Industrial cybersecurity. Passive first methods. Findings ranked by consequence.
Control systems were built to run a process, not to survive a scanner. Global Digital Forensics assesses PLCs, RTUs, HMIs, historians and the networks between them with methods planned around uptime and safety, and reports what an attacker could reach in terms your engineers and your board can both use.
Water: AWIA planning inputs · Power: applicable NERC CIP evidence · NIST SP 800-82 methods
Gather records before an engagement
Choose a guide to identify the records an OT assessment will ask for, assign an owner to each and write down the questions for your auditor, consultant, counsel or export control specialist.
The guides prepare your team for the scoping conversation about a control system assessment. They are not an audit, an assessment, a legal opinion or a specialist decision, and they authorize no testing of live equipment.
Read any overview without a form. To download, give your name and email and we will send a link that stays live for seven days; organization and phone are optional.
Use the four sector packs, the project workbook and the shared source records to organize a proposed OT assessment before anyone is on site.
File: ZIP: PDFs, XLSX workbook and CSV records.
Record the proposed scope, owners, safety boundaries and permissions before an audit, a security assessment or physical or cyber testing.
File: Editable CSV preparation checklist.
Browse all preparation packages by subject.
Check each overview for source dates, scope limits and unresolved questions before using a download.
Global Digital Forensics has operated since 1992 and brings cybersecurity, SCADA and OT assessment, digital forensics and expert testimony together in one practice. Founder Joseph Caruso has worked in engineering since 1980, across software development, mainframe databases, real time transaction systems, cellular networks and cybersecurity incident response, and holds the CISSP. Robert Knudsen pairs the CISSP, CompTIA Security+ and Network+ with eighteen years of forensic casework in federal and state court matters. That is the team that plans your assessment, and the plan starts with your sector.
Drinking water and wastewater
For community drinking water systems that fall under AWIA, the cyber evidence we gather can feed the risk and resilience assessment and the emergency response plan directly. Wastewater systems follow their own requirements, and we scope them on their own terms.
Power and energy
For registered entities with BES Cyber Systems, we agree the requirements in play and the evidence boundary before collection starts. Distribution, gas and other energy environments get their own applicability review rather than a borrowed checklist.
Across OT environments
We review architecture, legacy assets, vendor access and recovery with the operating context in view. Active validation happens only against separately authorized targets, inside agreed windows, with stop conditions your engineers set.
Security and engineering
Your technical team receives the asset and access path record, the source evidence behind each finding, the limits of what we could observe, the configuration findings, the corrective actions and the verification method we agreed for each one.
Leadership and counsel
Your leadership receives the operating consequence of each finding, the priorities, the accountable owners, the dependencies and the evidence a planning cycle or an applicable regulatory review will ask for, written for people who do not read firewall rules.
01 Scope
We define the assets, the process dependencies, the responsible owners, the exclusions and the people who can approve a method, then agree handling restrictions and escalation contacts, because an assessment that does not know who can say stop should not start.
02 Observe
We review diagrams, inventories, configurations, logs and approved passive observations, then reconcile those records with what operations and engineering know to be true. Most of what matters can be learned without sending a single packet into the control network.
03 Validate
Every active step is documented in advance: the target, the method, the operating window, the stop conditions and the recovery arrangements. Where production validation is unsuitable, we work on a representative or laboratory system instead.
04 Prioritize
Each finding records the affected process, the supporting evidence, the owner, the maintenance dependencies and the criteria for verifying the fix, and the report keeps a recommendation distinct from an implemented and verified change.
The approach is informed by NIST SP 800-82 Rev. 3, the NIST guide to operational technology security. The final scope depends on the evidence available and the operating constraints of the site. Passive observation also needs an approved collection design, and no method removes every operational risk, which is why we say so before work begins rather than after.
Illustrative report excerpt. This is a fictional example written to show the format, not a client result or a completed validation.
Management summary
A support account appears able to reach control zone assets beyond the equipment it was created to maintain. The operating concern is a path from a compromised vendor account to systems that run the process. Reachability must be confirmed before that consequence is treated as established.
Engineering record
Evidence: access approvals, identity groups, jump host policy and firewall configuration. Limitation: no active reachability check was performed. Next step: narrow the approved path, retain session records and agree a verification method with operations.
The contracted report can include an architecture and access path record, findings ranked by consequence, corrective owners, a remediation sequence and a defined validation plan. We agree the reporting audience, the depth and the retesting scope in writing, so the document you receive is the one you planned for.
