Service Overview
Operational Technology (OT) is a critical component of an organization’s ecosystem. Strengthening its cyber resilience requires the same proactive approach applied to IT systems. This assessment evaluates the OT environment’s security maturity level, identifies high-risk vulnerabilities, and provides recommendations for initial remediation.
Methodology
CYE follows a structured approach combining offsite data analysis and onsite inspections, with interviews and architecture reviews. The methodology ensures complete visibility into both digital and physical aspects of the OT environment while minimizing operational risk.
To comply with the “Do no harm” principle, CYE applies a secure and non-intrusive methodology, structured into three main phases:
1. Passive Data Gathering
CYE collects artifacts to understand the architecture, operational processes, and potential vulnerabilities within the OT environment. This phase includes reviewing firewall configurations, policies, internal procedures, and third-party support agreements.
2. Interviews
CYE conducts a series of interviews to evaluate the organization’s cybersecurity maturity against the NIST Cybersecurity Framework (NIST SP 800-82 Rev. 3). Topics include risk and vendor management, authentication and authorization, Purdue model implementation, iDMZ-OT segmentation, OT Wi-Fi, detection capabilities, and incident response and recovery measures.
3. Physical Review
As part of the engagement, CYE may also perform a physical review of OT assets such as data centers, PLCs, HMIs, control rooms, and network switches. This step helps uncover physical and procedural weaknesses, such as visible credentials, unprotected MFA devices, and alarm panels with exposed codes.
Deliverables
All findings are documented in Hyver, CYE’s Continuous Threat Exposure Management (CTEM) platform
The organization’s security maturity level is determined using the NIST Cybersecurity Framework, incorporating both technical findings and organizational context
Prerequisites
Before the assessment begins, the following information and access must be provided:
Detailed OT facility and ICS architecture, including OT network segments
List of deployed security solutions and vendors in the OT environment
Export of OT firewall configurations
Privileged credentials, depending on the scope and setup
Customer Engagement
The customer is responsible for:
Supplying all required data, documentation, and access credentials
Supporting onsite activities during physical inspections
Ensuring availability of relevant stakeholders for interviews, including:
Network engineers
Component owners (e.g., ESD, DCS, SCADA)
OT security personnel
Relevant Standards
NIST SP 800-82 Revision 3
Security Domains Covered
NIST CSF domains: Governance, Identify, Protect, Detect, Respond, Recover