Checklist | 5 min read
FAT and SAT cybersecurity evidence checklist
FAT and SAT cybersecurity evidence should connect each applicable requirement to a check, an expected result and a retained record. Separate what can be demonstrated at the factory from what needs the installed system.
Plan factory and site evidence separately
| Stage | Example check | Evidence and limits |
|---|---|---|
| Before FAT | Agree requirements, supplier responsibilities, test methods and expected results. | A traceability matrix and approved test plan; identify simulations and excluded interfaces. |
| FAT | Review agreed account roles, hardening, backup arrangements and representative communication restrictions. | Configuration baseline, results and evidence references; factory tests may not represent site connectivity. |
| SAT | Review installed interfaces, approved support access and site-dependent recovery checks. | Installed configuration and results; agree safe methods and operational constraints before testing. |
| Handover | Review failed, deferred and untested requirements with the receiving team. | Deviation/action records, owners, due stages and acceptance decisions; do not mark an unperformed test as passed. |
Evidence gap and common mistakes
A supplier demonstrates restoration of a controller application at FAT, while historian data and site engineering workstation recovery remain outside that setup. Retain the FAT result with its scope and plan the remaining demonstration under agreed site conditions.
A screenshot without configuration identity, acceptance criteria or a requirement reference is difficult to review. Avoid replacing test results with a generic pass statement, treating FAT as evidence for every site interface, or closing an action without an accountable decision.
Test coverage depends on the agreed system and requirements. This checklist is preparation guidance, not certification or proof of compliance, and does not authorise intrusive testing on operational systems.
Make cybersecurity testable
Cybersecurity requirements are often difficult to close because they are written too generally or introduced late in the project. FAT and SAT evidence should show what was checked, what was not checked and which assumptions remain open.
The checklist should be linked to project requirements, supplier responsibilities and operational handover needs.
Typical evidence areas
The exact checklist depends on the system, but most control system projects need evidence around architecture, account management, hardening, backup, remote access and communication paths.
Useful evidence
- approved network architecture and interface list
- user and administrator account evidence
- remote access design and approval route
- backup and recovery test evidence
- open action and residual risk register
Related support and guidance
Where this connects to project work
If the issue described here forms part of a wider assessment or engineering programme, Meridian's engineering assurance covers the scope, evidence and technical decisions needed for a defined engagement.