A method comprising: transmitting, by a first distributed control system node, a request to a server; receiving in response to the request, at the first distributed control system node over a network, information associated with a security manager; transmitting, from the first DCS node, a join request to join a DCS network to the security manager using the received information; receiving, a join response to the join request, at the DCS node, by sending security credentials from the security manager over the non-secure channel; establishing, by the DCS node, an encrypted channel to the security manager using the security credentials; transmitting, by the DCS node, a request for a policy for communicating with a second DCS node to the security manager over the encrypted channel; receiving in response to the request for a policy for communication with a second DCS node, a security policy and an initial activation time from the security manager at the first DCS node over the secure channel; performing a handshake operation with the second DCS node; wherein the handshake operation comprises a four-way handshake that includes: transmitting, by the first DCS node, a first policy update message including the initial activation time to the second DCS node and receiving, by the first DCS node, a first acknowledgement from the second DCS node; and receiving, by the first DCS node, a second policy update message from the second DCS node and transmitting, by the first DCS node, a second acknowledgement to the second DCS node; determining whether to adjust the initial activation time based on the received second policy update message; and transitioning the first DCS node to communicate with the second DCS node over the network using the security policy at the initial activation time, if it was determined to not adjust the initial activation time or at the adjusted activation time, if it was determined to adjust the initial activation time. transmitting, by a first distributed control system node, a request to a server; receiving in response to the request, at the first distributed control system node over a network, information associated with a security manager; transmitting, from the first DCS node, a join request to join a DCS network to the security manager using the received information; receiving, a join response to the join request, at the DCS node, by sending security credentials from the security manager over the non-secure channel; establishing, by the DCS node, an encrypted channel to the security manager using the security credentials; transmitting, by the DCS node, a request for a policy for communicating with a second DCS node to the security manager over the encrypted channel; receiving in response to the request for a policy for communication with a second DCS node, a security policy and an initial activation time from the security manager at the first DCS node over the secure channel; performing a handshake operation with the second DCS node; wherein the handshake operation comprises a four-way handshake that includes: transmitting, by the first DCS node, a first policy update message including the initial activation time to the second DCS node and receiving, by the first DCS node, a first acknowledgement from the second DCS node; and receiving, by the first DCS node, a second policy update message from the second DCS node and transmitting, by the first DCS node, a second acknowledgement to the second DCS node; transmitting, by the first DCS node, a first policy update message including the initial activation time to the second DCS node and receiving, by the first DCS node, a first acknowledgement from the second DCS node; and receiving, by the first DCS node, a second policy update message from the second DCS node and transmitting, by the first DCS node, a second acknowledgement to the second DCS node; determining whether to adjust the initial activation time based on the received second policy update message; and transitioning the first DCS node to communicate with the second DCS node over the network using the security policy at the initial activation time, if it was determined to not adjust the initial activation time or at the adjusted activation time, if it was determined to adjust the initial activation time.