ICS and OT Security Assessment

Not every operational technology environment answers to a federal directive, but the underlying problem is the same one those directives were written to address: a SCADA or ICS network that can't tolerate the same patching and scanning cadence as a corporate network, running processes that don't get to go down for a security finding. This ICS security assessment applies the same passive-by-design methodology built for regulated pipeline work to any control environment that wants an independent read on where it stands, structured against NIST SP 800-82r3, IEC 62443, and NIST CSF 2.0.

What gets assessed

• PLCs, RTUs, and other controllers, identified by model and firmware version where the evidence shows it
• HMIs, engineering workstations, historians, and the servers that run the SCADA or DCS platform
• The IT/OT boundary: firewall rules, the DMZ if there is one, and every path between the corporate and control networks
• Remote access for vendors and integrators: jump hosts, VPNs, and how each connection is approved and removed
• Network architecture inside OT: switching, routing, and how zones are separated today
• Procedures as they apply to the control environment: patching, backups, account management, and incident response

If segmentation is the specific question, planning a project or reviewing a design a vendor has already proposed, see IT/OT segmentation design and review instead.

How an engagement runs

1. Scoping call. Confirm the environment and sites, what's already documented, and what's driving the assessment, whether that's a board-level risk question, an insurance requirement, or never having had an independent read on the program.
2. Document and architecture review. Network diagrams, asset registers, firewall configurations, and existing policies are reviewed before anyone goes on site.
3. Site walkdown and passive capture. Control rooms and network cabinets are reviewed in person, and traffic is captured from SPAN ports or network taps to show what is actually talking to what.
4. Configuration audit. Device configurations, firmware versions, and firewall rule sets are checked against what the architecture is supposed to allow.
5. Findings readout. Your team walks through the findings before the final report is issued, so nothing in it comes as a surprise.

What you get

• An asset inventory built from capture and configuration data, with firmware versions where they're visible
• A current-state network diagram and a target zone-and-conduit model, the segmentation approach IEC 62443 is built around
• Findings mapped to NIST SP 800-82r3, IEC 62443, and NIST CSF 2.0, with the relevant MITRE ATT&CK for ICS techniques noted
• A prioritized remediation list that separates configuration changes from work that needs a project

Windlass is based in Houston, on-site for Gulf Coast operators and remote-capable everywhere else.

Who this is for

Windlass works with operators running SCADA or ICS environments who want a vendor-neutral read on where their program stands: refining and petrochemical, terminals and midstream, power generation and utilities, and other critical-infrastructure operators. If TSA has notified your pipeline system, hazardous liquid line, or LNG facility that it's critical, see the TSA pipeline cybersecurity page instead, which builds the same assessment around what those directives specifically require.

Why passive-by-design matters

An OT network runs equipment, not just data. Active scanning built for IT can lock up a remote terminal unit, a PLC, or a fuel controller that was never built to absorb it, and none of those devices give you a quiet way back once that happens. Architecture review, configuration audit, and protocol capture build the same picture without putting the process at risk.

Windlass is passive first and doesn't run penetration tests or generic active scans against OT devices. Active testing does have a place in OT, during factory acceptance testing, on a test bed, or in a planned outage, as covered in active vs. passive vulnerability scanning in OT. If your team or an integrator runs that kind of testing, the assessment can review those results alongside its own findings.

Frequently asked questions