pp. 810-818, July/Aug. 1999.
3. Monitoring und Diagnose elektrischer Maschinen und Antriebe, Allianz Schadensstatistik an HS Motoren 1996-1999 in VDE Workshop, 2001.
4. O.V. Thorsen and M. Dalva, “A survey of faults on induction motors in offshore oil industry, petrochemical industry, gas terminals and oil refineries,” PCIC, 1994. Record of Conference Papers, IEEE IAS 41st Annual, Vancouver, BC, 1994, pp. 1-9.

Adapted from EASA’s Root Cause Failure Analysis, 2nd ed., pp. 1-5.

Thomas H. Bishop,
P.E., senior technical support specialist at EASA

In his science-fiction novel Snow Crash, Neal Stephenson introduced the word “metaverse” in 1992. The novel describes a networked world, “Metaverse,” parallel to the real world. Meta means “transcendence,” and verse refers to “universe”. Later, Roblox, a sandbox game platform, became the first metaverse concept game. Since then, the concept and articles about the “metaverse” have appeared in many media reports, attracting the attention of people from all walks of life, even government departments, and creating the “meta-universe” phenomenon.

But the metaverse isn’t just a place for gamers and kids playing Roblox. That is why we keep hearing about serious companies establishing a presence and services there, including maintenance services. To some extent, companies make the jump just because they don’t want to miss out, even though the metaverse for industry and especially for maintenance is still in its infancy.

Indeed, the metaverse is only emerging and is years, even decades, from maturity. Even the naming conventions for this virtual world still need to be settled. We are not sure if we will have “the” metaverse, “a” metaverse, “many metaverses”, or a “multiverse” as a “pool of parallel metaverses”. However, even at this early stage, the value that can be obtained from the metaverse is close at hand. The buzz and hype may be exaggerated, but that doesn’t mean we can’t obtain value from the components and parts that go into it.

With the development of technology, the fantasies described in Snow Crash have gradually become more real, making it easier for people to cross the physical distance of the real world and connect, improving the immersive experience. In the metaverse, people perform their daily activities using avatars representing their “real” or imaginary selves. Simply stated, a virtual space becomes the real world for an alternative life with avatars or digital profiles participating in events, sometimes for private and sometimes for professional purposes – with possible economic implications.

Metaverse is still evolving, but its components are ready for use. These components include the technologies, tools, and systems these virtual worlds are built on and accessed through and the underlying concepts that support the new experiences. Some of these technologies have been around for some time, and the concepts are being applied in active metaverse platforms.

The immersive technologies

Realizing immersive experience requires hard and soft technologies, plus a pool of services. Two dominant technologies underlie the metaverse: augmented reality and virtual reality.

Augmented reality adds a digital graphic element to an existing, physical, real-world through the use of technologies such as glasses, lenses, or smartphones. In effect, it superimposes information on the natural environment. This technology has been especially popular in maintenance, where superimposed information for technicians has facilitated quicker repairs and increased the maintainability of assets. Lifelogging is a subclass of augmentation of the inner world where smart devices are used to record daily lives on the Internet. Examples of lifelogging are the social networks we use daily for professional or private reasons, such as Facebook, LinkedIn, or Instagram. Lifelogging is promising for maintenance, as machines connected in a machine-to-machine (M2M) environment are expected to deliver new services based on the social networking of assets in an unattended manner.

Virtual reality is a virtual online 3D reality, with avatars and communication tools simulating the inner world. The avatar can be personalized. Even though virtual reality’s cultural, physical, and social characteristics are different from reality, the avatar, like a real person, can communicate with other entities and achieve goals. Online video games are a well-known use of virtual reality. But virtual reality also applies to industrial settings. For example, in the virtual commissioning of new plants or assets, technicians can recreate the future shop floor, and correct or adapt as required, thus avoiding costly trial and error actions. A subclass of virtuality mirrors worlds that are virtualizations or simulations of the real world. The authentic appearance, information, and structure are transferred to a virtual space to carry out activities via the Internet or mobile applications. Well-known examples are Google Maps and Google Earth.

