On a typical new plant or control-system upgrade, the cybersecurity scope sits inside the automation vendor's package. The same organisation writes the security design, configures the system and runs the security tests. That is efficient, but it leaves the owner with one question unanswered: who checks the work?
The gap independent assurance fills
A vendor has every incentive to deliver a secure system, but also to finish on time and within budget. Where requirements are ambiguous, the interpretation that is easiest to build tends to win. An independent reviewer reads the same specification on the owner's behalf.
Independent assurance is not an audit of the vendor's competence. It is a structured check that the delivered system matches what the owner specified, so that issues are found before acceptance rather than after handover.
What a good assurance scope covers
- Requirements review: are the cybersecurity requirements in the specification clear, testable and aligned with the standards that apply?
- Design review: do the vendor's zones, conduits, remote access, hardening, logging and backup arrangements meet those requirements?
- Document review: a comment register that tracks every issue to closure.
- Test procedures: security test cases for factory and site acceptance that prove the requirements, not just the features.
- Witnessing: an independent observer at FAT and SAT, recording results against each requirement.
What it should not do
Independent assurance should not redesign the system or slow the project with new requirements. The reviewer's job is to verify against the agreed specification, raise issues early, and help the owner accept the system with confidence.
When to bring it in
The earlier the better. Reviewing requirements before the design freezes costs little and prevents expensive changes later. At minimum, involve an independent reviewer before the security design is approved and again for FAT.