OT Cybersecurity Assessment and Penetration Testing for Industrial Control Systems
OT cybersecurity assessment for plants, utilities, and facilities that run PLCs, DCS, SCADA, and safety systems. We assess your operational technology against ISA/IEC 62443 and NIST SP 800-82, test the paths an attacker would use to reach it, and give you a risk-ranked roadmap. Testing is passive first and agreed with your engineers, so production and safety come before findings.
What Is an OT Cybersecurity Assessment?
An OT cybersecurity assessment checks how well the systems that run physical processes are protected from cyber attack. It covers controllers, HMIs, engineering workstations, historians, safety systems, and the networks that connect them, measured against ISA/IEC 62443 and NIST SP 800-82. The result is a list of risks ranked by what could happen to people, the plant, and production.
OT is not IT with older computers. Availability and safety come first, systems run for decades, and a routine network scan can stop a controller. That is why an OT assessment starts with documents, interviews, and passive traffic analysis, and why any active testing is planned with the plant team.
Accredify Global assesses where your OT security stands and how an attacker could reach it, then gives you a roadmap your engineering, operations, and IT teams can act on. If your process safety team has run a Cyber PHA, we build on its results.
OT Security in 2026: Updated Standards and Wider Regulation
The guidance has been refreshed. NIST published SP 800-82 Revision 3 in September 2023, widening it from industrial control systems to OT in general, including building automation and physical access systems. It adds an OT overlay of security controls for low, moderate, and high impact systems. IEC 62443-2-1, the security program standard for asset owners, was reissued as Edition 2 in 2024.
Safety and security are now assessed together. ISA TR84.00.09, updated in 2024, explains how to build cybersecurity into the safety lifecycle for safety controls, alarms, and interlocks. Many operators now run a Cyber PHA alongside their process hazard analysis.
Regulation is reaching OT. In the EU, the NIS2 Directive covers energy, transport, water, manufacturing, chemicals, and food, among others. Insurers and large customers increasingly ask for evidence of OT security as well.
Sources: NIST SP 800-82r3 · IEC 62443-2-1:2024 · ISA TR84.00.09-2024 · Cyber PHA (ISA InTech)
OT Security Controls, and the Evidence We Look For
The areas where OT environments most often fall short, mapped to ISA/IEC 62443.
| Area | What good looks like | Evidence we look for |
|---|---|---|
| Asset inventory | Every controller, HMI, workstation, and network device known, with firmware versions | An inventory that matches what passive monitoring sees |
| Zones and conduits | Systems grouped by risk, with controlled connections between them | Architecture drawings, firewall rules, and real traffic |
| IT/OT boundary | A DMZ between business and control networks, with no direct paths | Rule reviews and tests of the paths across it |
| Remote and vendor access | Brokered, logged, time-limited access with multi-factor authentication | Access records, accounts, and session controls |
| Accounts and passwords | No shared or default credentials on controllers and HMIs | Account lists and configuration samples |
| Patching and legacy systems | Risk-based patching, with compensating controls where patching isn't possible | Vulnerability records and compensating control evidence |
| Monitoring and response | OT-aware monitoring and an incident plan engineers have practiced | Alerts, logs, and exercise records |
| Backup and recovery | Tested backups of controller logic and configurations | Restore test records |
| Safety systems | Safety instrumented systems separated and protected from change | Network separation, key switches, and change records |
OT Penetration Testing Without Putting Production at Risk
OT penetration testing shows whether an attacker could move from the business network, a vendor connection, or a wireless link to the systems that run your process.
What we test
- The IT/OT boundary, DMZ, and the services exposed across it
- Remote access paths, jump hosts, and vendor connections
- Engineering workstations, historians, and HMIs
- Wireless networks and portable media controls on site
- Whether a foothold on the business network can reach control systems
How we keep it safe
- Written rules of engagement agreed with operations before any test
- Passive analysis and configuration review first
- Active tests only on agreed systems, ideally in a test bed or maintenance window
- Plant engineers present, with clear stop conditions
- No active testing against live safety instrumented systems
For business systems and web applications, our VAPT service covers the IT side of the same attack paths. Findings from both can feed an ISO 27001 risk assessment or a cyber security risk assessment.
How Our OT Cybersecurity Assessment Works
Six stages, from the first call to a roadmap your plant and leadership can sign off.
Not sure what can safely be tested at your site, or where to start? A free scoping review answers that first.
Book a free scoping reviewOT Assessment vs IT Penetration Testing
The same goal, a different set of rules.
| Topic | IT penetration test | OT assessment |
|---|---|---|
| First priority | Confidentiality of data | Safety and availability of the process |
| Scanning | Active scanning is routine | Passive first; active only where agreed |
| Systems | Patched often, replaced every few years | Run for decades; patching needs shutdowns |
| Impact measured in | Data loss and downtime | Harm to people, environment, equipment, and production |
| Main reference | ISO 27001, NIST CSF, OWASP | ISA/IEC 62443, NIST SP 800-82 |
| Team | Security testers | Security testers working with plant engineers |
OT Cybersecurity Assessment Cost and Timeline
We do not publish a price list. The cost depends on how many sites, systems, and network zones are in scope and how much testing your plant can safely allow. A free scoping review gives you a tailored proposal.
