vaayaa Inclusive Education
Technical risk assessment

Industrial IoT Applications Risk Assessment: Sensors, Connectivity and Control Risks

A worked example of how a plant team identifies, scores and controls risks from connected sensors, gateways, controllers and data platforms, covering electrical, cyber, reliability, supplier and human factors.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Industrial IoT Applications course

Executive summary

This assessment shows how a plant team can find, rate and control the risks that come with connecting sensors, gateways, controllers and analytics. Eight risks were chosen because they are plausible in everyday industrial IoT work. Cyber intrusion into controllers scores highest before controls because it can change process behavior and stop production. Electrical hazards from retrofits, sensor drift and automated setpoint changes also carry serious potential harm. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once the added controls are in place, but the process and electrical risks need specialist review before any change. The first actions are network zoning, calibration linkage, a design check for every cabinet retrofit and visible logging of automatic setpoint changes. The plant is a teaching example, so every score illustrates method rather than a real site.

Focus area
Industrial internet of things applications
Setting
Manufacturing plant with connected sensors, edge gateways and a cloud analytics platform used for condition monitoring and process support
Method
Five by five likelihood and severity risk register with inherent and residual scoring

Scope

This assessment covers a plant that links field sensors, edge gateways, programmable controllers and a cloud analytics platform to monitor equipment condition and support process decisions. It looks at risks to people, equipment, processes, data and continuity of supply. It does not describe the design of any real plant and is not a formal site-specific assessment. Jurisdiction, plant type, network design and vendor choices are assumptions made for teaching.

Context

The plant runs two production lines with programmable controllers on a segmented operational network. Temperature, pressure, vibration and flow sensors feed edge gateways, which send data to a historian and then to a cloud platform. Maintenance planners use dashboards and predictive models to schedule work, while operators watch local panels. A small team of instrumentation engineers, electricians, network staff and a data analyst supports the system, and several devices come from outside suppliers. Each hazard is scored before controls to show its natural level, then again after the existing controls and the controls that should be added.

Objectives, assets and stakeholders

The objective is to keep people safe, run processes within approved limits, keep equipment available, protect data and meet legal duties while gaining value from connected devices. The assets in scope are field sensors, edge gateways, controllers, cabinets, the historian and cloud platform, spare parts, process material and the data that describes condition and quality. Stakeholders include operators, maintenance and electrical staff, process and safety engineers, workers whose data is monitored, suppliers, customers who rely on output, managers and regulators. Each risk has one owner role, and the operational technology security lead and process safety engineer report the register to plant management every quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H04 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H02
3 Possible Likelihood 3, impact 2, score 6, medium: H08 Likelihood 3, impact 3, score 9, medium: H06 Likelihood 3, impact 4, score 12, high: H05 Likelihood 3, impact 5, score 15, high: H03
2 Unlikely Likelihood 2, impact 5, score 10, high: H07
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H04 H06 H08 Likelihood 2, impact 3, score 6, medium: H01 H05 Likelihood 2, impact 4, score 8, medium: H02 H03
1 Rare Likelihood 1, impact 5, score 5, medium: H07
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Sensor calibration drift and misleading process readings 16 High 6 Medium Instrumentation and controls engineer
H02 Cyber intrusion into connected controllers and gateways 20 Critical 8 Medium Operational technology security lead
H03 Electrical shock and fire from retrofitted sensors and power supplies 15 High 8 Medium Electrical maintenance supervisor
H04 Network outage and data loss during maintenance 12 High 4 Low Network and communications lead
H05 Supplier firmware updates and component obsolescence 12 High 6 Medium Purchasing and supplier manager
H06 Poor data quality and misleading analytics 9 Medium 4 Low Data and analytics lead
H07 Automated setpoint changes without operator awareness 10 High 5 Medium Process safety engineer
H08 Worker monitoring data and privacy duties 6 Medium 4 Low Human resources and data protection lead
H01

Sensor calibration drift and misleading process readings

Operational Before 16 After 6

Field sensors and transmitters drift out of calibration, are mounted in the wrong place or are scaled with the wrong units, so the platform shows readings that look normal while the process runs outside its limits.

