How to use this checklist
This cybersecurity checklist was developed specifically for the energy sector considering NIS2, IEC 62443 requirements, and lessons from attacks like DynoWiper (December 2025). Each item is marked with priority: P1 (critical — implement immediately), P2 (high — implement within 6 months), P3 (medium — implement within 12 months).
The checklist is divided into 8 areas corresponding to key security domains for energy infrastructure.
1. IT/OT network segmentation
- [P1] Physical or logical separation of IT and OT networks with industrial DMZ
- [P1] No direct IT↔OT connections — all communication through DMZ
- [P1] Industrial firewalls with DPI for OT protocols (Modbus, DNP3, IEC 104)
- [P2] OT network microsegmentation — each substation as a separate segment
- [P2] Data diodes for most critical zones (Safety)
- [P2] Firewall rules at OT command level (not just ports/protocols)
- [P3] Regular firewall rule review — removing unnecessary rules
- [P3] IT/OT segmentation penetration testing at least annually
2. Access management
- [P1] MFA for all remote connections to OT systems (VPN, jump servers)
- [P1] Default password changes on all PLC controllers, RTUs, HMIs
- [P1] Disabling unused accounts and services on OT systems
- [P2] Privileged Access Management (PAM) for IT and OT admin accounts
- [P2] Separate accounts for IT and OT activities — no shared credentials
- [P2] Access permission review quarterly
- [P2] Logging and monitoring all remote sessions to OT systems
- [P3] Physical access control to control cabinets and engineering workstations
- [P3] Automatic logout of inactive sessions in OT systems
3. Monitoring and detection
- [P1] SOC (in-house or SOC as a Service) with 24/7 monitoring
- [P1] Passive OT network traffic monitoring (TAP/SPAN probes)
- [P1] IT and OT event correlation in a single SIEM
- [P2] Behavioral baseline of controller communications — anomaly alerts
- [P2] PLC controller configuration and firmware change monitoring
- [P2] Alerts on IT-to-OT connection attempts outside approved schedules
- [P2] Threat intelligence — energy sector IoC feed subscription
- [P3] OT honeypots — fake controllers as decoys
- [P3] Regular threat hunting exercises in IT/OT logs
4. Backup and business continuity
- [P1] Offline backups of PLC and RTU controller configurations (physical media)
- [P1] Offline backups of SCADA projects, HMI configurations, and engineering workstations
- [P1] Business continuity plan addressing SCADA system loss scenarios
- [P1] Manual control switching procedures at each substation
- [P2] Backup recovery testing quarterly — RTO measurement
- [P2] OT communication system redundancy (backup links, radio)
- [P2] Spare engineering workstations with controller programming software
- [P3] Paper documentation of OT network topology and configuration parameters
- [P3] Vendor agreement for priority service support during incidents
5. Vulnerability management
- [P1] Inventory of all OT assets with firmware/software versions
- [P1] CVE monitoring for SCADA systems, controllers, and firmware used in infrastructure
- [P2] OT patch management process — accounting for maintenance windows
- [P2] Patch testing in laboratory environment before production deployment
- [P2] Controller hardening — disabling unused ports, services, and protocols
- [P2] PLC programming mode protection (password, physical key)
- [P3] Regular vulnerability scanning (passive) of OT systems
- [P3] Controller firmware integrity verification (digital signatures)
6. Incident response
- [P1] OT-specific incident response plan — wiperware, ransomware, process manipulation scenarios
- [P1] Escalation matrix — contacts for OT engineers, dispatchers, management, CSIRT
- [P1] NIS2-compliant incident reporting procedure (24h/72h/1 month)
- [P2] Incident response exercises (tabletop exercises) at least twice yearly
- [P2] OT segment isolation procedures without stopping critical processes
- [P2] Forensic tools prepared for OT system analysis
- [P3] Full simulation exercises (red team vs blue team) annually
- [P3] Post-incident analysis with recommendation implementation (lessons learned)
7. Supply chain and vendors
- [P1] Vendor remote access control to OT systems — logging, monitoring, MFA
- [P2] Cybersecurity assessment of critical vendors (controller manufacturers, integrators)
- [P2] Security requirements in OT vendor contracts
- [P2] Firmware update integrity verification before deployment
- [P3] Vendor security audits every 2 years
- [P3] Contingency plan for key vendor compromise
8. Training and awareness
- [P1] Board cybersecurity training — required by NIS2
- [P1] Security awareness training for all employees (minimum annually)
- [P2] Specialized OT cybersecurity training for engineers
- [P2] Phishing simulations with energy/OT context
- [P2] Incident response procedure training for duty operators
- [P3] Continuous awareness program (newsletter, briefings)
- [P3] OT cybersecurity certifications for key staff (GICSP, ISA/IEC 62443)
Summary: implementation prioritization
Months 1-3 (quick wins — P1 items): IT/OT segmentation, offline backups, MFA, IR plan, 24/7 monitoring, board training. These items drastically reduce risk of the most serious scenarios, including DynoWiper-type attacks.
Months 4-9 (consolidation — P2 items): OT microsegmentation, PAM, PLC change monitoring, backup testing, OT patch management, IR exercises, OT training.
Months 10-18 (refinement — P3 items): honeypots, threat hunting, penetration testing, vendor audits, certifications, paper documentation.
How nFlo helps implement this checklist
OT/ICS security audits — baseline assessment, gap identification, and checklist item implementation prioritization.
SOC as a Service — delivering monitoring and detection items (section 3) with IT and OT coverage from day one.
Red Team — verifying implemented security measure effectiveness through controlled penetration testing.
Incident Response — developing and testing IR plans (section 6) specific to energy infrastructure.
Schedule a free consultation — we’ll help assess your current posture and plan checklist implementation.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
