Why the Inventory and the Stop Condition Come Before Any Capture
Operational technology assessments fail in two opposite ways. The first is the assessment that was never done, because the plant manager rightly refused to let a scanner anywhere near a thirty year old controller and nobody proposed a method that did not involve one. The second is the assessment that was done badly, where an active probe flooded a fragile network stack, froze a human machine interface or tripped a process. Both failures trace to the same missing preparation. Without an inventory, nobody can say which assets are off limits. Without a signed stop condition and a named engineer who can halt the work, nobody can act when something unexpected happens. Our guide to scoping OT security testing around operational risk describes the rules of engagement a plant signs before anything touches the network.
The inventory is the foundation for the compliance file as well as the engineering work. NERC CIP 002 requires bulk electric system operators to identify and categorize their cyber systems before any later standard applies. Community water systems completing risk and resilience assessments under AWIA Section 2013 must assess the risks to their electronic and automated systems, which presupposes knowing what they are. NIST SP 800 82 Revision 3 places asset management at the base of an OT security program. A controller nobody listed is a controller nobody patches, monitors or submits, and our guide to passive first asset discovery explains how the inventory is built from what the network actually shows and what the cabinets actually hold. The readiness items below are what the plant assembles so that work can begin safely.
The Order of Readiness, From Drawings to Signed Rules
Start with what the plant already has. The control engineer gathers the PLC project files, HMI tag databases, the existing asset spreadsheet and the maintenance records of field replacements, because the spreadsheet usually lists devices long since replaced. Network engineering produces the as built drawings, the switch inventory with mirror capability noted, the firewall and jump host configurations and the list of vendor remote access paths. From those, the engineering team and the security lead draw the zones and conduits, mark each asset's operational criticality and name the ones that are off limits to any active technique, beginning with safety instrumented systems, turbine and generator controls, chemical dosing and anything whose failure has a physical consequence.
With the picture drawn, the operational items follow. Operations identifies the maintenance windows in which any active work may occur and the operating modes the capture must cover, including startup, normal production, shift change and scheduled vendor maintenance. Network engineering identifies the SPAN or tap points that will see the most conduits and confirms each switch can mirror without affecting its own performance, noting unmanaged switches and serial segments as walkdown targets now rather than discovering the gap after the capture ends. The plant manager names the engineer who holds stop authority on the floor. Compliance maps the engagement to the mandate that governs it. All of that goes into a rules of engagement document that the plant manager, the control engineer and the corporate security lead sign together. Operators drafting one for the first time can begin with our OT audit workbook builder.
Who Owns the Process, Who Owns the Network and Who Can Halt the Work
The plant manager owns the process and the final word on what may be touched and when. The control engineer owns the asset classification and the project files. Network engineering owns the drawings, the switch configurations and the capture points. The corporate security lead owns the enterprise side of the boundary, the jump hosts, the firewalls and the vendor gateways where controlled active testing is appropriate, and coordinates with the plant rather than directing it. The compliance lead owns the mapping to CIP, AWIA, Coast Guard or other mandates and the submission calendar. The assessor owns the method within the limits the plant has approved in writing, and nothing more.
Stop authority belongs to one named person on the plant floor, reachable for every active step, who can halt the work without asking anyone. That person is not the assessor and not the corporate security lead, because the point of the role is that it answers to the process rather than to the engagement. The people who must not act are the ones outside the agreed plan. No corporate security engineer pushes a scan into a lower Purdue level because the capture looks quiet. No vendor technician makes an unrelated change during the window. No assessor extends a technique to a segment the rules did not include. Every deviation from the plan is recorded, and a change to the plan is signed the same way the plan was.
