OT and ICS security for plant environments
Operational technology runs the plant: the controllers, the HMIs, the historians and the network between them. Most of it was installed before anyone planned to connect it to anything, and it cannot be patched, scanned or rebooted the way IT can. We establish what is actually on the network and how far it is reachable, without touching the process — then help you rehearse for the bad day and respond to it.
Why an OT network cannot be secured like an IT one
The instinct is to point the IT security stack at the plant floor and call it covered. It does not work, and the reasons are practical rather than technical. A controller that has run untouched for eleven years has no agent to install and no patch window to install it in. Tools that are routine on a corporate network can knock a PLC offline, which on a production line is an outage and on a press is a safety event.
So the controls have to fit the plant. Discovery is passive rather than active — we read the traffic the network already carries, industrial protocols like EtherNet/IP, OPC UA and Modbus included, rather than probing devices that cannot take it. And every finding is weighed against uptime and safety before anything is recommended, because the plant does not stop for security work.
Built to be patched
- A window every month, and a reboot inside it
- Endpoints replaced on a refresh cycle
- Downtime costs money
- Scanning is routine
Built to keep running
- A window once a year, if the plant allows one
- Controllers that have run untouched for a decade
- Downtime stops production, and can be a safety event
- A scan can knock a controller over
Same attacker, different constraints. The controls have to fit the plant, not the other way round.
Commissioning Security Verification
An independent check that the security controls specified for a plant are actually present, correctly configured, and reachable only by the right people — device by device, against pass/fail criteria the client owns and approves. It runs on new builds ahead of Facility Ready, and on sites already operating. It never writes to, reconfigures or probes a live system.
For every device we sample, three things. Is it running what it should? Firmware and software versions match the approved list, and the program or settings match the approved release, with no undocumented changes. Is it configured the way it was designed? Default and shared passwords are gone, unused services and ports are off, logging and time sync work, and it only talks to the systems the network design allows. Can only the right people and systems reach it? Named accounts only, no leftover commissioning or vendor access, and no hidden remote-access paths. We apply this to PLCs, HMIs, protection relays, OT switches, and the servers and domain controllers below the facility router, plus physical checks: locked cabinets, blocked unused ports, labels that match the drawings. The yardstick is IEC 62443. Where no device-level baseline exists, we help turn the standard into clear pass/fail criteria for each device type. The client owns and approves those criteria before we verify against them.
Both. Before go-live, on new builds: at startup (L3 / Blue Tag) we record each device's as-installed security state the moment it is first powered; during functional testing (L4 / Green Tag) we confirm the controls actually work while systems run together; before Facility Ready, any serious issue has to be fixed and re-checked. After go-live, on operating sites: the same checks, done inside the site's approved maintenance and change windows. Either way, nothing is written to, reconfigured or actively probed on a live system. On verification engagements, nothing is ever run against a live controller: read-only, passive and offline methods only.
Findings as they happen, logged directly in the client's commissioning platform, each naming the device, severity, requirement breached, responsible contractor, and attached evidence. Serious issues raised immediately: critical and high findings go to the client's quality team as potential blockers to Facility Ready, and we re-check the fix before recommending closure. Weekly status: what has been checked against the sampling plan, what is open, and any schedule risk. A closeout package per site: the verified baseline, every finding and its resolution, and tamper-evident evidence such as hashed configuration files and time-stamped photos. The client can hand it to auditors or use it with a contractor without needing us in the room.
OT cyber assessment
Network design and architecture review, passive asset discovery, and control gap analysis, delivered as a written report with risk-ranked findings. Most engagements start here, because most plants do not have a current list of what is on the network. The inventory itself is usually the finding that changes the conversation.
Discovery is passive throughout. We read the traffic the network already carries rather than probing devices, so nothing we do can interrupt the process. The report names the gap, the fix, and the effort — so it can be taken to a budget meeting rather than filed.
- Flat network between business and plant floorSegmentation
- Vendor VPN with a shared accountRemote access
- Engineering workstation with local adminPrivilege
- Historian reachable from the corporate LANExposure
- No asset inventory older than the last auditGovernance
Risk-ranked, with the fix and the effort beside each one.
OT incident response
Investigation, containment and recovery inside OT. A retainer pre-clears the contract and shortens the call-out, which is the part people underestimate: on the day it happens, the delay is rarely technical. It is procurement, scope and an NDA being negotiated while the plant sits idle.
