Practitioner resource

The OT, ICS and SCADA Security Assessment Protocol

November 1, 2026

Before you read

Would you share your contact details with GDF? It helps us understand who finds these resources useful. It is optional, and every guide is yours to read either way.

Skip and read

We will remember your choice on this browser so you can browse the whole library without another request. You can read without sharing information.

Discuss Engaging an Expert All guides

(212) 561-5860 24/7: (800) 868-8189

Plan to minimize disruption, with explicit operational authority

An OT security assessment must respect the physical process it supports. A device may control treatment, power, movement, pressure, temperature or another condition that cannot be understood from a network diagram alone. Availability and safety constraints affect which evidence can be collected, which questions can be tested and who must authorize the work. A technique that is routine on an office network may be inappropriate on an operating control network.

Zero disruption should be a planning objective, not a promise. Passive observation, interviews and configuration review can still create operational risk if equipment is connected incorrectly or a proposed change alters traffic. The protocol below starts with existing records and requires a separate decision before active techniques. It is intended for asset owners, operators, engineers, security leaders and authorized assessors working together. [OT]

Establish the process boundary before the network boundary

Identify the facility, process, operating states and business functions within scope. Name the operations owner, responsible engineer, safety representative, security lead and assessor. Record who can approve access and who has immediate authority to stop the work. Identify contracted or vendor responsibilities and confirm that the organization has the authority to permit the proposed activity.

Document the conditions that matter to safe operation: critical cycles, maintenance periods, environmental constraints, staffing and dependencies on remote systems. Include systems that the team must not touch. A list of IP ranges cannot capture all of these conditions. The first deliverable should explain the operating boundary and the reasons for exclusions in terms the plant and security teams can both verify.

Gather existing evidence before introducing new traffic

Request current network drawings, asset lists, device roles, approved remote-access descriptions, relevant change records and available vendor documentation. Compare those sources with the knowledge of people who operate and maintain the process. Record the document dates and known omissions. A drawing that is useful for orientation may still be incomplete or out of date.

Use existing monitoring and configuration records where they can address the question. Ask how they were collected, which portions of the environment they cover and what their retention limits are. Do not infer that a device or connection is absent because a particular monitoring source did not see it. Keep discrepancies in an open-items register so the team can choose a safe way to resolve them.

Prepare an assessment safety and communications plan

Write the planned activity, expected effect, authorized operator, location, timing and prerequisites. Establish the method for communicating with the control room or process owner while work is underway. Define observable stop conditions, such as unexpected communications behavior, alarms, loss of visibility or a process condition that operations considers unacceptable.

Record what the assessor will do after a stop instruction and how operations will confirm that work can resume. Do not let a remote security team make that decision alone. Include recovery contacts and the records needed to understand a change. A rollback description should be specific to the proposed action and available recovery method; a general promise to undo the work is not a recovery plan.

Design passive observation with engineering review

If traffic observation is appropriate, have the authorized network and operations owners approve the collection point and connection method. Confirm how any existing mirror, tap or collection interface is configured and who may change it. Installing or reconfiguring a collection path is itself an operational action requiring review. The assessor should not attach equipment merely because the intended analysis is described as passive.

Define the collection period, expected process states, permitted data and secure handling arrangement. Record capture loss, time basis and limitations in visibility. A quiet window may omit startup, failover, maintenance or infrequent vendor activity. Describe what was observed during the actual period rather than presenting a short sample as a complete map of the facility's communications.

Reconcile assets and communication paths without guessing

Build an asset record from corroborated sources. Identify device function, owner, location or zone, relevant version information and the source supporting each entry. Mark uncertain identifications and avoid treating a network signature as conclusive proof of a device's model or role. Ask the responsible engineer to resolve meaningful discrepancies before planning a test against a supposed target.

For significant communication paths, identify the business purpose and the people who can approve it. Include engineering workstations, historians, remote services, identity dependencies and connections to enterprise systems. Distinguish observed communication from an allowed path in a configuration, and both from a path the team has successfully tested. Those differences affect the conclusions the assessment can support.

Review access and remote support as operating processes

Map how employees, contractors and vendors reach the environment. Identify approval, authentication, privilege assignment, monitoring and termination responsibilities. Ask operations to explain the maintenance tasks that rely on each route. A proposed access restriction should account for the work needed to keep the facility safe and available, rather than assume that disconnecting a service has no consequence.

