OT Security Assessment Checklist: Is Your Production Environment Protected?

OT Security Assessment Checklist

Work through the following assessment areas for your OT environment:

• Asset Inventory — do you have a complete inventory of all OT devices (PLCs, HMIs, SCADA servers, historians, engineering workstations) including OS version, firmware version, and network connectivity?
• Internet Exposure — are any OT devices or management interfaces directly accessible from the internet? (Use Shodan or Kyanite Blue's Hadrian assessment to check)
• Network Segmentation — is your OT network physically or logically isolated from your corporate IT network, with only specifically authorised traffic permitted between them?
• Remote Access — is all OEM and engineer remote access to OT systems channelled through a hardened jump server with MFA and session recording?
• Default Credentials — have default passwords been changed on all PLCs, HMIs, and network devices? Are there any hardcoded credentials in use?
• Patch Status — do you have a documented patch management process for OT systems? Are you aware of any unpatched critical vulnerabilities on production systems?
• OT Monitoring — do you have network monitoring in place that can detect anomalous behaviour in your production network (unusual commands, unexpected connections, lateral movement)?
• OT Backup — do you have tested backups of PLC programming, SCADA configurations, and historian data that would enable restoration after a ransomware attack?
• Incident Response — do you have a cyber incident response plan that specifically addresses OT incidents, including production safety decision-making and OEM engagement?
• Supplier Access — do you have documented controls on which OEM and maintenance suppliers can access your production systems, when, and from where?

Using Your Checklist Results

If you identified gaps in the checklist above — particularly internet exposure, absent network segmentation, or lack of OT monitoring — these represent the highest priority items for your OT security programme. Direct internet exposure of OT systems should be treated as a critical vulnerability and addressed immediately. IT-OT segmentation should be the first major project in any OT security programme. OT monitoring should follow once segmentation is in place. Kyanite Blue's Collective IP service provides OT security assessment and remediation support for manufacturing clients, using Hadrian for external exposure assessment and specialist OT security expertise for internal programme development.