COMAH and HSE OG86: Do UK Chemical Sites Need a Penetration Test?

No. COMAH does not name a penetration test, and the HSE’s guidance for control systems, OG86, lists penetration testing as optional. UK chemical sites still commission tests for three reasons: to evidence the measures COMAH asks them to demonstrate, to meet UK GDPR Article 32 on their IT systems, and because a customer or insurer has asked for a report.

Does COMAH require a penetration test?

COMAH does not mention penetration testing, or cyber security, by name. Regulation 5 of the Control of Major Accident Hazards Regulations 2015 requires every operator to take all measures necessary to prevent major accidents and limit their consequences, and to demonstrate to the competent authority that it has done so.

That duty is wide on purpose. It covers anything a major accident could depend on, and on a modern site that includes the programmable systems that run the process. The Health and Safety Executive explains on its cyber security page that industrial automation and control systems may be vulnerable to cyber threats, with the potential for incidents with major health, safety or environmental consequences. So cyber security reaches a COMAH site through the general duty in Regulation 5, not through a rule that names a test.

The same HSE page draws a boundary that matters when you scope a test. For COMAH purposes, cyber security is about the control systems that major accident safety relies on. It does not cover the protection of information on corporate networks. Those systems fall under data protection law instead, which is covered below.

What does HSE OG86 say about penetration testing?

OG86 treats penetration testing as an optional measure to be used with care. The guidance lists “Optional use of Penetration testing” among its countermeasures, and says it may be used at the higher levels of the control network, on less operationally critical assets, or during plant downtime so that online systems are not affected.

OG86, Cyber Security for Industrial Automation and Control Systems, is operational guidance written for HSE inspectors. The HSE says it is also freely available to COMAH operators as useful guidance on how compliance might be achieved. The document itself says that following it could contribute towards a suitable demonstration of compliance, and that alternative equivalent means may also be used.

Three points in OG86 are worth knowing before anyone proposes a test of plant systems:

• It warns that penetration testing remains a challenge in control system environments, because many real-time control and safety systems may be taken offline by testing.
• Under proactive security event discovery, it names “enhanced testing such as penetration testing, to address specific concerns”, and gives threats from external networks to the control system as the example.
• It says procedures should define the period, requirements and scope, and that even simple scanning of low level assets like controllers may cause them to fail, so testing should be well planned and limited.

Read together, the guidance points testing at the boundary: the routes from the internet and the corporate network towards the control system, not the live controllers themselves.

Who actually asks a chemical site for a penetration test?

In our experience the request usually comes from one of four places: the site’s own COMAH cyber security work, its data protection duties, a customer’s supplier review, or a cyber insurance form. Only one of these has a legal text behind it that mentions testing, and none of them names a penetration test as the only acceptable method.

Your own COMAH work. A site following OG86 may choose a penetration test to address a specific concern, such as whether a remote access route or the link between the corporate network and the plant network can be abused. This is the operator’s choice, made in its own risk assessment.

UK GDPR. Supplier portals, laboratory platforms and back-office systems hold personal data about staff, customers and suppliers. UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. It does not name penetration testing as the method. See our page on GDPR penetration testing.

Customers. In our experience, larger customers ask chemical and process suppliers for security evidence during onboarding and periodic supplier reviews. The wording varies by customer. Some ask for Cyber Essentials Plus, which is an assessor-led technical audit and a different thing from a penetration test. Some ask for a recent independent penetration test report. Read the exact wording before you buy anything.

Insurers. Some UK cyber insurance applications ask about testing directly. One published cyber proposal form asks whether you conduct penetration tests of your network at least annually, and whether all high and critical findings have been remediated. Requirements vary by insurer and policy. Our guide to cyber insurance renewals that ask for penetration testing goes through the questions.

Who can carry out a penetration test for a COMAH site?

Neither COMAH nor OG86 names an accreditation a testing company must hold. Chemicals organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. Start with the document that triggered the request and use the accreditation it names.

CHECK is the scheme under which NCSC assured companies can conduct authorised penetration tests of public sector and critical national infrastructure systems and networks. Where a requirement names CHECK, use a provider approved for it. Where it asks for a CREST-accredited penetration test, a CREST-accredited company such as EJN Labs meets it.

Whichever route applies, ask two practical questions. First, which legal entity holds the accreditation, and can you see it on the scheme’s own register. Second, how the company will keep testing away from live control and safety systems, because the OG86 warning applies to every tester.

