An OT cybersecurity risk assessment is priced around the system being assessed and the work needed to understand it. One control package with reliable drawings is a different assignment from a live processing site with several suppliers and undocumented connections. Before comparing fees, check that the proposals cover the same systems, activities and deliverables.
What are you asking the assessor to examine?
Start with the question the assessment needs to answer. Are you replacing a SCADA system, responding to a customer requirement or investigating risks across an existing plant? That purpose shapes the people, records and analysis needed.
These three scopes illustrate why quotations can differ:
| Assessment scope | Work that may be needed |
|---|---|
| One documented automation package | Review the package, its interfaces and the customer's requirements |
| An existing production area | Reconcile drawings, involve operations and investigate maintenance connections |
| Several interconnected sites | Review shared services, local differences and responsibilities across the estate |
These are scope comparisons, not price bands. Site attendance, supplier discussions and the condition of the records can change the effort within each category.
An asset count helps, but it is not a complete pricing basis. Twenty similar machines with consistent records may be easier to understand than a smaller installation whose support arrangements are unclear.
Check what the quotation includes
Ask for the system boundary, required inputs, assessment activities and outputs in writing. Depending on the assignment, you might need a risk register, documented assessment reasoning, security requirements and prioritised treatment actions.
Also check the practical commitments:
- Is site attendance included?
- Who obtains information from package suppliers?
- How many workshops and report reviews are allowed for?
- What happens if the drawings do not reflect the installation?
- Does the fee include reviewing responses to the findings?
These details make proposals easier to compare. They also identify work your team may need to provide.
A readiness review, gap assessment and risk assessment answer different questions. Readiness establishes a starting point; a gap assessment compares arrangements with agreed requirements; a risk assessment examines scenarios and consequences. A document review should not be priced or described as if it provides every one of those outputs.
Where BS EN IEC 62443-3-2 is the required basis, ask how the proposed work supports its system-design risk assessment purpose.
Give the consultant enough information to price the work
A useful first brief includes the site or package type, approximate system size, project stage, available drawings and required date. Explain the next decision: an investment approval, design review or customer submission, for example.
If you have no current drawings, say so. Reconstructing the network may be necessary before parts of the assessment can progress, and the proposal should explain how that will be handled.
Keep sensitive drawings and vulnerability details out of a public enquiry. We can agree how to share them once the requirement is understood. Our assessment preparation guide explains the records that can help.
At Meridian, we can define the assessment within an OT cybersecurity engineering work package. Bring the problem and the records you already have; we can help establish what needs doing before a proposal is prepared.
Ask us about an assessment quotation and tell us what you need the assessment to support.
