Each quarter, IISZON examines one gap between what regulations and vendors assume and what operational technology environments look like in practice. This edition: the difference between an organisation that has filled its security roles and one that can show those roles are capable of meeting the obligations they carry.
Two kinds of capability
Organisations running critical infrastructure trust their technology for good reason. A protection relay has been tested, a SCADA system is maintained on a regular cycle, and a safety instrumented system is validated before it goes anywhere near a live process. That trust is earned through engineering, commissioning, and asset management processes built up over years.
We measure and trust the resilience of our systems, but how well do we understand the capability of the people behind them? An org chart shows who fills a role, and training records what they’ve learned. But do we know if they can perform when it matters?
The regulatory picture is changing. The Cyber Assessment Framework requires role-level training that can demonstrate a positive impact on security behaviour, not simply a count of people who attended or passed. NIS2 places direct obligations on management bodies to complete security training and links human resources security to the wider risk management requirements in Article 21. ENISA’s June 2025 guidance goes further, mapping NIS2 obligations to specific cybersecurity role profiles, a sign that regulators are moving toward role-level accountability, rather than programme-level reporting.
The regulatory picture matters, but it is not the source of the risk. The exposure is structural, driven by at least three forces that most organisations have never formally linked to their security capability.
The Operational Gap
The first force is the labour market. The roles that carry the most security-critical knowledge in OT environments are among the hardest to fill. External recruitment for specialists who carry both deep process knowledge and security expertise is increasingly unrealistic in most sectors; the supply simply is not there. The people currently in those roles have typically built their knowledge over years, and when they leave, that knowledge goes with them. Most organisations have no structured way to track this dependency or plan against it.
The second is technology-driven change. Automation, AI and new tooling are reshaping what security roles require, and they are doing it faster than development programmes can track. Some monitoring and compliance tasks are being absorbed by platforms. At the same time, specialist roles at the analytical and architecture end are becoming more critical and harder to source. The capability profile an organisation planned for two or three years ago may not reflect what it needs now.
The third is concentration. Expertise is rarely distributed evenly across an organisation. It centres around key individuals whose knowledge and skills underpin critical capabilities and services. Those same individuals often carry specific regulatory obligations. Most organisations do not know which obligations would be at risk if those individuals were unavailable, because they have never drawn that connection.
- HR platforms are not built to see it. Training records, skills profiles, and development plans confirm the HR function is operating correctly. They do not map a role to a regulatory obligation or show whether the person in it can meet it. The question most organisations need to answer sits in the gap between those two layers, and the tools they have were not designed to look there.
- Concentration risk is invisible until it matters. The dependency on a small number of people often looks like organisational strength from the outside, until the risk becomes visible when those people are unavailable. In OT environments, the most process-critical knowledge tends to sit with those closest to the end of their careers, which means the window for structured knowledge transfer is already narrowing in many organisations.
- The gap shows up at the worst moment. A regulatory inspection, a significant reorganisation, a major incident: all arrive quickly and leave no time to discover a capability gap that was already there. An organisation that has not looked at its workforce capability picture is carrying a risk it has no way to manage.
- Training records do not show performance. Completing a course is not the same as being able to do the job under pressure, with incomplete information, in conditions the course did not cover. Inspection practice is moving toward testing the difference, and organisations that have relied on attendance records as their evidence of capability will find that position harder to hold.
Labour trends, automation, and concentration risk are widening this gap whether organisations measure it or not. The regulatory inspection regime is now well-positioned to test it. But the exposure exists independently of any inspector: an organisation that cannot account for where its security capability lives is carrying a risk it cannot manage.
How do you respond
Addressing this does not mean rebuilding how the organisation manages its people. It means getting a clear picture of the market, what each security role requires, whether the people in those roles can deliver it, and what workforce risks and opportunities may arise over the next two to three years, not just today. Five starting points:
- Map roles to regulatory obligations. A job description written for HR purposes describes a business function. It does not describe what a specific framework requires of the person in that role. The mapping needs to run from the CAF outcome, the NIS2 requirement, or the relevant sector framework, back to the individual. That mapping makes it possible to measure capability against something meaningful.
- Treat capability evidence differently from training records. A training log confirms a development programme was delivered. It is not evidence of capability for regulatory purposes. The evidence that holds up in an inspection is an auditable account of whether the workforce can meet the obligations placed on the organisation, tied to specific roles and requirements.
- Use the mapping to find concentration risk. When roles are mapped to framework obligations, the depth and spread of capability across the organisation becomes visible. The exercise regularly surfaces dependencies on individuals that were not being managed as a formal risk. When those individuals are unavailable through illness, resignation, or reorganisation, the security function and risk owner carry the consequence.
- Look at workforce trends, not just current capability. Market demand for OT security specialists is high and supply is not keeping pace. The picture varies sharply by role: some roles at the monitoring and compliance end carry real automation exposure and are at risk of being absorbed by platforms; roles at the analytical, architecture and advisory end are already in high demand and increasingly difficult to source. A third category offers a realistic reskilling pathway, typically control and process engineers who hold the domain grounding that cannot be hired in externally. Knowing which of your roles falls into which category, and where internal development is the only realistic route, changes what a response programme looks like.
- Build the picture before an engagement forces it. The evidence a competent authority expects to see should come from how the organisation manages its security function day to day, not from a reconstruction exercise in the weeks before a review. If the evidence has to be assembled under pressure, the capability behind it is not at the level the inspection regime expects.
IISZON has been developing a structured approach to this problem, with a solution that will initially surface risks and opportunities, which will provide the workforce intelligence needed to plan beyond the immediate picture. We are working with organisations on this now. If this reflects something your organisation is dealing with, we would welcome a conversation.