This presentation discusses: how Thales constructed a business case for improving the security of industrial control systems (ICS); the difficulties they faced; the most effective policy, processes and technologies they deployed; and how they proved that the capital and on-going operational costs were proportionate.