Product Overview

Summary: This SOP provides a structured, practical framework for managing cybersecurity across engineering projects, from design through to commissioning and handover. It helps Australian engineering teams protect project data, operational technology and intellectual property from cyber threats while meeting client, regulatory and contractual expectations.

Engineering projects increasingly rely on interconnected systems, cloud-based collaboration, and integration between IT and operational technology (OT). This exposes project data, control systems and client infrastructure to cyber risks that can lead to costly delays, safety incidents, reputational damage and contractual breaches. The Cybersecurity in Engineering Projects Standard Operating Procedure sets out a clear, repeatable method for embedding cyber risk management into day-to-day project delivery, from tender and concept design through to construction, commissioning and ongoing support.

Developed specifically for the Australian engineering context, this SOP aligns with local legislation and recognised standards while remaining practical for busy project teams. It defines how to classify information, control access to models and drawings, manage remote access to plant and equipment, and coordinate with clients, vendors and third parties on security requirements. It also addresses the interface between cybersecurity, WHS and operational risk, ensuring that cyber controls do not compromise safety-critical functions. With this SOP, organisations can demonstrate due diligence, satisfy client and regulator expectations, and build a consistent, auditable approach to cybersecurity across all engineering projects.

Key Benefits

• Strengthen protection of project data, designs and intellectual property against cyber threats and unauthorised access.
• Standardise cybersecurity practices across engineering projects, reducing variability and reliance on individual staff knowledge.
• Demonstrate due diligence and compliance with Australian regulatory expectations and client contract requirements.
• Reduce the likelihood of project delays, rework and reputational damage caused by cyber incidents or data breaches.
• Improve coordination between engineering, IT, OT and external vendors on secure system integration and remote access.

Who is this for?

• Engineering Managers
• Project Managers
• Design Engineers
• Systems Engineers
• Control Systems Engineers
• IT Managers
• OT/SCADA Engineers
• WHS and Risk Managers
• Information Security Managers
• Quality and Compliance Managers
• Consulting Engineers
• Bid and Proposal Managers

Included Sections

• 1.0 Purpose, Scope and Objectives
• 2.0 Definitions and Key Concepts (IT, OT, SCADA, ICS, Critical Systems)
• 3.0 Roles, Responsibilities and Authorities
• 4.0 Applicable Legislation, Standards and Client Requirements
• 5.0 Cybersecurity Planning in the Project Lifecycle
• 6.0 Information Classification and Handling for Engineering Data
• 7.0 Access Control for Design Files, Models and Project Systems
• 8.0 Secure Configuration and Hardening of Engineering and OT Systems
• 9.0 Remote Access, Vendor Support and Third-Party Connectivity
• 10.0 Secure Use of Cloud Services, Collaboration Platforms and Version Control
• 11.0 Cyber Risk Assessment and Integration with Project Risk Registers
• 12.0 Interface with WHS, Functional Safety and Operational Risk
• 13.0 Change Management and Configuration Control for Software and Firmware
• 14.0 Incident Detection, Reporting and Response for Cyber Events
• 15.0 Data Backup, Recovery and Business Continuity for Engineering Projects
• 16.0 Training, Awareness and Competency Requirements
• 17.0 Documentation, Records Management and Audit Trail
• 18.0 Continuous Improvement, Review and Lessons Learned

Legislation & References

• AS ISO/IEC 27001:2023 Information security, cybersecurity and privacy protection – Information security management systems
• AS ISO/IEC 27002:2023 Information security, cybersecurity and privacy protection – Information security controls
• AS ISO 31000:2018 Risk management – Guidelines
• Australian Cyber Security Centre (ACSC) – Essential Eight Maturity Model
• Security of Critical Infrastructure Act 2018 (Cth) and associated rules (where applicable to critical infrastructure projects)
• Privacy Act 1988 (Cth) and Australian Privacy Principles (for handling personal information in project systems)
• Relevant state and territory WHS Acts and Regulations (interface between cyber risk and safety-critical systems)