Examine the supporting record: who requested access, who approved it, which identity was used, what privilege was granted and when access was removed. Shared or emergency credentials require an accountable handling process. Record MFA coverage and its limits where supported. The report should identify a specific control gap or unresolved dependency instead of turning a general preference for stronger access control into an unreviewed production change.

Evaluate configuration and vulnerability information in context

Review relevant settings and supplier advisories using the available device and version information. Verify applicability with the engineering or vendor owner before treating an advisory as a confirmed vulnerability in the facility. An unverified product identification can lead to an incorrect remediation recommendation or an unsafe attempt to reproduce a condition.

When a weakness appears applicable, describe the affected function, known conditions, possible operational consequence and available mitigations. Distinguish evidence reviewed from behavior directly observed. A patch recommendation must account for support, compatibility, maintenance planning and recovery. Where immediate patching is not appropriate, operations and security should evaluate authorized compensating measures and record the remaining risk.

Require a separate gate for active validation

Any technique that sends assessment traffic, attempts authentication, changes a configuration or tests a control's behavior requires an explicit scope decision. Define the exact target, method, rate, window, operator, stop conditions and recovery prerequisites. Obtain the approvals required by the asset owner and relevant third parties. Do not treat approval to review documentation as permission to scan the network. [TEST] [ROE]

Consider a lab, replica, spare device or maintenance environment when it can address the question safely and meaningfully. Document the differences from production. If active validation cannot be justified within the operational constraints, say that the finding is based on records and review rather than demonstrated exploitation. A well supported limitation is preferable to an unnecessary production experiment.

Preserve an evidence trail that operators can understand

Record the source, operator, collection time, method, handling and any observed effect for each material item. Retain approved plans and significant communications with the resulting evidence. Avoid placing sensitive plant diagrams, credentials or raw captures in broad email distribution. Agree on a secure transfer method and restrict access according to the owner's requirements.

Keep the original material and an appropriately scoped analysis copy. Where information has been redacted for a wider audience, explain the redaction without losing the reference back to the controlled source. Evidence handling supports the ability to explain a finding later; it does not by itself establish compliance with every operational, contractual or regulatory obligation.

Report operationally meaningful findings and practical next steps

Each finding should identify the affected process or asset, supporting evidence, plausible consequence, uncertainty, recommended action and responsible owner. Explain whether the issue was observed, inferred from configuration or reported by another party. Identify testing that was not performed and the effect of that limitation on confidence in the conclusion.

Separate quick administrative corrections from engineering changes that require design, procurement or an outage window. Assign priorities with the owner using the business and safety context rather than a tool score alone. If the team accepts or defers a risk, retain the reason, approving authority and review condition. The result should be a plan operations can execute, not a generic list of security features.

Close the assessment without losing follow-through

Confirm that temporary access, collection devices and approved temporary configurations have been addressed according to the plan. Reconcile changes made during the assessment and obtain the owner's confirmation of the resulting state. Identify evidence the owner will retain, remaining open items and the people responsible for them.

Plan retesting around the actual remediation and operational constraints. Record what a successful retest demonstrates and what remains outside scope. Use the assessment to improve the accuracy of drawings, inventories, access procedures and response plans where authorized. NIST SP 800-82 Revision 3 is the current final publication used for this edition; later draft material should be identified as draft rather than silently treated as a final requirement. [OT]

Operational technology zones and controlled connections — Planning illustration. Apply it to the authorized scope and actual systems described in this guide.

Information Gathering Q&A Checklist

Use this Q&A with the people who own the systems and the relevant legal or business decisions. Mark unknown or not applicable answers explicitly. Record an owner, a confirming source and the date. The public guide-request form asks for your email, not the answers below.

Do not write passwords, recovery keys, unlock codes or authentication secrets here. Record whether authorized access is available, who controls it and how a secure handoff can be arranged. Keep completed copies in the location counsel or the company approves. Do not send a completed record containing sensitive account or employee details through a public contact form.

Who is directing the matter and who can authorize technical access?

Identify directing counsel, the business decision maker, the IT security owner and any outside administrator. Record the immediate deadline, relevant period and known preservation risk. An employee's possession of a device or an administrator's ability to access an account does not by itself settle the authorized examination scope.

Answer: