We verify the security of critical control systems.
OTSENTINEL assesses, reviews and verifies OT security for asset owners, EPC contractors and system integrators across the Middle East and India: power, water, renewables, oil & gas and other critical infrastructure, against IEC 62443 and the national rules where you operate.
Won a project with an OT security scope? We become your OT security team.
Many contractors and integrators across the Middle East and India win projects where the owner requires OT cybersecurity, but have no OT security specialists in-house. Buying a monitoring product rarely covers the whole requirement. The owner still expects cybersecurity documents, tests and compliance at every stage. We deliver that part for you, stage by stage.
| Project stage | What the owner asks for | How OTSENTINEL helps |
|---|---|---|
| Bid | Cybersecurity section of the technical offer, compliance statement | Tender cybersecurity section, compliance matrix against the specification |
| Design | Security philosophy, zone and conduit design, risk assessment, remote access design | OT security engineering documents, risk register, remote access design review |
| FAT / SAT | Cybersecurity test procedures, firewall validation, hardening evidence, witnessed tests | Test procedures, hardening checklists, witnessing and test reports |
| Handover (TOC / FAC) | Verified asset inventory, backups, policies, final cybersecurity acceptance | Asset inventory check, backup readiness audit, policies and procedures, final compliance statement |
| Compliance | Owner requirements and national rules (Qatar ICS standard, Saudi OTCC, UAE, Oman, Kuwait, India CEA and others) | Gap assessment and national standards compliance review |
Asset owners use the same services with us as their independent OT security inspector at FAT, SAT, TOC and FAC. On any one project we work for one side only.
Where do you need help?
We won a project with an OT security scope
Your owner expects cybersecurity documents, tests and compliance. We work as your OT security team from bid to final acceptance.
See how we help →We need an OT cybersecurity audit
A structured assessment against IEC 62443 and your national rules: Qatar, Saudi Arabia, UAE, Oman, Kuwait, Bahrain, India's CEA regulations and more.
See how we help →We need an OT security inspector for FAT, SAT, TOC or FAC
Independent cybersecurity inspection and witnessing at each project milestone, so it is accepted on evidence.
See how we help →We want our substations reviewed
Security review of substation control systems, their link to the control centre and every external connection.
See how we help →We don't know who can access our systems remotely
A review of every remote and vendor access path, the controls in place and the logs, plus a clear remote access policy.
See how we help →We don't have a reliable OT asset inventory
Set up from scratch, cleaned up after a monitoring tool is installed, or checked at project handover.
See how we help →We need a proper OT risk register
Set up from scratch or streamlined: risks linked to real assets and consequences, with owners and actions.
See how we help →Are our backups really ready?
An audit of OT backups, schedules and restore evidence: one-off, at handover or every six months.
See how we help →We need OT security policies and procedures
Remote access, change management, backup, incident response and more: written for the plant and ready for audit.
See how we help →Our services, one standard of evidence
Project Lifecycle Cybersecurity Support & Inspections
OT security support and inspection at every project stage: scope of work, bid, design, FAT, SAT, TOC and FAC.
Details →Per project stage, or a monthly fee on longer projectsIntegrator & EPC Compliance Support for Project Delivery
We work on your side to deliver a project that meets IEC 62443, the owner's specification and national standards.
Details →3–5 weeks per site, depending on scopeOT Cybersecurity Audit, Gap Assessment & National Standards Compliance
Assess your control systems against IEC 62443 and the national critical-infrastructure rules of each country where you operate.
Details →Per substation design, test event or in-service substation; lower price for repeat designsSubstation Control System Security Review
Security review of substation control systems, their link to the control centre and every external and remote connection.
Details →Review, policy pack, or both; optional yearly checkRemote Access Security Review & Policy
Find every remote and vendor access path, check the security in place and set a clear remote access policy.
Details →Fixed price per package: set-up, clean-up and prioritisation, or project asset checkOT Asset Inventory Services
Set up your OT asset inventory, clean it up after a monitoring tool is installed, or check it at project handover.
Details →Fixed-scope project, optional periodic review supportOT Risk Register Set-up & Streamlining
We set up a working OT cybersecurity risk register, or fix one that isn't managed properly, and hand it over to your team.
Details →3–4 weeks per unit or system, depending on scopeOT Security Engineering Documents
IEC 62443 project documentation: security philosophy, zone and conduit design, risk assessment and compliance matrices.
Details →2–6 weeks for a full set; single policies from a few daysOT Security Policies & Procedures
Practical OT cybersecurity policies and procedures your engineers can follow and your auditors will accept.
Details →One-off audit, handover check, or every six months on a yearly contractOT Backup & Restore Readiness Audit
Verify that your control systems have proper, scheduled and complete backups, and that restore is ready.
Details →Day rate under a framework agreement, or fixed price per work packageOT Specialist Support for Consulting & Audit Firms
An experienced OT security specialist for your audit and assessment teams.
Details →Monthly fee for set days per month, 6 to 12 month contractResident & Part-time OT Security Lead
An experienced OT security lead for a set number of days per month, or for a fixed period.
Details →From a few days to an ongoing retainerOT Cybersecurity Review & Advisory
Targeted reviews, supplier assessments, incident response plans and exercises for OT teams.
Details →Cybersecurity assurance at every project stage
Most cybersecurity problems on projects are cheapest to fix early. We review each milestone against the specification and standards, for the owner or for the contractor, so nothing reaches handover unchecked.
- FEEDConcept / FEED
- SOWScope of work & specification
- BIDBidder offer evaluation
- DESDetailed design
- FATFactory acceptance test
- SATSite acceptance & commissioning
- TOCTake-over certificate
- FACFinal acceptance certificate
Why independent assurance
No product to sell
We don't resell hardware, software or licences. Our recommendations follow the risk, not a catalogue.
A second pair of eyes
A control-system vendor can't credibly verify its own design. We give owners and EPCs an independent view they can rely on.
Engineering first
Plant safety and availability come before everything. We assess, review, document and witness. We never make hands-on changes to live systems: your team or your vendor does that.
Critical infrastructure we work in
Our methods apply wherever industrial control systems run essential services. We lead with power, water and renewables, where our experience is deepest, and work in other sectors with specialist partners.
Where we work: the Middle East and India
Assessed against the rules that apply to you
How an engagement runs
Scope
Agree the systems, standards, deliverables, acceptance criteria and how your data is handled.
Collect
Gather drawings, architecture, configurations and interviews through an agreed, secure channel.
Assess
Evaluate against IEC 62443 and the applicable national rules. Every finding is tied to evidence and a clause.
Report
A findings register, risk ratings and a prioritised remediation roadmap, reviewed with your team.
Support
Clarifications, re-checks of fixes and support through acceptance, FAT and SAT.
New to OT security?
Short, practical guides for managers and engineers: why control systems need different protection, and what every operator of critical infrastructure should have in place.
Your data stays protected
We sign an NDA before any data changes hands, use encrypted channels you approve, never put client data into public AI tools, and return or delete everything at the end of the engagement.
Insights
All insights →Why independent assurance matters for OT security
On most projects the vendor designs, builds and tests the control-system security. Here is why owners benefit from an independent check, and what it should cover.
Read →Preparing for an OT cybersecurity audit: what to gather
A practical checklist of documents and decisions that make an OT security audit faster, cheaper and more useful.
Read →Zones and conduits in IEC 62443: a practical introduction
Zones and conduits are the backbone of IEC 62443 system design. A short guide to what they are, how security levels attach to them, and where projects usually go wrong.
Read →