Who or what is affected: Operators, maintenance technicians and product quality staff

Causes

Missed calibration intervals, wrong configuration after replacement and no comparison against reference instruments.

Consequences

Poor control decisions, off-specification product, scrap, equipment damage and missed alarms.

Existing controls

  • Sensors carry a calibration label and are checked during scheduled shutdowns.
  • Operators compare key readings with handheld instruments on their rounds.

Control gaps

Calibration records are kept on paper and are not linked to the data platform.

Additional controls

  • Prevent: Link each sensor tag to a calibration record and block tags with overdue checks from use in control logic.
  • Detect: Flag any sensor reading that disagrees with a redundant reference by more than an agreed margin.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Instrumentation and controls engineer Target: Within 60 days Early warning: A sensor reading that differs from its redundant reference for more than one shift.
H02

Cyber intrusion into connected controllers and gateways

Technology and data Before 20 After 8

An attacker or careless user reaches the control network through an exposed gateway, a remote access tool or a shared laptop, then changes controller logic or blocks data, so the plant runs on false information or stops.

Who or what is affected: Plant operators, safety staff, production managers and customers who rely on output

Causes

Flat networks, default passwords, remote access left open and unpatched gateway software.

Consequences

Unsafe process changes, production stoppage, data theft and loss of trust in connected systems.

Existing controls

  • Gateways require individual login and sit behind a firewall.
  • Remote access is switched off outside agreed maintenance windows.

Control gaps

Network zones are not clearly separated and vendors keep standing remote access.

Additional controls

  • Prevent: Separate the control network into zones with only the data flows needed, and remove default credentials from all devices.
  • Detect: Monitor gateway traffic for new connections and changes to controller logic, with alerts to the security lead.
  • Respond: Keep a tested procedure to isolate a gateway and return to manual operation.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Operational technology security lead Target: Within 30 days Early warning: A controller logic change or new outbound connection that no change request explains.
H03

Electrical shock and fire from retrofitted sensors and power supplies

Safety Before 15 After 8

Sensors, gateways and new power supplies are added to existing cabinets by people without proper design checks, using poor cable routing, wrong protection or unsealed enclosures, so people can receive a shock or a cabinet can overheat.

Who or what is affected: Electricians, maintenance technicians, visiting contractors and nearby staff

Causes

Retrofits done quickly under production pressure, unclear responsibility between IT and maintenance, and aged cabinets.

Consequences

Electric shock, arc flash, burns, fire, plant shutdown and possible injury claims.

Existing controls

  • Only qualified electricians open live cabinets under a permit.
  • Retrofit parts carry a rating label and are logged in the asset list.

Control gaps

Low voltage retrofits are not checked against the original cabinet design or its heat load.

Additional controls

  • Prevent: Require a written design check of load, heat and protection before any device is fitted, with specialist electrical review where needed.
  • Detect: Run thermal checks on cabinets during planned inspections and record any hot spot.
  • Respond: Keep an isolation and fire response card at each cabinet that states who to call first.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Electrical maintenance supervisor Target: Within 30 days Early warning: A cabinet temperature rise or a new device fitted without a recorded design check.
H04

Network outage and data loss during maintenance

Operational Before 12 After 4

Network switches, wireless links or power to gateways fail, or a maintenance change interrupts communications, so sensor data stops arriving and automated alarms and records go missing for hours.

Who or what is affected: Operators, maintenance planners and analysts who rely on live data

Causes

Single points of failure in the network, wireless interference and changes made without a communications plan.

Consequences

Blind operation, missed alarms, gaps in quality records and delayed maintenance decisions.

Existing controls

  • Critical sensors are wired to a second network switch.
  • Maintenance changes need supervisor sign off before work starts.

Control gaps

Gateways buffer data for only a short time, and no one has tested failover.

