How to prepare for an OT cybersecurity assessment

Preparation should make the assessment boundary and evidence state visible before detailed review starts. Current drawings, asset records, support routes and operational constraints allow the assessment to examine risk instead of spending most of its time reconstructing the site history.

Do not delay the work until every record is complete. Mark what is confirmed, inferred, obsolete or unknown; uncertainty is useful assessment evidence when it is stated honestly.

Write down the decision the assessment must support. A baseline review of an operating site, a project risk assessment and a requirement-by-requirement IEC 62443 gap assessment need different inputs and outputs.

Also record the applicable standard, regulatory or client context. This prevents a general framework review from being mistaken for a detailed compliance decision.

Drawings are usually the fastest route into understanding an OT environment, but only when they are current enough to be trusted.

The assessor does not need polished drawings at the start. Marked-up drawings are often more useful than issued drawings that no longer reflect reality.

The key is to show what is believed to be installed, what is confirmed, and what is uncertain.

Existing design, process and safety documentation should be used as an initial step towards creating a definitive OT system architecture record.

An OT asset record does not need to start as a complex database. A spreadsheet is often enough if it captures the right information.

Do not hide unknowns. Unknowns are useful because they show where further discovery is needed.

A weak asset register pretends everything is known. A strong asset register makes uncertainty visible.

Not every asset carries the same risk. Before the assessment, identify the systems that matter most to safe and reliable operation.

The assessment should focus first on systems where compromise could affect safety, production, availability, environmental protection or regulatory compliance.

This is where operational context matters. A flat network is a technical issue. A flat network containing safety systems, compressor controls and remote vendor access is a business risk.

Remote access is one of the most important areas to prepare. A good assessment needs to know the access path, authentication method, approval process, reachable assets and monitoring arrangements.

Remote access should never be described only as the vendor logs in. That is not enough.

Cybersecurity controls in OT cannot be assessed properly without understanding how the site operates.

This prevents unrealistic recommendations. For example, patch all systems monthly may be normal in IT but unrealistic in an OT environment with validated systems, outage constraints, vendor dependencies and safety assurance requirements.

The better question is: what is the current patching constraint, what compensating controls exist, and what practical improvement is possible?

The assessment should not only find gaps. It should also recognise what is already in place.

This evidence helps separate undocumented controls from missing controls.

A control that exists but is not documented may still reduce risk, but it is harder to rely on. A control that is documented but not implemented is worse.

Most OT environments contain legacy assets. That is not automatically a failure. The issue is whether the risk is understood and managed.

The assessment should not simply produce a list of old equipment. It should explain what those systems mean for risk, resilience and future investment.

A short internal walkdown before the assessment is valuable.

This avoids the common problem where the assessment begins with a drawing review and ends with the discovery that the real system has changed significantly.

Before the assessment starts, assemble a simple pack. Include a short readme explaining what documents are current, what documents are historical, what is missing, what is uncertain, and who owns each information area.

This saves time and gives the assessor confidence that the site is organised, even where gaps exist.

Before the assessment begins, agree what the output should contain.

Avoid outputs that only list generic best practice. A useful OT cybersecurity assessment should explain what matters for that specific site, why it matters, and what should be done next.

The value of preparation is not paperwork. It is clarity.

A well-prepared OT cybersecurity assessment helps answer four basic questions: what do we have, how is it connected, who can access it, and what could realistically go wrong?

When drawings, asset records, remote access information and operational context are prepared in advance, the assessment becomes sharper, faster and more valuable.

The best outcome is not a perfect report. The best outcome is a defensible understanding of the OT environment and a practical route to reducing risk.