Sectors / 12

Security by sector

Interpret controls through sector-specific impact, dependencies and regulatory scope.

This work is currently open on this device. Sign in to save it and continue on another device.

The same “access control” protects different outcomes: patient care, production safety or transaction integrity. A sector label alone does not establish regulatory applicability; country, entity role, service and scope matter. NIS2 implementation and DORA financial scope require authorized assessment. These sector examples support decisions rather than confer compliance.

Map the process

0 / 4 steps reviewed.

Step 1 / 4

Define the business outcome

Describe the protected service and harm scenario in sector terms. Distinguish data and physical consequences. Do not hide different impacts behind one risk score.

Expected evidence

Service and impact record

One control, three perspectives

How does the control affect the service?

Test business and safety impact of the change.

Service test

Evaluate evidence

Claim: The critical service can continue.

Weak support

Two servers exist in the same region.

Stronger support

What evidence would you request before closing this claim?

Decision desk

A critical service has two servers sharing one identity and communications path.

First step?

Sector desk

Choose sector

Manufacturing

Protected outcome: Safety, production continuity and legacy controllers.
Business constraint: Maintenance windows are limited; supplier support may be critical.
Control approach: Verify remote maintenance with approval and session evidence; no active test without plant approval.
Fictional example: A second supplier path to a filling line was found through passive flows and rule review.

Worked example

This record is fictional. Do not treat sample results as evidence for your own work.

Sector	Critical service	Dependency	Scope decision	Control	Service test
Manufacturing	Example filling line	Remote maintenance gateway	Plant + legal review	Time-bound access	Approved maintenance window

Closure checklist

0 / 4

Checks on this screen last for this session only; they do not create closure evidence or compliance approval. Keep organizational records in the downloaded workpaper.

Applicability assessed beyond sector label.Service and harm scenario explicit.Shared dependencies reviewed.Service owner involved in closure.

Take it to work

Files in the selected language. The workbook includes blank records, a worked example and a checklist.

Complete workpackZIP · EN Editable workpaperXLSX · EN Printable workpaperPDF · EN Blank record templateCSV · EN Full guide and scenarioMD · EN

Keep learning

Explore related Academy courses

Sources and edition

Checked: 2026-10-21 · Edition 2026.10