An FMEA-Based Framework for Operational Technology Security Risk Prioritization in Manufacturing

Abstract

The increasing convergence of Information Technology (IT) and Operational Technology (OT) in manufacturing has introduced cybersecurity risks that threaten production reliability, operational continuity, and safety. However, conventional cybersecurity assessments often emphasize technical vulnerabilities without adequately considering their operational consequences. This study developed a Failure Mode and Effects Analysis (FMEA)-based framework integrating OT asset identification, cyber threat scenarios, failure modes, and operational impacts. Seven representative OT asset categories were evaluated using Severity (S), Occurrence (O), and Detection (D) criteria to calculate Risk Priority Numbers (RPNs) and establish risk-treatment priorities. The scenario-based assessment identified unauthorized Programmable Logic Controller (PLC) modification as the highest-priority risk (RPN = 420), followed by unauthorized remote access (RPN = 360), engineering workstation compromise (RPN = 324), and industrial network disruption (RPN = 324). A severity-based review mechanism was incorporated to address the limitations of conventional RPN prioritization. The proposed framework demonstrates how cyber-induced failure modes can be systematically translated into manufacturing-oriented risk priorities. By integrating cybersecurity considerations with industrial risk engineering, the framework provides a structured decision-support approach for prioritizing security controls and supporting production reliability, operational resilience, and risk-informed manufacturing management.