A system for configuring industrial devices for compliance with security policies comprising at least secure communication policies defining permissible data communication channels between industrial devices defined in a security model, or security event management policies defining one or more security events that are to trigger a notification or countermeasure by the industrial devices, the system comprising: a memory that stores executable components; and one or more processors, operatively coupled to the memory, that execute the executable components, the executable components comprising: a communication component configured to receive device identification data that identifies a new industrial device that has been installed in an industrial facility, and to determine, based on the device identification data, whether the new industrial device is permitted to operate within the industrial facility; and an instruction translation component configured to, in response to a determination that the new industrial device is permitted to operate within the industrial facility, cross-reference the device identification data with a security model that defines groupings of industrial devices into security zones and that further defines a security event management policy to be applied within a security zone of the security zones, the instruction translation component further configured to determine, based on the device identification data, a security zone, of the security zones defined in the security model, to which the new industrial device is assigned, and select, as the security policy to be applied to the new industrial device, a zone-specific security policy defined for the security zone and to configure a configuration instruction to set one or more configuration settings in accordance with the security event management policy and to reassess an implementation of the existing secure communication policies and/or the security event management policies for the security zone due to the new industrial device, wherein the communication component is further configured to send (2122, 2126) the configuration instruction to the new industrial device. a memory that stores executable components; and one or more processors, operatively coupled to the memory, that execute the executable components, the executable components comprising: a communication component configured to receive device identification data that identifies a new industrial device that has been installed in an industrial facility, and to determine, based on the device identification data, whether the new industrial device is permitted to operate within the industrial facility; and an instruction translation component configured to, in response to a determination that the new industrial device is permitted to operate within the industrial facility, cross-reference the device identification data with a security model that defines groupings of industrial devices into security zones and that further defines a security event management policy to be applied within a security zone of the security zones, the instruction translation component further configured to determine, based on the device identification data, a security zone, of the security zones defined in the security model, to which the new industrial device is assigned, and select, as the security policy to be applied to the new industrial device, a zone-specific security policy defined for the security zone and to configure a configuration instruction to set one or more configuration settings in accordance with the security event management policy and to reassess an implementation of the existing secure communication policies and/or the security event management policies for the security zone due to the new industrial device, wherein the communication component is further configured to send (2122, 2126) the configuration instruction to the new industrial device. a communication component configured to receive device identification data that identifies a new industrial device that has been installed in an industrial facility, and to determine, based on the device identification data, whether the new industrial device is permitted to operate within the industrial facility; and an instruction translation component configured to, in response to a determination that the new industrial device is permitted to operate within the industrial facility, cross-reference the device identification data with a security model that defines groupings of industrial devices into security zones and that further defines a security event management policy to be applied within a security zone of the security zones, the instruction translation component further configured to determine, based on the device identification data, a security zone, of the security zones defined in the security model, to which the new industrial device is assigned, and select, as the security policy to be applied to the new industrial device, a zone-specific security policy defined for the security zone and to configure a configuration instruction to set one or more configuration settings in accordance with the security event management policy and to reassess an implementation of the existing secure communication policies and/or the security event management policies for the security zone due to the new industrial device, wherein the communication component is further configured to send (2122, 2126) the configuration instruction to the new industrial device.