Representative engagement
Recovering the Cybersecurity Baseline for a Legacy SCADA System
A representative legacy-SCADA engagement where incomplete records prevent confident risk, architecture and change decisions.
Client profile
Production facility operator
Client situation
A production facility had an established SCADA and PLC environment that had undergone numerous modifications over its operational life. The system continued to perform its intended function, but drawings and asset information had not consistently kept pace with changes. Engineers therefore had limited confidence that the available documentation represented the installed system. That uncertainty had become a cybersecurity problem: without a reliable understanding of assets, interfaces and network paths, the organisation could not confidently assess risk, define security zones or determine whether proposed changes would introduce unintended connectivity.
The engagement
What the client needed
- establish which architecture and asset records can be trusted
- identify unknown communication paths and undocumented interfaces
- separate confirmed information from engineering inference
- clarify ownership and support dependencies around legacy assets
- create a defensible baseline for risk assessment, segmentation and future design
How Meridian would approach it
- reconcile drawings, PLC and SCADA information, configuration exports, switch data, backups and change records
- resolve naming, ownership and interface conflicts with site and support teams
- classify information explicitly as confirmed, inferred or unresolved
- record evidence sources and dates so assumptions are visible rather than presented as fact
- issue a controlled architecture and asset baseline suitable for subsequent cybersecurity engineering
What the client would receive
- updated OT and SCADA architecture drawings
- asset register
- interface and communications register
- IP and network record
- unresolved-information and documentation-gap register
What this would enable
Client outcome
The client would receive an evidence-based architecture and asset baseline with unresolved items clearly identified, providing a defensible foundation for subsequent risk assessment, segmentation, maintenance and cybersecurity engineering.
Representative engagement: this scenario is based on common industrial requirements and shows how Meridian would approach the work. It is not presented as a completed client engagement.
From example to a defined engagement
Related services
Choose this when your project needs specialist engineering capacity. A defined OT cybersecurity work package for risk, architecture, design review, supplier interfaces and assurance evidence within an active industrial project.
Have a defined OT or IEC 62443 question?
Use the 30-minute introductory call to outline the system, decision, project stage and evidence currently available. Keep sensitive site details out of the booking form.