The Mistakes That Trip a Plant or Blind the Assessment
The mistake with physical consequences is the active probe in the wrong zone. A commercial vulnerability scanner pointed at a programmable logic controller, a remote terminal unit or a live Modbus segment can flood a network stack, freeze an HMI or cause an unscheduled shutdown. The method in lower levels is passive capture at SPAN ports and taps, offline review of firewall exports, switch configurations and PLC project files, and physical walkdowns during maintenance windows. Active techniques belong in the higher zones, on the enterprise side of the boundary, where the question is whether an intruder could cross into the industrial zone at all. A rules of engagement document that does not draw that line by Purdue level has not done its job.
The mistakes that blind the assessment are quieter. A capture taken from a single core switch misses serial links, unspanned VLANs, unmanaged switches and devices behind protocol gateways, and an inventory delivered without a coverage map invites the false conclusion that what was not seen does not exist. A spreadsheet accepted as the baseline, without reconciliation against project files and a cabinet walkdown, carries years of field replacements forward as errors. And an engagement without an agreed goal, whether a first boundary picture, validation of a segmentation project or evidence for a specific submission, tends to answer every question partially. The OT assessment planning library holds the sector manuals that feed each of these decisions.
How GDF Supports Plant Engineering, Security Leads and Compliance Teams
Global Digital Forensics has performed security assessments and forensic examinations since 1992, and our SCADA, ICS and OT security assessments are scoped around physical safety and operational continuity with the plant's engineers in control. In higher Purdue zones we perform controlled, manual attack path validation to see whether an intruder can cross into the industrial zone. In the lower levels we switch to passive telemetry at SPAN ports and taps, offline configuration review and maintenance window inspections. Every engagement begins with the rules of engagement described above, and the inventory we deliver records the source and confidence of every entry alongside a coverage map showing which segments were instrumented and for how long, so a maintenance engineer, a security lead and a compliance lead can each see how much weight an entry will bear.
The report is written for the mandate that governs the plant as well as for the engineering team, with findings expressed as the gap between the protection a zone has and the protection its risk requires in ISA/IEC 62443 terms, and mapped to the CIP standard, AWIA assessment or Coast Guard requirement the compliance lead must answer. Where an incident has already occurred, the same examiners preserve and analyze the record under the direction of counsel. Our clients include utilities, industrial operators and Fortune 1000 companies, and the initial consultation is free. If a mandate's submission is approaching and the inventory is a spreadsheet nobody trusts, call (800) 868-8189 and a senior assessor will work through the readiness items with your plant engineer on the first call.
The Checklist at a Glance
| Item | Who acts | Where it lives | How fast it expires |
|---|---|---|---|
| Asset inventory with source and confidence | Control engineer with maintenance | PLC project files, HMI tag databases, walkdown notes | Drifts with every field replacement |
| Network drawings and conduits | Network engineering | As built drawings and switch configurations | Stale after any unrecorded change |
| Off limits assets and safety boundaries | Plant manager and control engineer | Rules of engagement, listed by Purdue level | Fixed for the engagement, renewed each time |
| SPAN or tap capture points | Network engineering | Managed switch mirror sessions and optical taps | Capture covers only the segments and windows instrumented |
| Maintenance windows for active work | Operations manager | Outage and maintenance calendar | A missed window pushes the work a full cycle |
| Stop authority | Named plant floor engineer | Rules of engagement and the contact sheet | Must be reachable for every active step |
| Vendor remote access inventory | IT and OT jointly | Firewall rules, jump hosts and vendor gateways | Changes whenever a vendor contract changes |
| Regulatory mapping | Compliance lead | CIP 002 categorization, AWIA assessment, Coast Guard plan | Each mandate runs its own submission cycle |
Request the Formatted Checklist
The formatted checklist and workbook edition, a printable control sheet with asset, boundary, capture point, maintenance window and stop authority fields the plant can fill in before the rules of engagement are drafted, is delivered by a private email link through the request form. Provide your name and email and the link opens the preparation library downloads in your browser, where the existing OT library also lives. If a regulator's deadline is near or an incident is under way, do not wait for the download. Call (800) 868-8189 and a senior assessor will take the call. The initial consultation is free.