Technical capability
Engineering Assurance
Independent review of supplier designs, FAT/SAT evidence, cybersecurity documentation, and project close-out evidence for control system delivery.
Where independent assurance adds value
The problem
Control system projects often require independent technical review to confirm that cybersecurity, network design, supplier assumptions, and control system requirements have been properly addressed.
Who it is for
- asset owners requiring independent scrutiny of supplier deliverables
- project managers preparing control systems for design gates, FAT, SAT, or handover
- integrators that need a clear route to close cybersecurity comments and evidence gaps
FAT should verify what can be demonstrated before installation. Site-dependent routes, operational interfaces and final access controls belong in SAT or commissioning, with the hand-off recorded rather than quietly omitted.
Review basis and supplier evidence
Inputs
- project requirements, specifications, assurance plans, and acceptance criteria
- supplier designs, calculations, configuration records, and test procedures
- the project programme, design maturity, responsibilities, and comment-resolution process
A review tied to project gates
- independent review of one PLC and SCADA package through design and test stages
- architecture, access control, backup, hardening, and cybersecurity test evidence
- comment tracking through supplier response and project close-out
How comments are raised and closed
Sequence
- establish the review basis, evidence expectations, interfaces, and decision points
- review supplier submissions for completeness, consistency, and technical justification
- record proportionate comments with clear owners and closure evidence
- report unresolved assumptions, exceptions, and residual concerns before acceptance
Assurance checks
- trace project requirements into supplier design responses
- review architecture, account, hardening, backup and remote-access submissions
- decide which requirements can be demonstrated at FAT and which depend on the installed site
- record comments with a technical basis, owner and required closure evidence
- carry unresolved assumptions and deviations into SAT, commissioning or handover
Evidence for project decisions
Deliverables
- requirements and evidence review matrix
- design review comments with closure criteria
- FAT and SAT cybersecurity test observations
- assumptions, deviations and outstanding-actions register
- close-out evidence review and acceptance briefing
Worked example: Verifying individually attributable remote access at FAT
- Requirement
- Remote engineering access must use individually attributable accounts with role-based permissions and retained security logs.
- FAT check
- Create representative users, verify role assignment and account disablement, exercise the available connection path and confirm the expected events are logged.
- Evidence retained
- Keep the approved test record, relevant configuration extract, log sample and any agreed exception. A screenshot without the test context is not sufficient on its own.
- SAT follow-up
- Confirm that the installed remote-access route, identity source, time synchronisation and log destination match the tested design.
Responsibility remains with the project
Not included unless separately agreed
- taking the designer's responsibility or approving work on the client's behalf
- witnessing every test or independently recreating all supplier calculations
- certification of the system or supplier
Standards and guidance referenced
Related support and guidance
Related services
Choose this when your project needs specialist engineering capacity. A defined OT cybersecurity work package for risk, architecture, design review, supplier interfaces and assurance evidence within an active industrial project.
Discuss engineering assurance
Use the 30-minute introductory call to outline the system, decision, project stage and evidence currently available. Keep sensitive site details out of the booking form.