Standards preparation checklist
OT Security Assessment Preparation
Prepare the scope, records and decisions for an OT security review. Covers selected program, architecture, access, change and recovery topics.
Baseline: NIST SP 800-82 Rev. 3, final. Prepared November 1, 2026.
Which processes and sites are included?
An OT review needs an operational boundary, not just an IP range. Include control systems, supporting engineering tools, remote sites and business connections that can affect the process. Identify exclusions so a limited review is not mistaken for a complete site assessment.
Evidence to gather
Site/process list, system boundaries, accountable process owner and known exclusions.
If something is missing
Have operations and engineering agree on the boundary before collecting technical records.
Topic reference: NIST SP 800-82 Rev. 3; Sections 2.2 and 4.1.1; PDF page 63. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Who can approve the work and accept the remaining risk?
A technical contact may not have authority to approve a shutdown, a process change or an exception. Identify operational, engineering and security decision makers and the person who owns unresolved risk.
Evidence to gather
Program charter, responsibility assignments, approval paths and escalation contacts.
If something is missing
Name the decision makers and distinguish access approval from permission to test or change a system.
Topic reference: NIST SP 800-82 Rev. 3; Sections 3.1 and 3.3.1-3.3.2; PDF page 55. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
What could a cyber event do to people, the environment or the process?
List the consequences of incorrect control, loss of visibility and loss of availability. A security measure that looks reasonable for office IT can create an unacceptable operating condition in OT.
Evidence to gather
Existing hazard/risk reviews, critical functions, safety constraints and engineering assumptions.
If something is missing
Discuss the consequences with the process and safety owners before selecting assessment methods.
Topic reference: NIST SP 800-82 Rev. 3; Section 4.1.1, OT-specific guidance; PDF page 63. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Which assessment methods are safe for this equipment?
Document fragile or unsupported components, prohibited activities, stop conditions and approved windows. Passive observation can reduce some interactions, but installing monitoring equipment can still interrupt a connection.
Evidence to gather
Approved scope, vendor constraints, test restrictions, stop authority and offline test options.
If something is missing
Begin with records and interviews. Obtain an approved method before using tools on production equipment.
Topic reference: NIST SP 800-82 Rev. 3; Section 4.3.5, Table 10; section 6.3.2.4; PDF page 80. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Can you identify the OT assets and their owners?
Include controllers, HMIs, engineering workstations, network devices and supporting servers. Record model, software/firmware version, location and responsibility where available. A discovery result alone can miss isolated or non-IP equipment.
Evidence to gather
Current inventory, source/date of each record, owners and an identified unknown-assets list.
If something is missing
Reconcile existing engineering records with approved observation and manual checks before adding automated discovery.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.1.1 and 6.1.1.2; PDF page 108. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Which assets matter most to continuing safe operations?
Two similar devices may have very different consequences if unavailable or manipulated. Identify process dependence and recovery order so limited assessment time is directed to important functions.
Evidence to gather
Criticality rationale, process dependencies, single points of failure and recovery priorities.
If something is missing
Ask operations to explain the impact of losing each critical function rather than ranking by device count.
Topic reference: NIST SP 800-82 Rev. 3; Sections 4.1.1-4.1.2 and 5.3.2; PDF page 63. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Do the diagrams show the connections that actually exist?
Include IT/OT boundaries, vendor paths, remote stations, wireless links and cloud services. Record what a diagram cannot establish and who last checked it against the environment.
Evidence to gather
Dated network diagrams, connection inventory, remote access paths and known undocumented links.
If something is missing
Resolve the important discrepancies with engineering. Do not assume an old drawing proves current isolation.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.1.1.2; PDF page 109. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are required communications documented?
Identify source, destination, direction, protocol and operational purpose for important traffic. This gives the team a basis for assessing rules and abnormal behavior without treating every observed connection as necessary.
Evidence to gather
Approved data-flow list, process purpose, owners and available observations.
If something is missing
Have system owners explain unknown or undocumented flows before proposing restrictions.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.1.1.1; PDF page 109. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are network segments separated by effective controls?
A diagram or VLAN label does not establish which traffic is permitted. Review enforcement between business networks, OT zones and management paths against required communications and safety needs.
Evidence to gather
Architecture, firewall/ACL exports, allowed flows and the latest approved rule review.
If something is missing
Arrange a configuration review first. Any live validation needs an agreed operational method.
Topic reference: NIST SP 800-82 Rev. 3; Section 5.2.3.1; PDF page 88. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Can management connections bypass the intended boundary?
Check for second network interfaces, temporary connections, remote tools and maintenance paths that bridge segments. Evaluate their purpose and controls instead of applying an unexplained blanket ban on a hardware feature.
Evidence to gather
Management-path inventory, interfaces, remote tools and approved exceptions.
If something is missing
Have engineering review each bridge and document how the intended boundary is maintained.
