OT cybersecurity assessments for industrial environments.

What does an OT cybersecurity assessment cover?

Operational technology (OT) monitors or controls physical equipment and processes. Industrial control systems (ICS) are part of that environment. An assessment needs to consider how security decisions affect operations, reliability and safety.

We agree the facilities, systems, evidence and assessment methods with your operations and security teams before work begins. The review can cover:

• Asset visibility: the available inventory, system owners, critical functions and dependencies.
• Architecture and access: IT/OT connections, network boundaries, remote access and supplier access.
• Operational controls: how vulnerabilities, patches, configuration changes and exceptions are managed.
• Recovery readiness: incident responsibilities, backup arrangements and the evidence available for recovery planning.

How the assessment works

• Scope the environment. Agree objectives, system boundaries, operational constraints, access and the people needed for the review.
• Review the evidence. Examine agreed documentation and records, and discuss operating practices with the relevant teams.
• Assess the gaps. Relate observations to the agreed assessment criteria and explain the evidence behind each finding.
• Prioritise the next steps. Review the findings with you and propose actions, owners and dependencies for your improvement plan.

What you receive

• An assessment summary explaining the scope, evidence reviewed and any limitations.
• Findings with their supporting evidence, operational context and priority rationale.
• A prioritised improvement plan with proposed responsibilities and dependencies.
• A findings discussion to help security and operations teams agree the next decisions.

Agree the assessment method before accessing systems

Operational constraints shape the engagement. We agree what can be reviewed, which access is permitted and how observations will be collected. Active scanning, exploitation, changes to production systems and ongoing monitoring are outside this assessment scope unless separately agreed.

For UK and US engagements, assessment criteria can draw on relevant ISA/IEC 62443 requirements and NIST OT security guidance. The scope identifies which references and parts of the environment are being assessed.

Prepare for the first discussion

Bring a high-level description of the site or process, the systems you want reviewed, available network diagrams and inventories, and any concerns about access or recovery. Identify the operations and security contacts who can explain the environment. We use that information to agree the next step.

Questions about OT assessments

Is this the same as an IT penetration test?

No. This assessment reviews the agreed OT environment, controls and evidence in its operational context. Penetration testing is a separate activity with its own objectives, authorisation and operating constraints.

Can we start with one facility or part of the environment?

Yes. We can agree a bounded assessment around a facility, process or system group. Dependencies and connections outside that boundary should still be identified so the findings can be understood in context.

What affects the scope and cost?

The number of facilities and systems, available evidence, access arrangements, supplier involvement and the assessment depth all affect the work. We use the scoping discussion to define what the engagement will cover.

References

• NIST SP 800-82 Rev. 3 — Guide to Operational Technology Security
• ISA/IEC 62443 series of standards