What Offshore Norge’s revised Guideline 104 means for OT cybersecurity

Norway’s oil and gas industry is getting to grips with a new national regulatory guideline for ensuring cybersecure operational technology (OT) used in industrial control systems. Since June 2026, the Norwegian Ocean Industry Authority Havindustritilsynet (Havtil) has been using and referencing Revision 7 of the Offshore Norge Guideline 104 PDF (ON 104) when regulating and auditing information security for process control, safety, and support ICT systems in the energy and petroleum sectors.  

For asset owners, operators, suppliers and other stakeholders operating on the Norwegian Continental Shelf, ON 104 brings important changes in structure and terminology but most importantly , in the scope and completeness of its requirements. Understanding these changes is essential for turning the guideline into a practical and auditable approach to OT cybersecurity. DNV’s new Recommended Practice DNV-RP-G110 Operational technology cyber security – barrier management can complement this work by helping organizations operationalize cybersecurity through established barrier management principles.

DNV Cyber is one of the seven key stakeholders in the Norwegian oil and gas sector that jointly developed ON 104. 

Target audience for Offshore Norge Guideline 104 (ON 104)
Operators, asset owners, rig owners	Operators oversee governance and implement cybersecurity controls according to ON 104 guidelines.
Suppliers and integrators	Suppliers and integrators are responsible for delivering solutions that comply with cybersecurity standards.
Regulators and auditors	Regulators and auditors use ON 104 as a framework to verify compliance with cybersecurity standards.

Understanding the structure of ON 104 

ON-104 is organized into 21 ‘cybersecurity baseline requirements’ (CSBRs) spanning the full lifecycle of OT cyber risk management. The CSBRs align closely with the cybersecurity functions – govern, identify, protect, detect, respond and recover – in the CSF 2.0 cybersecurity framework of the US National Institute of Standards and Technology (NIST).

By placing cybersecurity controls within these functions, ON 104 helps organizations understand where each control belongs and which main function it supports. Importantly, the guideline does not focus only on technology. It also covers processes and people-related considerations, including competence, to support a holistic approach to cybersecurity. 

For example, CSBR 12, requiring a ‘demilitarized zone’ between OT and IT networks, aligns with the ‘protect’ function in NIST CSF 2.0. 

ON 104 includes: 21 CSBRs grouped by functions
Functions	CSBRs
Govern & Identify  (Governance and asset identification)	Cybersecurity governance and strategy; supply chain risk management; system and asset inventory; threat and risk assessment; vulnerability and patch management
Protect  (Access, network, and asset protection)	Training and competence; network segmentation and architecture; malware protection; identity and access management (IAM); secure remote access; secure default configurations and OS hardening; secure portable media
Detect, Respond, Recover  (Monitoring, incident response, and recovery)	Security event logging; active network monitoring and threat detection; incident management plan; incident handling roles and capabilities; contingency operations and continuity; data and configuration backups; reliability testing of recovery backups; lessons learned and post-incident review

Understanding the new scope and terminology 

NOG 104 Rev. 6 focused heavily on controls and barriers intended to reduce the likelihood of a cyberattack. ON 104 gives equal attention to measures that reduce likelihood as well as measures that reduce consequences through incident response and detection capabilities. Areas that were not addressed previously are now covered clearly. 

For example, CSBR 21 requires a capability to restore. Organizations therefore need to ensure that critical data and systems are backed up and that their restoration capabilities have been tested. 

The change in terminology from NOG 104 to ON 104 also marks a shift from what could previously be regarded as vague advice to clear requirements that make expectations auditable and enforceable. Requirements that must be fulfilled are now written as “shall”. 
 
ON 104 is a completely rewritten document compared with NOG 104. As we see it, the distinction is fundamental: “ON 104 is not an update: it's a full redesign of structure, scope, and terminology.” It establishes the minimum requirements for OT cybersecurity on the Norwegian Continental Shelf and provides the basis Havtil uses to measure and assure a consistent level across the industry. 

Where organizations may face implementation challenges  

Early indications from a recent DNV Cyber webinar poll suggest that implementation is unlikely to be purely a technical exercise. Participants identified technical implementation, governance and ownership, and supplier management as the areas likely to present the greatest challenges for their organizations. 

The same webinar poll indicated that only a quarter of respondents had started implementing ON 104. Nearly a third reported little or no knowledge of the guideline, although some were familiar with its predecessor, NOG 104 Rev. 6 (2016), and very few considered their organizations already fully aligned. 

ON 104 represents a significant step up from the previous version of the baseline requirements. This new version is more structured and auditable, and implementation cannot be treated solely as a technical compliance exercise. The practical challenge will be turning the requirements into clear ownership, consistent implementation across OT environments and suppliers, and evidence that controls are actually in place and working as intended. 

Using DNV-RP-G110 alongside ON-104 

DNV’s new Recommended Practice DNV-RP-G110 Operational technology cyber security – barrier management can complement ON 104 by helping to address awareness, communication and training needs when complying with OT cybersecurity regulation.

DNV-RP-G110 focuses entirely on OT cybersecurity and how it can be viewed in a barrier management context. Cybersecurity can be difficult to communicate across an organization, whereas barrier management tends to be a more established practice. Applying this familiar context can make cybersecurity visible, measurable and, most importantly, actionable for decision-making across all organizational levels. 

DNV-RP-G110 covers how to adequately communicate, prioritize and defend cybersecurity investments and decisions across whole organizations. Developed from DNV’s experience working with owners and operators on the NCS, the recommended practice has been tried and tested in companies working with and on this topic. 

The recommended practice is therefore about operationalizing recommendations to strengthen cyber resilience at asset, system and company levels. This makes it particularly timely alongside the requirements in ON 104.  

For a more detailed explanation of ON 104, its practical implications and how DNV-RP-G110 can support implementation, watch DNV Cyber’s on-demand webinar “Offshore Norge’s revised Guideline 104 - Cybersecurity baseline requirements for Operational Technology (OT) systems”, featuring Tor Helge Kristiansen and Fred-Thomas Bowman, DNV Cyber’s experts on the topic.   
 

Watch the webinar with slides, detailed discussion, and answers to participant questions.

Download DNV’s new Recommended Practice DNV-RP-G110

10/23/2026 7:21:00 AM