Settle These OT Questions Before Field Work Starts

What the OT Planning Set Covers

The set is built for the sponsor and project manager who have to turn an assessment request into a scope an operator can approve. It holds four sector manuals, for water and wastewater, power and energy, manufacturing and transportation, each of which separates binding duties from official guidance, drafts and expired references so each planning note reads as planning and each legal clock as law. Beside them sits the state and local research companion, with a starting authority for every state and a method for the local permits, contracts and emergency arrangements that each facility settles from its own records.

The project workbook carries the same structure into execution. Every procedure row asks for the criterion tested, the population, the review period, the sampling rationale, the permitted method, the observation, the evidence reference and the reviewer, which is the order an auditor reads them in. The operating, technical and compliance owners sign the approval fields, so the file shows what was reviewed and by whom.

Rule and Facility Questions to Close First

Start with federal reporting. Confirm whether the CIRCIA reporting rule is final and in effect for your entity by reading the current Federal Register text and CISA's implementing instructions, and keep any existing sector reporting duties on their own clocks while that answer is put in writing. Rail, transit and pipeline operators should take their TSA security directives and approved plans from their own security official through the authorized handling process, because the security official holds the current versions and the operator's approved alternatives, while public copies carry fixed expiration dates.

Power companies need the NERC CIP requirement versions, implementation dates, registered functions and BES categorization frozen for the review period with the compliance owner. Defense manufacturers should confirm the current CMMC implementation direction and what the contracting officer requires for each award, apart from the safeguarding clauses already in the contract. Aviation operators bring the approved airport or aircraft security program and the airworthiness conditions that apply, such as DO-326A/ED-202A or EASA Part-IS, straight from the operator's own records.

Then the facility facts. The state profiles point to where the rule lives, so confirm the controlling state text and current agency instructions for each site, along with the facility list, permits, leases, grants, insurer terms, ownership and any local operating agreements. Where an ISA/IEC 62443 conformity claim, a safety system approval or a quality release is in play, identify the edition and the specialist who owns it before the assessment criteria are agreed.

Bring the Open Questions to a Senior Assessor

Global Digital Forensics has supported operators and security teams since 1992. On the first call a senior assessor reviews your facilities, sectors and states, marks which of these questions are still open, and recommends a scope, safe methods and a stop authority that fit your operating windows. The initial consultation is free. Scope your assessment or call (800) 868-8189.

To work through the questions on your own first, download the manuals and workbook from the OT assessment planning library. Our field approach is described under OT, ICS and SCADA Security Assessments.