Services / OT Security Policies & Procedures
Service
OT Security Policies & Procedures
Regulators and auditors ask for written policies first. We write OT-specific policies and procedures that match how your plant actually runs, aligned to IEC 62443-2-1, NIST SP 800-82 and the national rules that apply to you.
What's included
- OT cybersecurity policy (the top-level policy and governance roles)
- Asset inventory and management procedure
- Patch and vulnerability management policy and procedure
- Remote access and third-party (vendor) access policy
- Account, access control and password management
- Network segmentation and firewall rule management
- Removable media, USB and maintenance laptop control
- Malware protection for OT systems
- Backup, restore and recovery procedure
- Configuration and change management (management of change) for control systems
- Security logging and monitoring procedure
- OT incident response plan, playbooks and regulatory incident reporting
- Physical security of control rooms, cabinets and network equipment
- Supplier and service-provider security requirements (IEC 62443-2-4)
- Security requirements for new projects and modifications
- Wireless, mobile and cloud/IIoT connectivity policy
- Information classification and handling (drawings, configurations, findings)
- Security awareness and training procedure
- OT risk management procedure (linked to the risk register)
- OT business continuity and disaster recovery