There is a lot of debate about whether AR or VR will dominate the market. The truth is that each has its unique value. Each enables users to experience and interact with the digital worlds that comprise the metaverse and the avatars that inhabit them.

Each offers adaptability for different maintenance scenarios since using specific gadgets on the shop floor is impossible. Sometimes it is possible to use a PC or mobile device. Still, the immersion and physical interaction offered by a head-mounted display and hand-tracking controllers are much more natural and engaging than those of a keyboard, mouse, or games controller. Moreover, a remote maintenance action may require an immersive experience rather than a standard inspection, and augmented information provided by a device might be enough. But it is the convergence of these technologies and concepts that is truly the game changer when it comes to leveraging the metaverse.

While current headsets can be hot and heavy, the technology is advancing rapidly, and a new generation of slimmer and lighter devices suggests the beginning of a more comfortable way to access the metaverse. VR and AR offer different experiences, with VR fully immersing users and AR layering digital items over the real world. Use cases that demand a fully immersive experience will benefit more from VR use, whereas others that depend on interacting with the natural world will necessitate AR. Neither is better than the other, and neither is “wrong.”

In summary, considering digital twins as a tool to monitor dynamic changes in systems is crucial for maintenance applications in the industrial metaverse. Metaverse solutions are essential for remote maintenance managers and workforce groups who can use digitally cloned models for testing, monitoring, intervention, and training. In this way, the metaverse will become a powerful platform for maintainers and beyond.

Its role in assisting virtual teams in gaining access to or control over digital clones is also being considered as a means of promoting new business models in the field of maintenance as a service; this includes remote troubleshooting and assistance, but it also includes innovative alterations in the digital clones based on ongoing failures, problems, and maintenance actions, thus promoting new product development and reliability growth.

Metaverse and maintenance actions

There are clear relations between the metaverse and the prevention and mitigation of failure. The metaverse can certainly be adopted for diagnostic and repair support with satisfying results. Maintenance 4.0 has already adopted and adapted various innovative technologies, such as IIoT, CPS, cloud, fog, Big data Analytics, machine learning, blockchain, and Industrial AI.

Immersive technologies are becoming increasingly important. The disruptions they bring to performing maintenance will include the ability to monitor and interact remotely with a large population of assets and educate those involved in maintenance activities. Digital innovations can be adopted as an alternative maintenance service model; indeed, the possibility of creating avatars allows consultations and personalized actions. In the metaverse, maintainers could “consult” in a 3D virtual workshop using remote services and devices, such as wearable sensors and smartphone applications, monitor the health status of assets, and once they have a “diagnosis”, perform maintenance intervention using haptic sensors and robotic actuators.

The potential for incorporating monitoring devices into asset health programs is enormous. Different devices can be adapted to remotely monitor asset health conditions, connecting real life with the virtual world. The health of a distant asset can be assessed by IoT sensors, plus a number of virtual sensors, with Industrial AI models within the system adding further physical and expert knowledge. The creation of soft sensors will increase health visibility and improve maintenance criteria. With this information, both real and virtually created, maintenance crews will evaluate asset performance and damage propagation, comparing, in real-time, their data with the data of other users worldwide. Through real-time monitoring, maintainers can be part of an online community, and being guided by experts worldwide increases the likelihood that they will attend maintenance good practices programs and adopt world-class decisions.

Moreover, these monitoring devices will allow assets to be fully present in the metaverse, 24/7. Importantly, monitoring health parameters around the clock will facilitate prompt prevention or intervention, helping service providers improve maintenance security. Along with monitoring, in the metaverse, a virtual and AI-based avatar or agent may provide personalized feedback and support, and, in this way, maintenance interventions could become more effective.

Finally, an avatar that can act as a “virtual doctor/nurse” may be able to directly monitor and interact with the asset, providing individualized care and treatment but also supervising and monitoring, in real time, the “patient’s” evolution after maintenance or repair actions. In this way, the metaverse can serve as a transitional stage before maintenance providers tackle real-world problems. In the metaverse, they can accompany assets into specific individualized environments, thus enhancing the efficacy of maintenance programs and actions. Beyond maintenance, however, virtual care models with group support programs could be a valid intervention in real-world health problems; in this context, remote virtual nursing care with robotic end-user delivery units could be helpful.

