The Decision Operators Face When a Regulator or Insurer Asks for Evidence
Plant managers, utility security leads and the auditors who review them face a choice that IT teams do not. A corporate network can be scanned on a Tuesday afternoon and the worst outcome is a slow file server. A programmable logic controller that receives an unexpected packet can fault, and a faulted controller on a water treatment line, a substation or a vessel is a safety event rather than a finding. Yet regulators, insurers and boards now ask the same questions of the plant floor that they ask of the data center: what assets exist, where the IT and OT boundaries are, whether vendor remote access is controlled and whether any of it has been tested. The decision is how to produce that evidence without the test itself becoming the incident, and it is a decision the plant must make with its engineers in full control.
The three guides in this topic are a single methodology read in three parts. Every OT engagement GDF performs starts passively, listening to a SPAN or tap during normal operation and walking the floor with the control engineer, because the inventory that results is the foundation of every later judgment about segmentation and risk. Active work, where it is needed at all, is scheduled into existing maintenance windows under rules of engagement the plant signs, with controller specific testing performed on a test bed or spare hardware rather than on the running process. Findings are written against the standards the operator is actually judged by, from NERC CIP and the state utility rules to IEC 62443 and the sector guidance, so that the deliverable serves the auditor as well as the engineer.
How to Read These Guides and in What Order
Read the scoping guide first. It explains why standard IT penetration testing can trip a plant or halt a vessel, describes the safety first methodology built with plant engineers in control, and sets out the rules of engagement the plant signs before anything touches the network. It also names the people who should be in the scoping conversation, from the plant manager and the control engineer to the network lead and the corporate security lead responsible for mandate mapping. Everything in the other two guides assumes that conversation has happened and that the plant's risk tolerance and production calendar govern the work.
The passive first asset discovery guide comes second, because an operator cannot defend or patch controllers it does not know exist and because every regulator starts with the inventory. It explains how passive SPAN telemetry is combined with engineering walkdowns, how coverage and confidence are reported so blind spots are visible, and who keeps the inventory current after the engagement ends. The segmentation validation guide closes the sequence with the boundaries between IT and OT, between sites, and between the plant and its vendors. It describes why CAD diagrams rarely match the live floor, what firewall exports prove and what packet captures add, and how a multi site program receives an enterprise rollup comparing boundary posture across plants and substations.
What GDF Does for Operators, Utilities and Their Auditors
Global Digital Forensics performs critical infrastructure and OT security work as part of a practice that has operated since 1992, bringing the same evidence discipline to the plant floor that it brings to the courtroom. The engagement forms are OT asset discovery, network segmentation validation, OT, ICS and SCADA security assessments and SCADA security testing, with sector specific assessments for power and energy, water and wastewater, maritime and manufacturing operators. Each produces a deliverable the operator owns, written in the vocabulary of the standard the operator is audited against, with an owner and an update cadence named in the report because an inventory or a boundary map without a keeper decays quickly.
For auditors and regulators the value of that approach is traceability. A finding states the evidence behind it, whether a passive capture, a configuration export, a walkdown observation or a controlled test result, and the report separates what was observed from what was inferred. For internal security teams the deliverable becomes the asset basis for continuous passive monitoring and the baseline for the next assessment. When an OT incident occurs, the same examiners provide OT, ICS and SCADA incident response and OT forensics, and the inventory and boundary map built in advance are what make it possible to scope the event quickly. Our examiners have testified in federal and state courts, and that experience shapes how every OT finding is documented.
How to Begin
The initial consultation is free. Call (800) 868-8189 or request a consultation online, and ask for the OT practice. On the first call we want to know the sector and the mandates that apply, how many sites and how many control networks are in scope, whether a SPAN or tap can be provided on each, when the next maintenance windows fall, whether any prior inventory or network diagram exists and whether the deliverable has to satisfy a specific auditor, regulator or insurer. From those facts we propose a scope that starts passively and names any active phase separately, so the plant can approve each step on its own terms.
Before the call, the OT assessment planning library collects the preparation checklists, deliverable descriptions and sector manuals that explain what an assessment produces for power and energy, water and wastewater, maritime and manufacturing operators. The OT workbook builder lets an operator assemble the asset, boundary and mandate information an assessment begins from, and the New York utility audit builder does the same for operators under that state's rules. Bringing whatever exists, even an incomplete spreadsheet of controllers or an outdated diagram, shortens the passive phase because the examiner knows what to reconcile against.