How to prepare for an OT cybersecurity assessment

An OT cybersecurity assessment should not begin with someone trying to work out what the site actually contains.

Too often, assessment time is lost to basic discovery: hunting for drawings, checking whether network diagrams match reality, asking who owns remote access routes, or trying to understand why two systems that look separate on paper are connected in the field.

Good preparation changes the quality of the assessment. It helps the assessor focus on risk, architecture, exposure, resilience and practical improvement rather than spending most of the time rebuilding the site history from fragments.

The aim is not to make everything perfect before the assessment. The aim is to make the OT environment understandable.

Before gathering documents, be clear on what the assessment is trying to prove.

Typical objectives include understanding the current OT architecture, identifying exposed or poorly controlled connections, reviewing remote access arrangements, checking asset visibility and ownership, assessing segmentation between systems, reviewing alignment with standards such as IEC 62443, and preparing for regulatory, client or internal assurance requirements.

IEC 62443 is widely used for industrial automation and control systems because it provides a structured way to assess cybersecurity performance across people, process and technology.

For UK critical sectors, the NCSC Cyber Assessment Framework is also relevant because it helps organisations assess and improve cyber resilience, particularly where essential services are involved.

The best assessments are not treated as audits to get through. They are treated as a structured way to understand operational risk.

Drawings are usually the fastest route into understanding an OT environment, but only when they are current enough to be trusted.

The assessor does not need polished drawings at the start. Marked-up drawings are often more useful than issued drawings that no longer reflect reality.

The key is to show what is believed to be installed, what is confirmed, and what is uncertain.

Existing design, process and safety documentation should be used as an initial step towards creating a definitive OT system architecture record.

An OT asset record does not need to start as a complex database. A spreadsheet is often enough if it captures the right information.

Do not hide unknowns. Unknowns are useful because they show where further discovery is needed.

A weak asset register pretends everything is known. A strong asset register makes uncertainty visible.

Not every asset carries the same risk. Before the assessment, identify the systems that matter most to safe and reliable operation.

The assessment should focus first on systems where compromise could affect safety, production, availability, environmental protection or regulatory compliance.

This is where operational context matters. A flat network is a technical issue. A flat network containing safety systems, compressor controls and remote vendor access is a business risk.

Remote access is one of the most important areas to prepare. A good assessment needs to know the access path, authentication method, approval process, reachable assets and monitoring arrangements.

Remote access should never be described only as the vendor logs in. That is not enough.

Cybersecurity controls in OT cannot be assessed properly without understanding how the site operates.

This prevents unrealistic recommendations. For example, patch all systems monthly may be normal in IT but unrealistic in an OT environment with validated systems, outage constraints, vendor dependencies and safety assurance requirements.

The better question is: what is the current patching constraint, what compensating controls exist, and what practical improvement is possible?

The assessment should not only find gaps. It should also recognise what is already in place.

This evidence helps separate undocumented controls from missing controls.

A control that exists but is not documented may still reduce risk, but it is harder to rely on. A control that is documented but not implemented is worse.

Most OT environments contain legacy assets. That is not automatically a failure. The issue is whether the risk is understood and managed.

The assessment should not simply produce a list of old equipment. It should explain what those systems mean for risk, resilience and future investment.

A short internal walkdown before the assessment is valuable.

This avoids the common problem where the assessment begins with a drawing review and ends with the discovery that the real system has changed significantly.

Before the assessment starts, assemble a simple pack. Include a short readme explaining what documents are current, what documents are historical, what is missing, what is uncertain, and who owns each information area.

This saves time and gives the assessor confidence that the site is organised, even where gaps exist.

Before the assessment begins, agree what the output should contain.

Avoid outputs that only list generic best practice. A useful OT cybersecurity assessment should explain what matters for that specific site, why it matters, and what should be done next.

The value of preparation is not paperwork. It is clarity.

A well-prepared OT cybersecurity assessment helps answer four basic questions: what do we have, how is it connected, who can access it, and what could realistically go wrong?

When drawings, asset records, remote access information and operational context are prepared in advance, the assessment becomes sharper, faster and more valuable.

The best outcome is not a perfect report. The best outcome is a defensible understanding of the OT environment and a practical route to reducing risk.