Prof. Diego Galar, Ramin Karim, and Uday Kumar from the University of Luleå, Sweden

References
Galar, D., Kumar, U., & Seneviratne, D. (2020). Robots, Drones, UAVs and UGVs for Operation and Maintenance. CRC Press.
Karim, R., Galar, D., & Kumar, U. (2021). AI Factory: Theories, Applications and Case Studies.
Galar, D., & Kumar, U. (2017). eMaintenance: Essential electronic tools for efficiency. Academic Press.
Galar, D., Daponte, P., & Kumar, U. (2019). Handbook of Industry 4.0 and SMART Systems. CRC Press.

How to Get Started

Success is dependent on organization and commitment. Without these two structural elements, your ultrasound lubrication program will find difficulty getting traction. A well-organized strategy and carefully planned execution will get the project started properly. Getting the commitment from all levels becomes much easier when a program can demonstrate structure and cohesion. Results will prove the program faster which will trigger easier access to funding to grow and sustain the program.

Start by asking “Why start an ultrasound lubrication program and what improvements do we expect?” There is no one easy answer to the question. Saving money is an obvious benefit that gets the attention of management, but it is not specific enough. How will an ultrasound lubrication program save money?

By reducing grease consumption;

• By raising awareness of the right types of grease to use;
• By making more effective use of lube tech’s time;
• By reducing unwanted machine breakdowns caused by lubrication failures;
• By extending bearing life expectancy.

A new beginning is the best opportunity to review what you have been doing previously. Identify what worked and improve or remove what did not. We will not go deeply into all aspects related to good lubrication practices. However, there are some basic and relevant points that should be noted.

Lubricant management program:

Keeping your bearings healthy requires a lubricant with the right quality for the application. By quality we refer not only to the quality of the grease manufacturer, but quality in a broader sense which involves all the processes from manufacturing to application. Some general recommendations are:

• Keeping high standards of housekeeping for storage, handling, and application to prevent contamination that degrades the quality of lubricants.

• Keeping a detailed list of products to use for each lubrication point. Selecting the right lubricant requires technical knowledge in several aspects. Using the wrong product will jeopardize the useful life of the component. Don’t change lubricants without solid reasons. Consider contracting a lubrication consultant to direct advice on this.

• Providing training in every aspect relevant to lubrication practices and product knowledge to those responsible for lubrication.

• Setting objectives to reach so you have a clear path to follow.

Application Guidelines:

Delivering the lubricant to the right point requires some type of device; usually a grease gun. There’s lots of different types but they all have one thing in common: they deliver grease with high pressure, enough to overcome the backpressure in the grease fitting.

Dirty grease and mixing grease types kills bearings. Therefore, it is necessary to extend the precautions for contamination and storage discussed above, to the application of lubricant through grease guns:

• Wherever possible, insist on using a dedicated grease gun for each grease type to avoid the risk of applying the wrong product through cross contamination. Label the grease gun with the associated grease to be used. LUBExpert manages multiple grease guns to prevent mixing of grease types.

• Standardize your grease guns so they all deliver the same quantity of grease per stroke.

• The same principle must be applied for your ultrasound device. If using SDT’s acoustic lubrication adaptor LUBESense1, assign a different one for each grease type. Grease remaining in the adaptor can mix with new grease causing a degrading chemical reaction.

• Always clean the grease fitting and grease gun before and after every application.

• Some bearings have drain plugs for purging old grease. If you open the drain, remember to clean the drain hole; it may be clogged. Use a clean brush like a bottle washing brush to clear the port.

• Apply grease slowly, one full stroke at a time (no more than 20% of the maximum designated quantity per injection) to avoid over greasing. This also avoids potential damage to the bearing as too much pressure can push the bearing cage into the roller elements.

• Always allow for churning time – the time required for freshly injected grease to work its way into the bearing.

