At SecureWorld...

... there's a good article with a list of suggested strategic moves at the end. Here's the link:

Defending PLC's