Containment inside OT is also a different judgement call. Isolating a host in an office is free. Isolating a historian mid-batch is not, and someone has to weigh that against the process in real time.
The retainer is what removes the procurement delay from the worst day.
OT tabletop exercises
Simulated drills against the scenarios that actually reach plant environments, in standard or custom formats, closing with an after-action report.
- Ransomware reaching the plant floor. The business network is encrypted and nobody can say whether the plant is safe to keep running. The decision is who makes that call, on what evidence, and how fast.
- Insider and contractor access. An engineer or a vendor with legitimate credentials does something they should not. Most plants find they cannot tell the difference between that and normal work.
- Supply chain compromise. An integrator's remote access is the way in. The drill usually reveals nobody has a current list of who holds that access.
- Custom scenarios. Built around your own architecture and the incident your team already worries about.
- Active testing. Active testing is performed only in labs or isolated test systems, never on energized production, and never as part of a verification engagement.
IEC 62443 and NERC CIP
IEC 62443 is the framework most industrial environments are measured against, and NERC CIP applies if you are in the bulk electric system. Both ask for the same foundations in different language: know what you own, segment it, control who reaches it remotely, review privileged accounts, and be able to show an incident was handled.
We map your controls to the framework, close the gaps we find, and assemble the evidence. The certificate comes from your assessor, not from us. If NERC CIP is your driver specifically, the energy and utilities page covers that programme in more detail.
| Control | Evidence | State | |
|---|---|---|---|
| Asset inventory maintained | IEC 62443-2-1 | Ready | |
| Zones and conduits defined | IEC 62443-3-2 | Gap | |
| Remote access brokered and logged | NERC CIP-005 | Gap | |
| Privileged accounts reviewed | NERC CIP-004 | Ready | |
| Patch and vulnerability process | IEC 62443-2-3 | Open | |
| Incident response tested | NERC CIP-008 | Gap |
Placeholder values. We close the gaps; the certificate comes from your assessor, not from us.
Industries we secure OT in
- Manufacturing and food and beverage. Production lines, batch processes, and the historians that prove what was made when.
- Energy, oil and gas, and water and wastewater. Distributed sites, remote access as the default, and NERC CIP or state regulators in the background.
- Data centers and building automation. Power, cooling and access control, all of it networked and rarely inventoried.
- Chemical and pharmaceuticals. Safety instrumented systems and validated environments, where change control is already strict and security has to work inside it.
- Electric and public sector. Substations, municipal utilities and the shared-service arrangements around them.
Independent of the platforms we verify
We do not resell, implement or take commission on OT security platforms. We hold no partnership or reseller agreement with any OT vendor. When we verify, we sell nothing: we license, deploy and operate nothing in the environment we verify, and bid no remediation on assets we have verified.
That matters because a verification is only worth something if the people doing it have nothing to sell you afterwards. What we sell in OT is the assessment, the exercises and the response retainer — none of which depend on which platform you end up choosing.
If you are running a commissioning or acceptance process and need the verification done by someone with no stake in the outcome, that is the work we are built for.
Common questions about OT security
No. Discovery is passive — we watch traffic rather than probe devices. Anything active is agreed in writing first and run in a window the plant has approved. The default assumption is that a controller cannot be touched.
Usually you do not need a separate provider so much as OT-specific competence. The failure mode we see is an IT team applying IT judgement to a plant: scanning a subnet that includes PLCs, or isolating a host mid-process. If your current provider has OT experience, use them. If the answer is vague, that is the gap.
An assessment, because almost nobody has a current asset inventory. Until you know what is on the network and how it is reachable, every other decision is guesswork.
No. We do not resell, implement or take commission on OT platforms, and we hold no vendor agreements. If a platform is the right answer for you, we will say so — we just are not the ones selling it.
We get you ready for it and assemble the evidence. Certification comes from an accredited assessor. Anyone offering to both prepare and certify you is worth a question.
Start with what is actually on the network
A 30-minute review of your OT estate and privileged access with a certified engineer. You get the findings in writing, with no obligation. If the answer is that your current arrangements are sound, that is what the findings will say.
Find out what is reachable from your business network
A free consultation covers what you run on the plant floor, how it connects to everything else, and where the gaps are. Findings in writing, no obligation.