Why an OT audit is not an IT audit in a factory
Many manufacturing companies that decide on a cybersecurity audit outsource it to a firm specializing in IT. This is a fundamental mistake. The OT (Operational Technology) environment operates under different rules than IT, and standard IT audit tools and methodologies can actually damage production systems.
Nmap scanning an OT network can crash PLC controllers. Nessus sending test packets to a SCADA system can trigger false alarms or process restarts. An auditor who does not understand the Purdue model and industrial protocols will not identify critical gaps — because they do not know what to look for.
An OT/ICS security audit requires specialized knowledge combining cybersecurity with industrial automation engineering.
What does an OT security audit cover?
1. OT asset inventory
Surprisingly many companies do not know exactly what is connected to their production network. The audit covers:
- PLC/RTU controllers — models, manufacturers, firmware versions, deployment dates
- SCADA/HMI systems — software versions, operating systems, patching level
- Network infrastructure — switches, routers, firewalls (or lack thereof) in the OT network
- Engineering workstations — software, connections to both networks (dual-homed?)
- Historian servers — location in the architecture (IT, OT, DMZ?)
- IoT devices — sensors, cameras, communication modules on the shop floor
- External connections — supplier VPNs, remote access modules, 4G/5G modems
2. Network architecture and segmentation assessment
Mapping current network topology against the Purdue model:
- Does a DMZ between IT and OT exist?
- Are Purdue zones implemented?
- Is communication between zones controlled (firewalls, ACLs)?
- Identification of dual-homed devices (interfaces in both IT and OT)
- Identification of uncontrolled IT→OT paths
- Conduit assessment per IEC 62443
3. Vulnerability analysis
Passive vulnerability identification without impacting processes:
- Known CVEs in detected SCADA/HMI software versions
- PLC controller firmware vulnerabilities (CISA ICS-CERT databases)
- Unpatched operating systems (Windows XP/7 on OT stations)
- Default passwords and lack of authentication in OT devices
- Open ports and network services on the OT network
4. Access control assessment
- How are OT system accounts managed?
- Is MFA used for remote access?
- Are supplier service accounts managed (creation, removal, rotation)?
- Is physical access to control cabinets controlled?
- Do onboarding/offboarding procedures exist for OT access?
5. Change management assessment
- Are PLC configuration changes documented and versioned?
- Who has controller programming privileges?
- Does a golden config baseline for PLCs exist?
- How are firmware updates managed?
- Are patches tested before production deployment?
6. Incident readiness assessment
- Does an OT-specific IR plan exist?
- Does personnel know what to do during a cyberattack on production?
- Do offline copies of PLC configurations and controller programs exist?
- Have recovery procedures been tested?
- How quickly can production be restored after an incident?
7. Regulatory compliance assessment
- Gap analysis against NIS2 requirements
- IEC 62443 compliance assessment (target SL vs actual SL)
- ISO 27001 requirements verification extended to OT
- Industry-specific requirements assessment (e.g., FDA for pharma)
OT audit methodology
Phase 1: Planning and preparation (week 1)
- Kick-off meeting with IT, OT and management teams
- Documentation collection: network diagrams, device lists, policies
- Scope definition: which lines/plants, which systems
- Safety rules agreement: what the auditor can and cannot do on the OT network
- Maintenance window planning (if active tests are needed)
Phase 2: Discovery and mapping (weeks 1-2)
- Passive network scanning — SPAN/TAP traffic capture for device and flow identification
- Physical walkthrough — shop floor visit, device identification, physical security verification
- Configuration review — offline analysis of firewall, switch and SCADA configurations
- Interviews — conversations with OT engineers, operators and IT about practices and procedures
Phase 3: Analysis and assessment (weeks 2-3)
- Asset and topology mapping
- Vulnerability analysis (passive)
- Segmentation and flow assessment
- Access control gap identification
- Process and procedure evaluation
- Gap analysis against standards
Phase 4: Reporting (weeks 3-4)
- Technical report — detailed findings with evidence
- Executive summary — key risks and recommendations for management
- Prioritized recommendations — quick wins, short-term, long-term
- Roadmap — remediation plan with timeline and cost estimates
- Results presentation — for management, IT and OT
Typical OT audit findings in manufacturing
Based on audit experience in manufacturing, the most common findings are:
- Lack of IT/OT segmentation — flat network connecting office to shop floor
- Default PLC passwords — controllers with factory credentials
- Missing OT asset inventory — nobody knows exactly what is on the network
- Unpatched systems — Windows XP/7 on HMI stations
- Uncontrolled supplier remote access — permanent VPN without monitoring
- No OT IR plan — IT plan does not cover production scenarios
- Dual-homed historian — server with interfaces in IT and OT = segmentation bypass
How to prepare your factory for an audit
- Gather documentation — network diagrams (even outdated), device lists, IT policies
- Designate contacts — OT engineer, IT administrator, production manager
- Identify maintenance windows — if the audit requires active testing
- Prepare access — management system accounts, access to control cabinets
- Inform personnel — auditors will speak with operators and engineers
Want to know the true state of OT security in your factory? Schedule an OT/ICS security audit — we will deliver a complete risk picture and a prioritized remediation plan.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