Type of bearing inside:

Don’t assume that a grease fitting installed on a bearing housing means a path to grease the bearing. Sometimes, motors are fitted with both grease fittings AND sealed for life bearings. You must identify every grease point to be managed within the ultrasound program.

Identify the bearing inside to know its size for lubrication quantity, its particulars for defect diagnosis, and the type of grease typically used. Here are some helpful tips regarding the use of acoustic lubrication:

• Friction produces ultrasound. Bearing friction is produced by the contact between race, rolling elements and seals or shields.

• Less contacts means less friction. A ball bearing produces less friction than a same size roller bearing under the same lubrication conditions, speed and load.

• Plain bearings produce the lowest friction levels. Their ultrasound baseline often trends in the single digits or low teens.

Typically, they remain consistent for their lifespan and only display sudden upward trend lines when the oil film becomes contaminated or the bearing is near failure.

Benefits of Ultrasound

Ultrasound performs well at sensing and measuring changing in friction levels. It’s the perfect technology to guide lube technicians during the lubrication-replenishment task. Ultrasound assisted lubrication of plant assets offers significant benefits that calendar based lubrication cannot. The days of relying on calendars and calculators are over.

Find out more by visiting our website at https://sdtultrasound.com/industry/bearing-lubrication-monitoring/

Cyber threats to industrial facilities are becoming more common, complex, and creative as operational technology (OT) – the control systems that manage, monitor, automate and control industrial operations – is increasingly networked and connected to IT environments. The manufacturing sector recently became the world’s most cyber-attacked industry for the first time, according to IBM’s 2022 X-Force Threat Intelligence Index. Other industrial sectors, including energy and transport also appear within the top ten.

Production shutdowns, safety incidents, process disturbances and other service disruptions are all potential consequences of a cyber-attack on industrial operations. Life, property and the environment are at stake.

It’s no surprise, then, that cyber security is rising up the boardroom agenda in industrial sectors. Cyber security risks are now business risks, and business leaders are recognising that cyber security is a pre-requisite for digitalisation and automation excellence.

The supply chain security challenge

Industrial companies’ investment in cyber security is now increasing. More focus is being placed on identifying where companies are vulnerable to attack, and putting the people, process, and technology measures in place to defend their IT and OT environments. But all this effort will make no difference if the security posture of a company’s supply chain is not equally strengthened.

Companies can have complete oversight of their own vulnerabilities and have all the right measures in place to manage the risk, but this doesn’t matter if there are undiscovered vulnerabilities in their supply chain. One issue can escalate or ‘domino’ into many others. The supply chain is a very attractive target for cyber criminals because it potentially provides a single-entry point to multiple companies’ environments.

Supply chain security risks have not gone unnoticed by OT security professionals. The majority say their organisations are at risk because of their inability to ascertain the security practices of relevant third parties and to mitigate cyber risks across the OT external supply chain, according to research conducted by Applied Risk, a DNV company, in 2021.

Many suppliers and manufacturers of equipment integrated within OT systems simply lack the people, processes, and technologies to demonstrate the cyber security of their products and services. By adopting a cyber security programme, investing in training of the workforce and following a Secure Software Development Life Cycle (SDLC) process, the risk of security vulnerabilities in products in production can be improved.

Vendors’ systems used to be standalone. Now, they are increasingly connected within IT/OT systems internally and externally in much larger critical infrastructure ecosystems.

Applied Risk’s study found that only a third of OT security professionals say their organisations conduct regular audits of their main suppliers, and just a quarter (27%) conduct due diligence prior to contracting with new suppliers.

Companies with industrial operations need to pay greater attention to assuring that equipment vendors and suppliers demonstrate compliance with security best practice from the earliest stages of procurement and throughout the lifecycle of a project. Strengthened data management securing information and data sharing between suppliers, customers and other partners, limited access to critical assets – next to implementing monitoring and threat detection systems – improve supply chain cyber security by mitigating the risk of cyber-attacks. And if things go wrong, have an incident response plan in place to manage the threat and act fast.

