Focusing on technical security can lead to shortfalls in the understanding of social and organisational security challenges. This paper proposes a method for analysing social, technical, and organisational security challenges, in regard to industrial control systems (ICS). This method is applied to a target organisation dependent on ICS, to validate the approach and gain initial insight into the organisation’s perspective on security for ICS.