Choose an IEC 62443-3-2 assessor who can understand your industrial process, apply the assessment method and explain the resulting engineering requirements. That may be an internal team, an external specialist or a combination. Ask who will do the work and what they need from your operations and engineering teams.
Look for industrial understanding
An industrial control system (ICS) controls or supervises physical processes. Its cybersecurity assessment therefore needs more than a list of software vulnerabilities. A concern that appears minor in an office environment may affect control, visibility or recovery at a plant.
Ask a bidder to explain one proposed deliverable in detail. Could your engineer trace a risk-register entry back to the affected function, relevant access route and treatment action? That tells you more about the proposed work than a list of qualifications alone.
Ask a prospective assessor how they will understand the process, operating modes and dependencies before evaluating risk. They should be able to explain what information they need from operations and engineering, and when safety expertise or supplier input will be necessary.
For an asset owner, this helps establish whether the assessment will reflect the installed plant. For an integrator, it helps determine whether the work will inform design requirements while there is still time to act on them.
Understand what the standard is being used to achieve
The published IEC 62443-3-2 scope covers defining the system under consideration, zones and conduits, risk assessment, target security levels and documented security requirements. The assessment needs a clear relationship between these activities and the engineering decisions being made.
Ask how the proposed team will establish boundaries, examine interfaces and document uncertainty. A report that assigns scores without explaining the scenarios or assumptions can be difficult to use when deciding what to change.
The assessor should also distinguish between recommendations and decisions reserved for your organisation. External advice supports risk management; it does not transfer ownership of operational decisions to the consultant.
Ask about the work, not just the credentials
Useful questions when comparing proposals include:
- Who will actually perform and review the assessment?
- What relevant industrial experience can they substantiate?
- How will they involve operations, engineering, IT and suppliers?
- What evidence will they examine, and what will remain unverified?
- How will findings become requirements and accountable actions?
- What is excluded from the engagement?
Request a description of the deliverables and, where available, a suitably sanitised example of their format. You are looking for a usable engineering record, with enough reasoning to support subsequent design and review.
Agree how the assessment will interact with live systems
A risk assessment is not automatically a penetration test. Interviews, document review and agreed site observations can establish important facts without attempting exploitation or changing configurations.
Any proposed discovery or testing activity needs separate consideration of authorisation, equipment suitability and operational constraints. Do not assume that a tool used successfully on business networks is appropriate for a live control system.
Suppose you are replacing a SCADA server but keeping the existing engineering workstation and supplier connection. Ask the assessor how those retained interfaces enter the assessment. A server-only review will leave that question unanswered.
If you are still establishing which requirements apply, a readiness review may provide a more useful starting point.
Who will actually carry out the assessment, and what will your team need to provide? We can help define that brief. Choose a suitable risk-assessment starting point with the plant and project stage.
