John Cusimano is an industrial control system (ICS) / OT cybersecurity expert with a strong background in process control and functional safety engineering. Since 2009, John has started up and successfully led 2 ICS/OT cybersecurity consulting practices at boutique consulting/engineering firms (exida and aeSolutions). Both practices experienced above average growth and profitability under his leadership.. John has personally performed countless ICS cybersecurity vulnerability and risk assessments in wide range of industries per NIST, ISA/IEC 62443 and NERC CIP standards. He developed the CyberPHA methodology through a combination of his work on standards committees and by working with key clients who shared his interest in applying process safety engineering discipline to ICS cybersecurity. The CyberPHA methodology has become a globally recognized method of performing risk assessments of ICS and safety systems. John is not only a successful business leader and ICS cybersecurity practitioner, but he is also a highly respected thought leader in the ICS cybersecurity field. He was a leader in the development of the ISASecure™ certification scheme and launched the first ANSI accredited ISASecure testing laboratory at exida. He was a SME for the first LOGIIC SIS project. He led the development of 3 ICS cybersecurity courses for ISA (ISA IC33, IC34 and IC34) as well as the accompanying certificate programs. He also led the development of the "ICS Cybersecurity for Manager's" course hosted by SANS. John served as Chairman of the ISA 99 subcommittee that authored the recently approved ISA/IEC 62443-3-2 standard, "IACS Security Risk Assessment & Design". Currently, John is vice president of OT security for Armexa. In this role, John serves on the Executive Leadership team, oversees business development and marketing, and leads the Assessment, Governance, and Training (AGT) services delivery practice. Many of his clients are Fortune 500 multinational companies with both domestic and international operations. His practice's flagship ICS cybersecurity service is OT cybersecurity risk assessments per the ISA/IEC 62443-3-2 (aka CyberPHA, CyberHAZOP, Cyber Bowtie) but their services range from cybersecurity program development, CyberFAT and SAT testing, ICS and IIoT cybersecurity risk assessments, and training.