OT Security

Explain how safety, availability, determinism, and long asset lifecycles constrain OT security architecture decisions.

Map an industrial system’s components and trust relationships to the Purdue Model and ISA-95 levels.

Differentiate the security responsibilities of basic process control, safety instrumented, supervisory, and enterprise systems.

Trace plausible attack paths through an integrated IT/OT architecture.

Document assumptions, constraints, and dependencies that affect an OT security design.

Produce a current-state OT security architecture diagram for a representative industrial site.

Differentiate the responsibilities of asset owners, system integrators, product suppliers, and service providers under IEC 62443.

Derive system security requirements from the seven IEC 62443 foundational requirements.

Select a target security level for an industrial zone using consequence and threat information.

Distinguish system-level requirements in IEC 62443-3-3 from component capabilities in IEC 62443-4-2.

Map relevant NIST SP 800-82 guidance to an OT architecture decision.

Create a requirements traceability matrix linking business needs, risks, standards, and technical controls.

Define the minimum data fields and ownership rules for an architecture-grade OT asset inventory.

Select safe asset-discovery methods for different OT operational constraints.

Reconcile passive discovery results with controller inventories, switch data, and configuration records.

Build a communication baseline from an industrial packet capture.

Create a data-flow diagram covering site, enterprise, vendor, and cloud connections.

Identify undocumented assets, flows, and dependencies from inventory and network evidence.

Rank OT assets and functions by safety, operational, environmental, financial, and regulatory consequence.

Construct an OT attack scenario using MITRE ATT&CK for ICS techniques.

Build an attack tree for a high-consequence industrial process outcome.

Estimate likelihood and impact when OT incident data is incomplete.

Prioritize risk treatments using consequence, exploitability, exposure, and existing safeguards.

Convert a threat scenario into testable security architecture requirements.

Define IEC 62443 zones based on function, criticality, trust, and target security level.

Specify conduits using required data flows, protocols, directionality, and security controls.

Design an industrial DMZ that mediates historian, remote-access, update, and file-transfer services.

Evaluate physical segmentation, VLANs, VRFs, firewalls, and microsegmentation for an OT use case.

Design segmentation controls that preserve MRP, PRP, HSR, and other availability requirements.

Validate a firewall rule base against approved conduit requirements.

Identify shared infrastructure dependencies that could bypass or weaken OT segmentation.

Design identity boundaries between enterprise and OT directory services.

Create an OT role-based access model for operators, engineers, administrators, vendors, and applications.

Design a privileged-access workflow using MFA, jump hosts, approval, session recording, and time limits.

Evaluate vendor remote-access patterns against operational and security requirements.

Define lifecycle controls for OT service accounts, shared accounts, and machine identities.

Design break-glass access that preserves accountability during operational emergencies.

Create a disruption-aware hardening baseline for OT Windows and Linux hosts.

Specify security controls for HMIs, engineering workstations, PLCs, RTUs, and IEDs according to their capabilities.

Select application allowlisting and endpoint-protection patterns for an OT environment.

Design compensating controls for industrial protocols that lack native authentication or encryption.

Configure a security architecture pattern for OPC UA certificates, trust lists, and secure endpoints.

Design secure MQTT broker connectivity using client identity, authorization, and TLS.

Define an OT certificate and key-management approach for constrained and long-lived assets.

Select passive sensor locations using zones, conduits, redundancy, and traffic visibility requirements.

Define an OT telemetry architecture covering network, host, identity, firewall, application, and controller evidence.

Write protocol-aware detection hypotheses for suspicious Modbus, DNP3, OPC UA, and MQTT activity.

Design secure OT-to-SIEM log transport and retention across trust boundaries.

Establish a behavioral baseline without treating normal maintenance as malicious activity.

Map detection coverage and gaps to MITRE ATT&CK for ICS techniques.

Design trustworthy time synchronization for event correlation and forensic analysis.

Choose safe vulnerability-identification methods for assets with different operational tolerances.

Decide when authenticated scanning, passive assessment, configuration review, or offline testing is appropriate.

Prioritize OT vulnerabilities using consequence, exposure, exploitability, and compensating controls.

Design a patch workflow covering testing, maintenance windows, deployment validation, and rollback.

Assess supplier development and component-security evidence using IEC 62443-4-1 and IEC 62443-4-2.

Use SBOM and VEX information to evaluate software-component exposure.

Create an end-of-life risk treatment plan for unsupported OT assets.

Identify minimum viable operations and recovery dependencies for a representative industrial process.

Evaluate whether redundancy introduces common-mode cyber failure paths.

Design an OT backup architecture for configurations, logic, images, keys, and operational data.

Define evidence-preservation requirements for OT incident investigation.

Create an OT ransomware response playbook that accounts for safety and production constraints.

Create a response playbook for unauthorized controller logic or setpoint changes.

Validate recovery priorities against RTO, RPO, safety, and process restart requirements.

Evaluate edge-to-cloud connectivity patterns for industrial telemetry and remote services.

Design security controls for an industrial edge gateway and message-broker deployment.

Determine when a unidirectional gateway or data diode is appropriate and identify its limitations.

Apply zero-trust principles selectively to identities, devices, applications, and flows in OT.

Choose compensating controls for brownfield assets that cannot meet target requirements.

Build a phased migration roadmap from a current-state to a target-state OT architecture.

Elicit business, operational, safety, compliance, and technical requirements for a simulated industrial site.

Produce a current-state assessment that identifies architecture gaps and high-consequence attack paths.

Design a target-state OT security architecture with zones, conduits, identity, monitoring, and resilience controls.

Allocate security requirements to network, endpoint, application, process, and procedural safeguards.

Create architecture decision records that explain major design alternatives and trade-offs.

Validate the target architecture against threat scenarios, failure modes, and IEC 62443 requirements.

Build a risk-ranked implementation roadmap with dependencies, quick wins, and longer-term investments.

Present and defend the architecture to both engineering leaders and business stakeholders.