From Exposure to Evidence: A Practical 14-Day IT/OT Assurance Plan

Purpose and safety rule

This free programme helps organisations convert assumptions about IT and operational technology controls into documented evidence. It is not a certification, penetration test or substitute for an engineering safety case.

Do not conduct intrusive controller scanning, exploit testing, firmware changes, forced failover or production disruption without written engineering approval, a risk assessment, maintenance window and rollback plan. Passive review and vendor-supported checks are the default.

Accountability

Appoint an executive sponsor, OT engineering authority, IT security lead, site owner and evidence custodian. Each finding needs an owner, affected process, asset/version evidence, consequence, deadline and closure decision.

Fourteen-day schedule

1. Day 1: approve scope, safety boundaries, accountable owners and change restrictions.
2. Day 2: map critical industrial processes and supporting IT services.
3. Day 3: reconcile OT asset, software, firmware and support inventories.
4. Day 4: verify internet exposure and external management interfaces.
5. Day 5: review supplier, contractor and unattended remote-access permissions.
6. Day 6: map privileged accounts, service identities and MFA exceptions.
7. Day 7: validate IT-to-OT firewalls, conduits, DMZs and jump hosts.
8. Day 8: compare installed versions with current vendor advisories and CISA KEV; document applicability.
9. Day 9: test logging, alert ownership, retention and investigation visibility using non-disruptive methods.
10. Day 10: map backup copies, isolation, retention and encryption-key custody.
11. Day 11: conduct an approved isolated restore or tabletop recovery rehearsal.
12. Day 12: exercise escalation and containment authority for an IT-to-OT intrusion scenario.
13. Day 13: rank residual risks, compensating controls and investment needs.
14. Day 14: obtain executive and engineering sign-off on findings and a 30/60/90-day remediation plan.

Evidence standard

The minimum evidence set is a signed process-dependency map, versioned inventory, external-access register, approved trust-boundary diagram, vulnerability applicability record, recovery-test report and prioritised exception register.

Score issues using operational consequence, reachability, exploitation evidence and compensating controls, rather than CVSS alone. Suspected compromise and confirmed internet-exposed exploited vulnerabilities require immediate escalation, not deferral until day 14.

Executive report

Report assets with verified versions, unauthorised remote paths, applicable exploited vulnerabilities, critical services with proven recovery, unresolved unknowns and funded remediation owners. Missing evidence is not evidence of control effectiveness.

Further authoritative guidance

• NIST SP 800-82 Rev. 3: Guide to Operational Technology Security
• CISA KEV catalogue
• CISA ICS advisories

Disclaimer: Adapt this framework to local law, operational safety requirements, vendor instructions and site change governance.