Most of the time in an OT cybersecurity audit is spent finding information. Owners who prepare the basics in advance get a faster audit and better findings. Here is what to gather before the assessor arrives.
Scope and responsibilities
- Which sites, systems and networks are in scope, and which are explicitly out
- Who owns each system, and who the vendor and maintenance contacts are
- The standards and regulations you need to show compliance with
Architecture and assets
- Current network architecture drawings, including the IT/OT boundary and any demilitarised zone
- An asset inventory: controllers, HMIs, servers, network devices and their software versions
- Any existing zone and conduit model or segmentation description
Access and connectivity
- All remote access paths, including vendor access, and how they are approved
- Wireless, cellular and satellite links
- How removable media and maintenance laptops are controlled
Policies and procedures
- OT security policy and procedures, if separate from IT
- Patch and backup procedures, and evidence that backups are tested
- Incident response plan and contacts for OT incidents
- Change management records for recent control-system changes
Previous findings
- Earlier audit reports and the status of their actions
- Vendor security advisories that apply to your systems
Practical arrangements
- How documents will be shared securely, and how long the assessor may keep them
- Whether any on-site observation is allowed, and under what supervision
- Who will sign off the scope and accept the final report
An audit is only as good as the evidence behind it. Preparing these items turns the audit from an information hunt into a useful conversation about risk.