Abstract
Operational Technology (OT) systems are becoming increasingly software-driven and connected. This creates new digitalization opportunities but can also increase the risk of cyber security breaches than can have severe consequences. Through a close dialogue with Norwegian actors in the oil- and gas industry and insight into the IEC 62443 standard we propose a process model for continuous risk assessment and mitigation. This paper explains the phases and details of the model and discusses its limitations and further work.