OT and ICS Security Checklist for Energy Operators
When the SANS and Dragos teams analysed the 2016 Industroyer attack on the Ukrainian grid, the lesson was not that the malware was unstoppable, but that the basics were missing: flat networks, unmanaged remote access and no monitoring of control traffic. Most OT compromises exploit gaps that a disciplined checklist would have closed. This guide turns the fundamentals of OT and ICS defence into a sequence energy operators can actually work through, from asset inventory to incident response.
Dragos consistently reports that the majority of OT environments it assesses have limited or no visibility into their own control-network traffic.
Step 1: Build a Complete Asset Inventory
You cannot defend or segment what you have not catalogued, so the checklist begins with a full inventory of every OT and ICS asset. Use passive discovery first to avoid disturbing fragile devices, then reconcile against engineering records. Capture firmware versions and end-of-life status, because that data drives almost every later decision about patching and risk.
- Passively discover every PLC, RTU, HMI and SCADA server
- Record make, model, firmware version and support status
- Map each asset to its Purdue level and physical location
- Flag legacy and end-of-life devices for compensating controls
Step 2: Segment OT From IT
Segmentation is the single highest-value control, so it comes early. Establish an industrial DMZ so no enterprise system talks directly to a control device, then enforce default-deny rules between Purdue zones and micro-segment between sites. The goal is that an IT compromise stays in IT and a single breached site cannot spread laterally across the estate.
- Stand up an industrial DMZ between OT and corporate IT
- Apply default-deny firewall rules between Purdue zones
- Micro-segment between substations, sites or generation units
- Use data diodes where only outbound monitoring data is needed
Step 3: Lock Down Remote Access
Remote access is the most common foothold, so every path in must be controlled. Remove direct internet exposure of control systems, route engineers and vendors through MFA-protected, session-recorded jump hosts, and grant access on a time-bound, least-privilege basis. Vendor maintenance windows should be opened deliberately and closed again, never left standing.
- Eliminate any direct internet exposure of OT devices
- Force all remote access through MFA jump hosts with session recording
- Grant time-bound, least-privilege access to engineers and vendors
- Audit and close standing vendor connections
Step 4: Manage Patching and Vulnerabilities
OT cannot follow IT patch cadences, so the checklist treats vulnerability management as a risk-prioritised exercise. Subscribe to vendor and ICS-CERT advisories, prioritise patches by exploitability and exposure, and apply them in planned maintenance windows after testing. Where a device cannot be patched, document a compensating control such as tighter segmentation or virtual patching at the firewall.
- Track ICS-CERT and vendor advisories for your asset base
- Prioritise by exploitability and network exposure, not just CVSS
- Test and apply patches in planned maintenance windows
- Use virtual patching and segmentation where devices cannot be updated
Step 5: Monitor and Prepare to Respond
Detection closes the loop. Deploy monitoring that understands industrial protocols so anomalous commands and unexpected connections are visible, and feed that telemetry to a team that can act on it around the clock. Pair monitoring with an OT-specific incident-response plan that has been rehearsed, because a generic IT runbook will not tell an operator how to recover a control system safely.
- Deploy protocol-aware OT monitoring for anomalous commands
- Route telemetry to a 24/7 detection and response capability
- Maintain an OT-specific, rehearsed incident-response plan
- Keep offline, tested backups of control configurations and logic
How Kyanite Blue and Sophos Deliver the Checklist
Kyanite Blue works through this checklist with energy operators as a programme, not a one-off audit. We run passive discovery, design and deploy Purdue-aligned segmentation on Sophos firewalls, harden remote access with MFA jump hosts, and run managed monitoring that watches OT traffic for anomalies. Sophos deep-learning detection and our 24/7 response team turn the final two steps from intentions into an operating capability, with the evidence trail your competent authority expects.
Frequently Asked Questions
What is the most important item on an OT security checklist?
Asset inventory and segmentation rank highest, because they enable everything else. You cannot protect, patch or monitor assets you have not catalogued, and segmentation is the control that turns an IT incident into a contained event rather than a grid-wide one.
How do you patch OT systems that cannot be taken offline?
Prioritise patches by real-world exploitability and exposure, apply them in planned maintenance windows after testing, and where a device cannot be updated, deploy compensating controls such as tighter segmentation or virtual patching at the firewall.
Why do energy operators need OT-specific incident response?
A generic IT runbook does not account for safe shutdown, restoration of control logic or the safety implications of an OT outage. An OT-specific, rehearsed plan ensures responders know how to contain an incident without endangering operations or supply.
Get help working through your OT security checklist
Kyanite Blue specialises in cybersecurity for iGaming operators. MGA-licensed operators across Malta trust our stack.
Get in touchReady to secure your iGaming operation?
MGA-licensed operators across Malta trust Kyanite Blue.