Topic reference: NIST SP 800-82 Rev. 3; Section 5.2.3.1; section 6.2.5; PDF page 88. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
How are physical access and remote locations controlled?
Cabinets, control rooms and field equipment can be reached through physical routes as well as network paths. Identify who can enter, how visitors are handled and whether unstaffed sites have suitable protection.
Evidence to gather
Access lists, visitor process, cabinet controls, site checks and responsible owners.
If something is missing
Review the highest-consequence locations with the physical security and operations teams.
Topic reference: NIST SP 800-82 Rev. 3; Section 5.2.2; PDF page 86. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Do access permissions follow current responsibilities?
Identify operator, engineer, administrator and vendor permissions. Include how accounts are issued, changed and removed. Shared or legacy access needs a documented reason and compensating measures rather than assumed individual accountability.
Evidence to gather
Account/role list, approval records, departures/role changes and exceptions.
If something is missing
Reconcile accounts with current authorized personnel and escalate unexplained privileged access.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.1 and 6.2.1.1; PDF page 114. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Can operators still act safely during an authentication failure?
Authentication and session-lock settings must account for urgent operator action. Identify where technical limitations or emergency needs change the design and how access remains controlled in those cases.
Evidence to gather
Emergency-access procedure, HMI constraints, access safeguards and review approvals.
If something is missing
Review proposed authentication changes with the process and safety owners before applying them.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.1, OT-specific guidance; PDF page 114. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are vendor connections approved, limited and removed when finished?
Record the business reason, user, permitted systems, access window and removal method. Operations should know when remote work is planned. Continuous support needs a defined arrangement rather than an undocumented exception.
Evidence to gather
Vendor access register, approvals, session records and expiry/revocation process.
If something is missing
Review active access with the responsible vendor and operator before scheduling changes.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.10; PDF page 139. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Where is remote-user authentication enforced?
Confirm how remote users are identified and where MFA or compensating controls are applied. Protecting an access gateway is different from adding authentication directly to every controller.
Evidence to gather
Remote access design, identity settings, MFA coverage and documented limitations.
If something is missing
Agree on a feasible architecture for unsupported devices instead of forcing an untested change on them.
Topic reference: NIST SP 800-82 Rev. 3; Sections 6.2.1.4.4 and 6.2.10; PDF page 123. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are wireless and cellular connections part of the scope?
Radio and cellular paths can provide access outside the expected wired perimeter. Record ownership, purpose, authentication and the operational effects of losing the link.
Evidence to gather
Wireless/cellular inventory, configurations, providers and engineering requirements.
If something is missing
Identify unknown links and have engineering assess them before changing radio or network settings.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.9; PDF page 137. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are control-system changes recorded and approved?
A current configuration has limited value if the team cannot explain who changed it or restore the prior state. Include logic, setpoints where relevant, firmware, network rules and supporting applications in the change process.
Evidence to gather
Approved changes, baseline versions, backup points, test records and rollback instructions.
If something is missing
Reconcile recent changes with the configuration owner and record missing approvals or recovery material.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.4.2; PDF page 128. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
How are relevant vulnerabilities identified without unsafe probing?
Use the asset/version inventory, vendor notices and approved assessment methods to identify exposure. Automatic scanning is not the only way to identify a weakness, and some tools can affect control-system communications.
Evidence to gather
Inventory/version records, vendor advisories, review process and approved tool methods.
If something is missing
Start with the known estate and advisories. Assess tool compatibility offline before production use.
Topic reference: NIST SP 800-82 Rev. 3; Sections 6.2.11 and 6.3.2.4; PDF page 141. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are patch decisions based on operational and security risk?
Record applicability, vendor advice, testing, deployment windows and rollback. Where a patch is delayed or unavailable, capture the reason, interim protection and date for reconsideration.
Evidence to gather
Patch decisions, offline test results, exception owner and planned maintenance window.
If something is missing
Ask knowledgeable OT personnel to decide the treatment. Avoid an automatic office-IT patch schedule for OT.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.11; PDF page 141. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are unsupported components managed as a continuing risk?
Old equipment may remain necessary for the process. Identify support status, exposure, spare availability and feasible protective measures. An upgrade plan should account for engineering dependencies, not just the software version.
Evidence to gather
Support/lifecycle register, compensating controls, replacement plan and approved risk decisions.
If something is missing
Assign an owner to each important unsupported component and define the next review milestone.
Topic reference: NIST SP 800-82 Rev. 3; Section 5.1.1 and section 6.2.11; PDF page 84. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are maintenance tools and vendor laptops controlled?
Service equipment and software can carry changes or malicious content into the OT environment. Record which tools are approved, how their origin is checked and how maintenance activities are logged.
Evidence to gather
Approved tools, vendor software provenance, maintenance authorizations and activity records.