Additional controls

  • Prevent: Add a local data buffer on each gateway sized for the longest planned outage, and review its capacity each year.
  • Recover: Test a failover to the standby link and record how long data took to return.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Network and communications lead Target: Within 60 days Early warning: A gateway that has been silent for longer than its normal reporting interval.
H05

Supplier firmware updates and component obsolescence

Supplier Before 12 After 6

A device vendor releases an update that changes how data is sent, or stops supporting a part, so connected equipment stops working, becomes hard to repair or cannot be replaced at the planned cost.

Who or what is affected: Maintenance team, purchasing staff and plant managers

Causes

Dependence on one vendor, weak support terms in contracts and updates applied without testing.

Consequences

Unplanned downtime, costly redesign, loss of spares and security exposure from unpatched devices.

Existing controls

  • Critical spare parts are held for the main production line.
  • Vendor contracts name a support contact for each major device.

Control gaps

Vendor support end dates are not tracked, and updates are installed without a test environment.

Additional controls

  • Prevent: Keep a register of support end dates and firmware versions, and approve updates only after a test on a spare unit.
  • Respond: Hold a shortlist of alternative suppliers and compatible parts for each critical device.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Purchasing and supplier manager Target: Within 90 days Early warning: A vendor notice of end of support for any device on the critical equipment list.
H06

Poor data quality and misleading analytics

Technology and data Before 9 After 4

Dashboards and predictive models are built on incomplete, duplicated or mislabelled data, so maintenance is scheduled on the wrong equipment or real faults are missed, yet the team trusts the output anyway.

Who or what is affected: Maintenance planners, quality engineers and managers making investment choices

Causes

Unclear tag naming, time stamps in mixed time zones and models trained on too little history.

Consequences

Wasted maintenance effort, missed faults, poor capital decisions and erosion of trust in the platform.

Existing controls

  • Data is collected from a single historian with time stamps.
  • Dashboards show the data source for each chart.

Control gaps

No one checks whether model predictions match later failures.

Additional controls

  • Prevent: Enforce a naming standard for tags and a check for missing or duplicate records before data reaches the platform.
  • Detect: Compare model predictions with recorded failures each quarter and report the hit rate.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Data and analytics lead Target: Within 90 days Early warning: Repeated predictions over a quarter that do not match inspection findings.
H07

Automated setpoint changes without operator awareness

Safety Before 10 After 5

Automated control or optimization software changes a setpoint or recipe, and operators are not told, so the process moves beyond safe or approved limits before anyone notices. Specialist process safety review is needed before such changes go live.

Who or what is affected: Process operators, shift supervisors and nearby staff

Causes

Optimization rules added without a hazard review, and alarms that are silenced or hidden.

Consequences

Process excursion, pressure or temperature upset, release of material and injury.

Existing controls

  • Hard pressure and temperature limits stop the process independent of software.
  • Operators can override automatic control from the panel.

Control gaps

Automatic changes do not appear on the operator screen and are not logged with reasons.

Additional controls

  • Prevent: Keep a hazard review for each automatic change and limit software to set ranges approved by the process engineer.
  • Detect: Show every automatic setpoint change on the operator screen with a reason code, and alarm on any change outside the approved range.
  • Respond: Train operators on manual override and rehearse it twice a year.
Likelihood 2 x impact 5 before; 1 x 5 after Owner: Process safety engineer Target: Within 30 days Early warning: Any automatic setpoint change without a logged reason code.
H08

Worker monitoring data and privacy duties

Legal and compliance Before 6 After 4

Wearable tags, camera analytics or location data collected for safety or productivity are kept longer than needed, shared without notice or used in discipline, breaking the duties that apply where the plant operates. Jurisdiction is assumed, so specialist legal advice is needed.

Who or what is affected: Workers, human resources staff and the data protection lead

Causes

Monitoring added for one purpose and reused for another, with no retention rule.

Consequences

Complaints, legal action, loss of worker trust and penalties where the law applies.

Existing controls

  • Monitoring data is stored on the company platform with access limited to named roles.
  • Workers are told in writing that location tags are used for safety.

