How to use this checklist
This checklist covers 50 OT cybersecurity control points organized into 8 categories. Each point has an assigned priority:
- CRITICAL — implement immediately, absence = direct attack risk
- HIGH — implement within 3 months
- MEDIUM — implement within 6-12 months
Start with an OT security audit — it will help determine which points are already met and which need immediate attention.
1. OT asset inventory and management
- CRITICAL: Complete OT device inventory — PLCs, RTUs, SCADA, HMIs, industrial switches, IP sensors
- CRITICAL: Documentation of firmware versions and operating systems for every OT device
- HIGH: OT asset criticality classification (critical / important / auxiliary)
- HIGH: Network connection registry — which device communicates with what and via which protocol
- MEDIUM: Automated OT asset inventory (passive NDR tools)
- MEDIUM: Lifecycle management plan — replacement schedule for legacy systems (Windows XP/7, old firmware)
2. IT/OT network segmentation
- CRITICAL: DMZ between IT and OT network — no direct IT↔OT communication
- CRITICAL: Elimination of dual-homed devices (historians, engineering workstations with interfaces in IT and OT)
- CRITICAL: Industrial firewall at IT/OT boundary with OT protocol-based rules
- HIGH: Segmentation within OT — isolation of production lines from each other
- HIGH: Isolation of safety systems (SIS) from the rest of OT network
- HIGH: VLANs for each Purdue model zone with ACLs on routers
- MEDIUM: Microsegmentation of critical OT assets
- MEDIUM: Data diodes (unidirectional gateways) for OT→IT data transfer
3. Access control
- CRITICAL: MFA for all remote connections to IT and OT networks (VPN, RDP)
- CRITICAL: Elimination of default passwords on PLC controllers and OT devices
- CRITICAL: Individual accounts for every OT system user (no shared accounts)
- HIGH: Jump server as the only entry point to OT network for administration and service
- HIGH: Supplier account management — creation, temporary activation, deactivation after service
- HIGH: Physical access control to control cabinets and OT server rooms
- MEDIUM: PAM (Privileged Access Management) for OT administrative accounts
- MEDIUM: Recording of administrative and service sessions on OT network
4. Monitoring and threat detection
- CRITICAL: Monitoring connections between IT and OT zones — lateral movement detection
- HIGH: Passive OT network traffic monitoring (SPAN/TAP) with industrial protocol analysis
- HIGH: SOC with OT competencies or SOC as a Service with OT threat detection
- HIGH: Alerts on OT system logins outside working hours
- HIGH: PLC configuration change monitoring — alert on unauthorized upload/download
- MEDIUM: Anomaly detection in industrial protocols (Modbus, OPC UA, S7comm)
- MEDIUM: New device detection on OT network (rogue device detection)
- MEDIUM: IT and OT log correlation in SIEM
5. Backup and recovery
- CRITICAL: Offline copies of PLC configurations and controller programs (USB/disk in safe)
- CRITICAL: Golden config baseline — documented correct configuration for every PLC
- CRITICAL: Engineering workstation and SCADA backup (golden images) — offline!
- HIGH: Regular recovery tests with time measurement (RTO/RPO)
- HIGH: Manual production startup procedures without IT systems (manual override)
- HIGH: Step-by-step documentation for restoring each production line
- MEDIUM: Automated PLC configuration backup with versioning (change management)
6. Incident response
- CRITICAL: OT-specific IR plan — scenarios: ransomware, HMI loss, unauthorized PLC change
- CRITICAL: Procedure for safely disconnecting OT from IT without stopping critical processes
- HIGH: Designated IR team including OT engineers, IT and production management
- HIGH: Emergency contact list: IR firm, national CSIRT, OT vendors, insurer
- HIGH: Regular IR exercises (tabletop exercises) at least twice a year
- MEDIUM: Crisis communication procedures (internal, customers, media, regulators)
- MEDIUM: Post-mortem analysis after every incident with IR plan updates
7. Regulatory compliance
- CRITICAL: Assessment of whether the company falls under NIS2 (sector, size, revenue)
- CRITICAL: Designated cybersecurity responsible reporting to management
- HIGH: NIS2 gap analysis — identification of missing requirements
- HIGH: Incident reporting procedure to CSIRT (24h / 72h / 30 days)
- HIGH: Management training on NIS2 requirements and personal liability
- MEDIUM: IEC 62443 compliance assessment — target SL per zone
- MEDIUM: ISO 27001 certification extended to OT
8. Supply chain and training
- HIGH: Inventory of suppliers with OT network access
- HIGH: Cybersecurity requirements in OT supplier contracts
- HIGH: Cybersecurity training for OT engineers and operators (min. twice yearly)
- MEDIUM: Service media verification (laptops, USB) before connecting to OT
- MEDIUM: Cybersecurity audit of critical OT suppliers
- MEDIUM: Phishing simulations for personnel with IT/OT system access
Quick wins — what to implement in the first week
If your factory is starting from scratch, these actions provide immediate security improvement:
- MFA on VPN and remote access — blocks the vast majority of attacks based on leaked credentials
- Change default PLC passwords — eliminates a trivial attack vector
- Offline PLC configuration backup — copy current programs to USB in a safe
- Physically disconnect uncontrolled IT→OT paths — if there is no firewall, pull the cable
- IR contact list — who to call at 3 AM when HMI screens go black
Scorecard — assess your factory
Count how many of the 50 points are fulfilled:
- 40-50: Good level, focus on continuous improvement
- 25-39: Medium level, prioritize CRITICAL gaps
- 10-24: Low level, urgent OT security audit needed
- 0-9: Critical risk level, immediate action required
Not sure how many points your factory meets? Schedule an OT security audit — we will go through this checklist together and prepare a prioritized action plan.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
