OT/ICS Security Assessment

Not every operational technology environment answers to a federal directive, but the underlying problem is the same one those directives were written to address: a SCADA or ICS network that can't tolerate the same patching and scanning cadence as a corporate network, running processes that don't get to go down for a security finding. This assessment applies the same passive-by-design methodology built for regulated pipeline work to any OT/ICS environment that wants an independent read on where it stands, structured against NIST CSF 2.0, NIST SP 800-82r3, and IEC 62443.

What this assessment covers

Architecture review maps how IT and OT are actually separated today, not how the diagram says they are, and works toward a defensible zone-and-conduit model, the segmentation approach IEC 62443 is built around. Configuration audit and protocol capture characterize the network without sending it traffic it wasn't built to handle. Findings map against NIST CSF 2.0 and NIST SP 800-82r3 instead of a generic checklist retrofitted after the fact, and come back as a prioritized list, not an unranked scan report. If segmentation is the specific question, planning a project or reviewing a design a vendor has already proposed, see IT/OT segmentation design and review instead.

Who this is for

Windlass works with operators running SCADA or ICS environments who want a vendor-neutral read on where their program stands: refining and petrochemical, terminals and midstream, power generation and utilities, and other critical-infrastructure operators. If TSA has notified your pipeline system, hazardous liquid line, or LNG facility that it's critical, see the TSA pipeline cybersecurity page instead, which builds the same assessment around what those directives specifically require.

Why passive-by-design matters

An OT network runs equipment, not just data. Active scanning built for IT can lock up a remote terminal unit, a PLC, or a fuel controller that was never built to absorb it, and none of those devices give you a quiet way back once that happens. Architecture review, configuration audit, and protocol capture build the same picture without putting the process at risk to prove a finding that passive methods can surface just as well.

What an engagement looks like

Engagements start with a scoping call to confirm the environment, what's already documented, and what's driving the assessment, whether that's a board-level risk question, an insurance requirement, or simply not having an independent read on the program before. From there, the assessment runs against your actual environment. The output is a findings report mapped to NIST CSF 2.0 and IEC 62443, with a prioritized list of what to fix first. Windlass is based in Houston, on-site for Gulf Coast operators and remote-capable everywhere else.

Frequently asked questions