Sources, licences and what we changed

Brought to you by CyberForte

CyberForte works on OT and industrial cybersecurity. We built this free site to make two excellent public resources easier to read and act on. Contact: info@cyberforte.co.uk · cyberforte.co.uk.

CyberForte is not affiliated with, or endorsed by, ENISA or OWASP.

Part 1: ENISA Secure by Design and Default Playbooks

• Source: github.com/enisaeu/enisa-sbd-playbook, based on the ENISA Secure by Design and Default Playbook, a practical guide for SMEs. Version used: 31 July 2026.
• Author: European Union Agency for Cybersecurity (ENISA).
• Licence: Creative Commons Attribution 4.0 International (CC BY 4.0).
• What we changed: we added our own “In plain words” summary, example and practical checklist to each playbook. The original playbook text is reproduced unchanged, only converted from Markdown to web pages. Our summaries are also shared under CC BY 4.0.

Part 2: OWASP OT Top 10

• Source: ot.owasp.org and github.com/OWASP/www-project-operational-technology-top-10. Version used: OWASP OT Top 10 2025, repository state of 20 October 2026.
• Author: the OWASP OT Top 10 project and its contributors.
• Licence: Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0), as stated in the document and its repository.
• What we changed: we added our own summary, “why it matters”, “how to reduce the risk” and practical checklist to each entry. The original entry is reproduced unchanged, converted from Markdown, with links to other entries pointed at this site or at ot.owasp.org.
• Share-alike: because our OT Top 10 summaries are adapted from OWASP's text, they are shared under CC BY-SA 4.0 too. You may reuse them on the same terms.

Illustrations

The 3D plant, the story drawings and the icons are modelled and drawn in code by CyberForte. They are our own interpretation and are not part of the ENISA or OWASP material. The 3D plant uses the open-source three.js library (MIT licence), included with the site; a flat drawing is shown if your browser cannot run it. The only source image is ENISA's Figure 1, shown unchanged with its credit.

Real-world examples

We only add a real-world example when it is backed by reputable reporting, and we link to the sources. If an investigation is still open, the example is labelled Reported. The examples listed inside the original texts are the authors' own.

Good practice, not a stamp

These guides describe good practice and help with readiness. They are not legal advice, and reading or ticking them does not by itself meet any legal or regulatory requirement.

Your data

This site has no accounts, no tracking and no cookies. Checklist ticks, progress and your light or dark choice are saved only in your own browser (local storage) and never leave your device.