Time to take action

It is now time for both industrial operators and their suppliers to face these challenges head-on. Increasingly, suppliers must assure themselves that they have the right measures in place to defend their products and systems from cyber threats. They must also be in a position to demonstrate their security posture to companies procuring from them.
The overriding principle to mitigate against assets and operations being compromised by a cyber-attack is to protect, detect, respond and recover. This is in line with industry best practice including the National Institute of Standards and Technology’s (NIST) cyber security framework.

The Centre for Internet Security (CIS) sets out benchmarks for vendor product families to help protect systems against threats more confidently while The Open Worldwide Application Security Project (OWASP) Foundation provides free online resources for web application security.

For many organisations, however, the challenge in ensuring cyber resilience is understanding and identifying where their vulnerabilities are. By having a clear overview of attack surfaces and potential entry points, you can prioritise the vulnerabilities and non-conformities that must be addressed. Robust and often straightforward mitigation measures can be put in place to address most vulnerabilities.

When it comes to demonstrating security posture, it pays for suppliers to be able to prove that they conform to a growing number of industry standards and practices. These standards include IEC 62443, the international series of standards that address cyber security for operational technology in automation and control systems, and ISO 27001, the standard for information security management systems and their requirements.

Recommended practices are also available to help companies on their path to compliance with industry standards. For example, DNV’s Recommended Practice DNV-RP-G108 provides best practice on how to apply the IEC 62443 standard in the oil and gas industry.

Help is at hand from industrial cyber security specialists, including DNV, for those companies who don’t have the in-house expertise to undertake this work themselves. They can help to identify which standards are most relevant to comply with, uncover companies’ compliance status, what outline what needs to be done to achieve compliance before helping to put mitigating actions in place.

For companies procuring products and systems from suppliers, we recommend that supply chain audits and vendor cyber security requirements are implemented during procurement, installation and operation of equipment, systems, and software. By defining requirements up front, and regularly reviewing suppliers against those requirements, understanding the supply chain’s cyber security posture becomes less of a black box. Vulnerabilities can be more easily identified. Mitigating actions can be undertaken more collaboratively. Assessments should be undertaken continually, rather than periodically, to ensure resilience against new and emerging cyber-attack vectors.

Tighter regulation on the horizon

Companies with industrial operations who have not yet put their own cyber security and that of their supply chain on their to-do list may be incentivised to do so by tightening regulation. For example, organisations providing essential services (including energy, drinking water supply, transport, healthcare and more) in the European Union (EU), will soon face tougher cyber security regulation than ever, with the threat of more and greater fines and/or withdrawal of license to operate if they do not comply.

The revised NIS2 Directive strengthens cyber security requirements on companies, introducing top management accountability for non-compliance and streamlining reporting obligations. Crucially, the Directive also puts more focus on cyber security of supply chains.

The NIS2 Directive suggests forcing individual businesses to address cyber security risks in supply chains and supplier partnerships to address the security of these ties. The idea is that it will improve supply-chain cyber security for important information and communication technology at the European level. Building on the successful strategy used in the framework of the European Commission’s Recommendation on Cybersecurity, Member States may conduct coordinated risk assessments of vital supply chains in collaboration with the Commission and the European Union Agency for Cybersecurity (ENISA).

The revised Directive on Security of Network and Information Systems (NIS2) to come into force in January 2023. Member States have until October 2024 to homologate NIS2 into national legislation and while it is estimated that organisations within NIS2 scope will have to start complying by mid-2024 with relevant national laws.

Organisations in industrial sectors should now think about NIS2’s scope and if their operations fit within it. An organisation should consider the organisational, financial, and technical actions that will be necessary to get ready for NIS2 compliance if it looks likely that they will fall under the new legislation’s purview. For instance, the European Commission anticipates that organisations’ ICT security spending will increase by up to 22% in the first few years following the introduction of NIS2.

In-scope organisations should also monitor how NIS2 is implemented in the important EU jurisdictions where they conduct business.

If you think your organisation might fall under the scope of the NIS2 Directive, my advice is to get advice. DNV’s white paper on the Directive is a great starting point for identifying what new cyber security laws mean for industrial companies in Europe, and what you need to do to get ready to comply.

Jalal Bouhdada, Global Cyber Security Segment Director, DNV