Control gaps

No record of purpose or retention is kept for each monitoring feed.

Additional controls

  • Prevent: Record the purpose and retention period for each monitoring feed, and delete data when the period ends.
  • Detect: Review access logs for monitoring data each quarter and report any use outside the stated purpose.
Likelihood 3 x impact 2 before; 2 x 2 after Owner: Human resources and data protection lead Target: Within 60 days Early warning: A request to use monitoring data for discipline or to share it with a third party.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and severity runs from Negligible to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. Low risks are accepted and watched. Medium risks need routine controls with a named owner. High risks need senior attention and a dated plan. Critical risks must be reduced before the affected system runs again. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls, and residual must never be higher than inherent. Severity covers harm to people first, then process integrity, equipment, continuity, data and legal exposure. A safety or electrical risk is never rated down only because it has not yet happened. The people who do the work should challenge every rating, and any rating is reviewed when an indicator reaches its threshold or when the plant, network or supplier changes.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Controller logic changes or new outbound connections without a matching change request.Escalate to the operational technology security lead at once, and isolate the gateway if the change cannot be explained within one hour.
Sensor readings that disagree with a redundant reference for more than one shift.Escalate to the instrumentation and controls engineer when any sensor disagrees, and to the plant manager if the process is affected for more than a shift.
Cabinet hot spots or new devices fitted without a recorded design check.Escalate to the electrical maintenance supervisor immediately, and withdraw the cabinet from service until a qualified review is complete.
Automatic setpoint changes without a logged reason code.Escalate to the process safety engineer at once, and to the plant manager if any change falls outside the approved range.
Requests to use worker monitoring data for discipline or to share it with a third party.Escalate to the data protection lead before any action is taken, and to legal advisers where the local law applies.

Contingency arrangements

If a serious event occurs, such as a controller compromise, a fire in a cabinet or an unsafe automatic change, the plant moves to the approved manual procedure and the process safety engineer confirms it is safe. The operational technology security lead isolates the affected gateways and restores controller configuration from a verified copy. Electrical isolation follows the response card, and emergency services are called first where people are hurt. Production is protected by a standby plan for critical lines, and workers and customers are told what they need to know early and plainly.

Prioritized action plan

  1. Separate the control network into zones and remove default credentials, owner operational technology security lead, within 30 days.
  2. Require a written electrical design check before any cabinet retrofit, owner electrical maintenance supervisor, within 30 days.
  3. Show every automatic setpoint change on the operator screen with a reason code, owner process safety engineer, within 30 days.
  4. Link each sensor tag to its calibration record and block overdue tags, owner instrumentation and controls engineer, within 60 days.
  5. Record purpose and retention for each worker monitoring feed, owner human resources and data protection lead, within 60 days.

Conclusion

Reliable connected systems depend on a few steady habits: zoned networks, linked calibration records, design checks before any retrofit, visible setpoint changes, tested failover and clear rules for worker data. The highest scores sit with cyber exposure, electrical retrofits and automatic process changes, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified engineering, safety and legal advice for any real plant decision.

Assumptions and limitations

Assumptions

  • The plant operates under a national workplace safety regime that requires risk assessment, but the specific jurisdiction is not named.
  • Controllers and safety functions are designed to fail to a safe state independent of the connected platform.
  • Staff are trained in basic plant procedures, and vendor support contracts exist for the main devices.

Limitations

  • The scores are examples for learning and do not describe any real plant, network or supplier.
  • Electrical, process safety, cyber and privacy rules vary by location and change over time, so specialist review is needed.
  • This is educational content and is not engineering, legal or safety certification advice.

Related frameworks to study

  • Hierarchy of controls for eliminating or reducing hazards
  • Failure mode and effects analysis for sensors and gateways
  • Defense in depth for operational technology networks
  • Layered risk ownership across operations, engineering and governance

Technical Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Industrial IoT Applications course Read the best practices for this course

More Technical risk assessments

Hourly Active: 35,661 Learners