Turn guidance into an action plan
Agree the systems and business processes in scope, assign a decision-maker and technical owner, and record what evidence will demonstrate progress. Separate immediate risk treatment from longer-term improvement, and set a review point for outstanding actions.
What leaders should do
- Identify critical production, engineering, remote-access, identity, and supplier-connected systems.
- Validate segmentation, privileged access, remote support, backup recovery, and visibility safely.
- Prioritise realistic paths from external exposure or compromised identities to operational impact.
- Coordinate remediation with maintenance windows, safety controls, production constraints, and owners.
The key question is which combinations create material operational risk and how they will be controlled.