If you would like the contracted report scoped to your reporting audience, describe who will read it and we will propose the depth and the retest scope in writing.
Scope can include PLCs, RTUs, HMIs, SCADA servers, historians, engineering workstations, gateways and the remote access systems that support them. Legacy equipment is reviewed in its operating context, including the compensating controls around it and the recovery options available, because replacing a twenty year old controller is rarely the first practical step.
During scoping we identify the protocols in use, such as Modbus TCP, DNP3, IEC 61850 or OPC DA and UA, and agree for each system the specialist capability required, the configuration or passive evidence available and the validation permitted. Naming a protocol does not mean every implementation or test method is included, and we would rather settle that at the table than discover it on site.
Technical scope record
For each system or protocol we record the process owner, the evidence available, the agreed review method, the excluded actions, the validation window and the recovery support, so nobody has to remember later what was agreed.
Relevant expertise
Review the published team qualifications, then agree the technical lead, the industrial experience and any specialist duties the installed systems require. The examiners behind this practice have testified in federal and state courts, and the same discipline governs how we document an assessment.
Want to know who would lead the work at your site? Ask us to name the technical lead and we will confirm availability and industrial experience before you engage.
Use the GDF New York engagement hub to discuss facilities in New York and New Jersey and neighboring operations in Pennsylvania and Connecticut. We agree site access, maintenance windows, technical staffing and travel before anything is scheduled.
For regulated New York utilities, we confirm the applicable NY PSC requirements, including the IT cybersecurity regulations adopted in April 2026, and review the supporting IT and the IT to OT access boundaries within the agreed technical scope. For New Jersey utilities, we identify the applicable NJ BPU program and its evidence requirements.
NYDFS 23 NYCRR Part 500 applies to covered entities authorized under New York banking, insurance or financial services laws. Location in New York alone does not establish applicability. Discuss Part 500 technical evidence support when your organization has a relevant covered entity or contractual requirement.
Technical assessment, regulatory assessment, engineering implementation and independent audit are separate scopes, and the operator and its advisers determine which duties apply. An assessment supports those decisions with evidence; it does not by itself establish compliance or legal privilege.
Sources checked October 14, 2026: NY PSC IT cybersecurity announcement; NJ BPU Reliability and Security; NYDFS covered entities.
Water planning pack
Preview the applicability prompts, the evidence owner checklist, a fictional access finding and the fillable planning worksheets. Email is the only contact detail requested for the full PDF.
Power planning pack
Preview the remote access evidence checklist, the authorization boundaries, a fictional finding and the fillable scope and action records. Email is the only contact detail requested for the full PDF.
The packs are planning aids. You can read the previews without registering, and a resource request does not book an assessment or subscribe you to marketing.
We agree the assets, the access, the responsibilities, the exclusions, the evidence handling and the validation criteria in writing before work starts. A technical assessment, a regulatory assessment, an engineering implementation and an independent audit are different scopes with different people accountable for them, and the operator retains its operating and compliance responsibilities throughout. That clarity is what lets a finding be acted on without an argument about whose job it was.
If the line between an assessment, an audit and an engineering fix is unclear in your organization, ask for the written scope that settles it before work starts.
Frequently asked
Yes. We plan the assessment around the operating process and the methods your engineers approve. Documentation review, interviews and passive observation establish the baseline, and engineering approves the scope and timing of any active validation before it happens.
Yes. We examine vendor accounts, authentication, permissions, connection paths, approval procedures and session records, then document what we found and the practical control improvements that would close the gap.
Yes. We assess legacy equipment in its operating context, including segmentation, controlled access, monitoring, backups and the recovery options appropriate to the environment, rather than treating every older controller as a finding in itself.
Yes. We define the common controls and the site specific dependencies, coordinate with each operating team and organize the findings so they serve both local remediation and leadership decisions across the fleet.
The report ranks the findings by consequence, explains what each one means for the operation, identifies the technical evidence behind it and sets out the remediation and validation steps in the order we recommend taking them.
Download the four sector packs and the fifty state companion, or build a workbook set for your states, your ownership and your operating scope.
Technical review: Joseph Caruso, Founder, CEO and CTO. Reviewed .
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .
Assessment scope
Share your organization and preferred reply method. We review the request, discuss the technical lead and reporting needs, then agree the scope before work starts.
No network diagrams, credentials or detailed vulnerabilities are needed here. Secure exchange is arranged separately.
Active OT incident? Call (800) 868-8189 for 24/7 intake.