OT Security Readiness: Inventory, Boundaries and Rules Before Testing

Global Digital Forensics checklist. Edition 2026-11-03, November 3, 2026. 24/7 hotline (800) 868-8189.

A control network tested like an office network can trip a plant, and a control network has to be inventoried before it can be defended or audited. This checklist is what plant engineering, network and compliance assemble before any sensor is connected.

Why the Inventory and the Stop Condition Come Before Any Capture

Operational technology assessments fail in two opposite ways. The first is the assessment that stalls, because the plant manager rightly refused to let a scanner near a thirty year old controller and nobody proposed a passive method instead. The second is the assessment done badly, where an active probe flooded a fragile network stack, froze a human machine interface or tripped a process. Both trace to the same missing preparation. The inventory tells everyone which assets are off limits, and a signed stop condition with a named engineer who can halt the work lets the team act when something unexpected happens.

The inventory is the foundation of the compliance file as well as the engineering work. NERC CIP-002 requires bulk electric system entities to identify and categorize their BES Cyber Systems before the later CIP standards apply. Community water systems completing risk and resilience assessments under AWIA Section 2013 must assess their electronic and automated systems, which presupposes knowing what they are. NIST SP 800-82 Revision 3 places asset management at the base of an OT security program. A controller nobody listed is a controller nobody patches, monitors or reports.

The Order of Readiness, From Drawings to Signed Rules

Begin with the controlled drawings, project files, maintenance and configuration records and the knowledge of the people who run the plant, noting the source and date of each. Map the zones, conduits, enterprise connections, safety functions and dependencies with a model that fits the facility; the Purdue model is one useful reference. Operations, engineering and vendor owners rate each asset’s criticality and record which methods are permitted and which are prohibited, with the reason for each exclusion.

Before any equipment is connected or any traffic is sent, write down the activity, the exact target, the method, the operator, the rate, the window, the operating state, the prerequisites and the stop conditions. Installing a SPAN port, a tap or a sensor is operational work that needs approval like any other change. Record what the capture can see, any packet loss and the segments outside its view. Name who can stop the work, who can authorize resuming it, how they will be reached and who handles recovery. Use a lab, a replica, an offline configuration review or a planned maintenance window where they answer the question safely.

Who Owns the Process, Who Owns the Network and Who Can Halt the Work

The operations owner controls access to the process and its operating constraints. Engineering confirms functions, dependencies and vendor limits. Network and security owners explain configurations and access routes. Compliance supplies the criteria that apply. The assessor proposes methods within that scope and records what was done. Whether an active technique is safe depends on the asset and the process, on either side of the boundary.

For each activity, name an operating role and a backup with immediate authority to stop it, reachable on a channel independent of the people under pressure to finish. The same named role approves resuming the work. Every technique stays within the approved plan, and every deviation is recorded.

The Mistakes That Trip a Plant or Blind the Assessment

Active traffic can destabilize a controller, an interface or a process. Choose techniques from the actual asset, process, vendor and safety constraints. Existing telemetry, offline review of configurations and logic, and controlled walkdowns often answer the question without touching production. Any active validation that is justified gets exact targets, methods, limits, windows, engineering permission, stop conditions and recovery prerequisites.

The mistakes that blind the assessment are quieter. A capture from a single core switch misses serial links, VLANs without a mirror, unmanaged switches and devices behind protocol gateways, so the inventory comes with a coverage map that shows which segments were seen. Reconcile any spreadsheet baseline against project files and a cabinet walkdown, so the baseline is checked against years of field replacements. Agree the goal first, whether a first picture of the boundary, validation of a segmentation project or evidence for a specific submission, so the engagement is built around that question.

How GDF Supports Plant Engineering, Security Leads and Compliance Teams

Global Digital Forensics has performed security assessments and forensic examinations since 1992. OT work is planned with the operations and engineering owners around physical safety, dependencies and the real architecture, using existing telemetry, offline configuration and logic review, site walkdowns and specifically approved active validation. The report states what was examined, over which period and with what visibility.

Findings are written for the mandate that governs the plant as well as for the engineering team, expressed as the gap between the protection a zone has and the protection its risk requires in ISA/IEC 62443 terms, and mapped to the CIP standard, AWIA assessment or Coast Guard requirement the compliance lead must answer. Where an incident has already occurred, the same examiners preserve and analyze the record under the direction of counsel. Our clients include Fortune 1000 companies, and the initial consultation is free. If a submission is approaching and the inventory is a spreadsheet nobody trusts, call (800) 868-8189 and a senior assessor will work through these items with your plant engineer on the first call.

Activity authorization and execution record

For each activity, record its purpose and criterion, the asset or function, the architecture and dependencies, the population and period, the permitted and prohibited methods, the limits, the access route, the tool and version, the operator, the window, the prerequisites, the approvals, who can stop and resume it and the recovery contact. Afterward, record the actual times, changes, deviations, observations, evidence IDs and reviewer.

Keep observed communication, configured permission and tested behavior in separate columns, and list the segments and operating states outside the observation so they stay visible in the report.

The Checklist at a Glance

The same rows are in ot_security_readiness_checklist_workbook.csv, with columns for the owner, the date, notes, status, the evidence ID and the next action.

Sources