What shapes the scope
- Sites — how many plants or facilities, and where
- Systems and zones — control systems, vendors, and network segments
- Testing depth — assessment only, or assessment plus penetration testing
- Test environment — whether a test bed or maintenance window is available
- Reuse — existing drawings, inventories, and Cyber PHA results
How long it takes
| Assessment and roadmap | 6–12 weeks, depending on scope |
|---|---|
| On-site work | Planned around your operations and shutdowns |
| Re-test | After fixes, or yearly |
How to Choose an OT Cybersecurity Assessment Provider
Questions worth asking any OT security provider, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Will you scan our live controllers? | Not by default. We start passive, and any active test is agreed in writing first. |
| Do you certify us to IEC 62443? | No. We assess your environment against it. Product and system certification is done by specialist test labs. |
| Do you work with our engineers? | Yes. Testing happens with your plant team, on their schedule. |
| Can findings support NIS2 or ISO 27001? | Yes. We map findings to the frameworks you report against. |
| Do you replace our safety studies? | No. Process safety studies stay with your safety team; we cover the cyber side. |
| How is it priced? | A tailored proposal after a free scoping review. |
What You Receive From an OT Assessment
What is connected, confirmed by real traffic.
Your systems grouped by risk, with target security levels.
The attack paths we tried and what they reached.
Findings mapped to the standard's requirements.
Fixes in order of consequence, with owners.
A plain summary for your board, insurers, and customers.
Frequently Asked Questions About OT Cybersecurity Assessments
Straight answers on standards, safe testing, Cyber PHA, cost, and timeline.
What is OT cybersecurity?
OT cybersecurity protects operational technology, the systems that monitor and control physical processes. That includes PLCs, distributed control systems, SCADA, HMIs, safety instrumented systems, and building automation. Its first goals are safety and keeping the process running.
What does an OT cybersecurity assessment include?
Usually an asset and architecture review, passive network traffic analysis, a review of remote access, accounts, patching, monitoring, and backups, a zone and conduit risk assessment, and optional penetration testing. The result is a risk-ranked roadmap mapped to ISA/IEC 62443.
What is ISA/IEC 62443?
A series of international standards for securing industrial automation and control systems. Part 2-1 covers the asset owner's security program, Part 3-2 covers risk assessment with zones and conduits, Part 3-3 sets system security requirements and security levels, and Parts 4-1 and 4-2 cover product development and components.
What are IEC 62443 security levels?
Security levels describe how strong protection must be. SL 1 protects against accidental misuse, SL 2 against simple intentional attacks, SL 3 against skilled attackers with moderate resources and OT knowledge, and SL 4 against well-resourced, highly motivated attackers. A target level is set for each zone.
Is OT penetration testing safe?
It can be, when it is planned properly. Testing should start with passive analysis, follow written rules of engagement, use a test bed or maintenance window for active tests, have plant engineers present, and avoid live safety instrumented systems. Uncontrolled scanning of live controllers can stop production.
How is OT penetration testing different from IT penetration testing?
IT testing focuses on data and uses active scanning routinely. OT testing puts safety and availability first, tests mainly the paths into control networks, and uses active techniques only where agreed. Impact is measured in harm to people, equipment, and production, not just data.
What is the difference between a Cyber PHA and an OT assessment?
A Cyber PHA is a workshop that links process hazard scenarios to cyber threats, to find where a cyber attack could defeat safeguards. An OT assessment checks the actual security controls and attack paths. They work best together: the Cyber PHA sets priorities, and the assessment tests them.
Does NIST SP 800-82 apply to us?
It is guidance, not a law. NIST SP 800-82 Revision 3, published in September 2023, is widely used to secure OT, including industrial control and building systems, and often sits alongside ISA/IEC 62443 in customer and insurer requirements.
Does NIS2 cover OT?
Yes, for organizations in its sectors. NIS2 requires risk management measures for network and information systems in sectors such as energy, transport, water, manufacturing, chemicals, and food, and that includes the OT those organizations depend on.
Can you certify our plant or products to IEC 62443?
No. We assess your operating environment against IEC 62443 and report the gaps. Certification of industrial products and systems under IEC 62443 schemes is carried out by specialist test labs.
Which industries need OT cybersecurity assessments?
Any organization that runs physical processes with connected control systems, including oil and gas, chemicals, power and utilities, water, manufacturing, pharmaceuticals, food, mining, transport, and large buildings and campuses.
How long and how much does an OT cybersecurity assessment take?
Most assessments take 6 to 12 weeks, depending on sites, systems, and whether penetration testing is included. On-site work is planned around operations. There is no list price; a free scoping review gives you a tailored proposal.
Find the Paths Into Your Control Systems Before an Attacker Does
Tell us about your sites, control systems, and remote access. We'll agree what can be tested safely, how it maps to IEC 62443, and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global compliance team.