What should a chemical site test?

Test the systems an attacker can reach first: internet-facing services, remote access, and the web platforms that suppliers, laboratories and engineers log in to. Then test the separation between corporate IT and the plant network. Live controllers and safety instrumented systems stay out of scope unless your engineering team has agreed a safe plan.

• External perimeter and remote access. VPN gateways, remote-access services, exposed management interfaces and cloud consoles. See external infrastructure penetration testing.
• Supplier and vendor portals. Whether one supplier can see another supplier’s pricing, volumes or contract terms.
• Laboratory and LIMS platforms. Sample chain of custody, and the integrity of results and audit trails.
• Plant monitoring and process interfaces. Dashboards, historian systems and industrial remote-access portals, tested from the IT side of the IT/OT boundary.
• Plant and vendor APIs. The interfaces behind monitoring platforms, ERP integrations and vendor feeds.
• Corporate and site networks. Segregation between corporate IT, laboratory and plant or process-control networks.

What evidence do you hand back?

Hand back a dated report that states the scope, the method, each finding with a severity score, and what was fixed. No public rule sets a format for chemical sites, so match the evidence to the question you were asked. A customer review and an insurance form usually want different levels of detail.

For an insurance form, the useful evidence is the date of the last test and confirmation that high and critical findings were fixed, which a retest provides. For a customer review, a summary letter naming the scope and the testing company is often enough, with the full report available under a confidentiality agreement. For your own COMAH records, keep the scope document as well as the report. OG86 expects testing procedures to define period, requirements and scope, and the scope document is where that is written down.

What does it cost?

Price follows the number of testing days, and the number of days follows the scope. UK day rates for CREST-accredited penetration testing typically run £1,100 to £1,400. The pricing page shows typical engagement lengths for each type of test, and the quote form gives an exact figure for your scope.

How EJN Labs approaches testing for chemical and process sites

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated chemicals and process industries service. We test from the IT side of the IT/OT boundary: supplier and vendor remote-access pathways, plant-monitoring dashboards, laboratory platforms, APIs, the external perimeter and corporate and site networks.

Live control systems and safety instrumented systems are left alone. Any work that reaches towards OT or process-safety infrastructure only goes ahead against an agreed safe test plan, with your engineering team, defined change windows and a kill switch. Testing is safe by default on production, with no denial of service, and out of hours slots are available.

The work is done by UK-based, CREST-certified testers. You get a fixed price for a defined scope, findings in a client portal as they are confirmed, CVSS-scored findings with a walkthrough call, and the report on the last day of testing. Retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees.

Frequently Asked Questions

Is a penetration test mandatory for a COMAH site?

No. Regulation 5 of the Control of Major Accident Hazards Regulations 2015 requires operators to take all measures necessary to prevent major accidents and to demonstrate that to the competent authority. It does not name penetration testing. HSE guidance OG86 lists penetration testing as an optional measure for control systems.

Does OG86 apply to our office IT and business systems?

OG86 is about industrial automation and control systems. The HSE says that, in relation to COMAH, cyber security does not cover the protection of information on corporate networks. Office IT, supplier portals and laboratory platforms that hold personal data fall under UK GDPR Article 32, which requires a process for regularly testing your security measures.

Can a penetration test be run on live control systems?

OG86 advises care. It says many real-time control and safety systems may be taken offline by testing, and that testing may be used at the higher levels of the control network, on less operationally critical assets, or during plant downtime. EJN Labs tests from the IT side of the IT/OT boundary and leaves live control and safety instrumented systems alone.

Does the testing company need to be CREST-accredited or a CHECK provider?

Neither COMAH nor OG86 names an accreditation. Chemicals organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. Check the customer contract, insurance form or internal standard that triggered the request and use the accreditation it names.

How often should a chemical site run a penetration test?

No rule for chemical sites sets a frequency. OG86 says a site’s own procedures should define the period, requirements and scope of any testing. Some cyber insurance forms ask whether network penetration tests are run at least annually, so once a year, and again after a significant change, is a common starting point.

Get a quote for your site

Tell us which systems are in scope and who has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Penetration Testing Cost for UK Chemical and Process Sites, Best Penetration Testing Companies for UK Chemicals and Process Industries, penetration testing for UK chemicals and process industries, penetration testing for energy and renewables, GDPR penetration testing and what underwriters accept at a cyber insurance renewal.