If something is missing
Review the maintenance entry process with the equipment owner before the next service visit.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.5; PDF page 134. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are removable media and portable equipment handled consistently?
Identify how USB devices, portable drives and other media enter, move through and leave the environment. Include authorization, labeling, storage and the treatment of sensitive configuration files.
Evidence to gather
Media procedure, permitted devices, transfer records and storage/sanitization arrangements.
If something is missing
Establish an approved transfer route that engineers can use rather than an impractical undocumented workaround.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.7; PDF page 136. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Is malware protection compatible with the control applications?
Security software and signature updates can affect performance or essential files. Identify supported protection, exclusions, update arrangements and the measures used where agents cannot safely operate.
Evidence to gather
Vendor compatibility guidance, protection configuration, exceptions and update/test records.
If something is missing
Review changes with engineering and the vendor before enabling new scans or endpoint agents.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.3.2.3; PDF page 148. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Do the available logs cover important changes and access?
List the sources actually recording activity, the events retained and the retention period. A configured log source may still have capacity, export or collection gaps. Protect the records needed for later analysis.
Evidence to gather
Sample logs, logging configuration, retention/capacity settings and access controls.
If something is missing
Confirm one representative event is retained through the collection path using an approved verification method.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.6.1; PDF page 135. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Can timestamps be compared across the relevant systems?
Record time sources, time zones and known clock differences. Accurate time supports troubleshooting and event correlation, but changes to time services can also affect control functions and need engineering review.
Evidence to gather
Time configuration, source dependencies, clock checks and known limitations.
If something is missing
Document discrepancies before changing clocks. Have engineering approve any synchronization change.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.12; PDF page 142. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Who receives and acts on an OT security alert?
A monitoring system is useful only when the team understands normal behavior and can act on meaningful deviations. Identify escalation, operating context and response arrangements for remote or unstaffed sites.
Evidence to gather
Alert rules, normal-activity baselines, duty contacts and representative handling records.
If something is missing
Choose a representative scenario and confirm the response path through an approved tabletop or review.
Topic reference: NIST SP 800-82 Rev. 3; Sections 6.3.1-6.3.3; PDF page 144. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Is the organization able to recover the important configurations?
Include controller logic, HMI files, network configurations and the tools and licenses needed to use them. A successful file copy is not the same as a demonstrated working restoration.
Evidence to gather
Backup inventory, versions, engineering dependencies and recent restore evidence.
If something is missing
Use the OT backup checklist to identify missing recovery dependencies before scheduling a safe exercise.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.4.3; PDF page 129. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are recovery objectives and startup dependencies agreed?
Define the tolerable outage and data loss for the important functions. Restoration order may depend on power, communications, safety checks and equipment availability rather than simply restoring servers first.
Evidence to gather
Approved RTO/RPO, startup sequence, dependencies and available spares.
If something is missing
Have operations validate the recovery sequence and identify assumptions that have not been demonstrated.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.4.5; PDF page 131. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Does the incident plan cover safe containment and continuity?
Disconnecting a suspected device may interrupt an essential process or remove operator visibility. The plan should connect security decisions to operational authority, safety conditions and alternatives such as controlled manual operation.
Evidence to gather
Incident plan, decision authority, safe operating limits and emergency contacts.
If something is missing
Walk through a plausible scenario with engineering and operations before relying on a generic IT playbook.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.4.5, OT-specific guidance; PDF page 133. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Have the relevant people practiced their roles?
Operators, maintainers, IT, security and outside providers need to know their part in an incident or recovery. A policy acknowledgement alone does not demonstrate that the plan can be executed under pressure.
Evidence to gather
Role-specific training, exercise records, lessons and outstanding actions.
If something is missing
Plan an authorized tabletop that includes the important operational decisions and external dependencies.
Topic reference: NIST SP 800-82 Rev. 3; Sections 3.3.5 and 6.2.4.5; PDF page 58. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are power and environmental dependencies included?
Cooling, reliable power and environmental protection support the control equipment. Record what happens during a power interruption, how equipment reaches a safe state and who maintains the supporting protection.
Evidence to gather
Power/UPS arrangements, environmental monitoring and maintenance records.
If something is missing
Review critical dependencies with facilities and engineering without changing live power or safety systems.
Topic reference: NIST SP 800-82 Rev. 3; Section 6.2.4.4; PDF page 130. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are significant exceptions assigned and revisited?
Some recommended protections may be impractical on a particular device. Record the limitation, the accepted risk, interim measures and the decision owner. An exception should remain visible after the assessment is filed.
Evidence to gather
Risk/exception register, approvals, treatment actions and review dates.
If something is missing
Agree on a risk-based action plan and who can accept unresolved exposure.
Topic reference: NIST SP 800-82 Rev. 3; Sections 3.3 and 4.3.5; PDF page 54. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date: