Which controls are legally mandatory depends on your country, sector and whether you're designated as critical infrastructure. Our Standards page lists the national rules. Whatever the regulation, the same essentials appear in IEC 62443, NIST SP 800-82 and national frameworks. If any of these are missing, they are where to start.
Governance
- Named ownership: a senior person accountable for OT security, with clear roles between IT, operations, engineering and vendors.
- OT security policy and procedures approved by management and reviewed regularly.
- Risk assessment of critical systems, repeated after significant changes.
Know and segment your systems
- Asset inventory: every controller, workstation, network device and software version, kept current.
- Network segmentation: zones and conduits with controlled boundaries, and an industrial DMZ between IT and OT.
- No direct internet access to control systems.
Control access
- Secure remote access: a single controlled route, multi-factor authentication, approval for each session and recording of vendor sessions.
- Account management: unique accounts, least privilege, prompt removal of leavers, no shared default passwords.
- Physical security of control rooms, cabinets and network equipment.
Keep systems hardened
- Secure configuration baselines with unused ports and services disabled.
- Vulnerability and patch management that is risk-based and planned with the vendor, with compensating controls where patching isn't possible.
- Malware protection and removable media control suited to OT, including checks on maintenance laptops and USB devices.
Detect and respond
- Logging and monitoring of security events at key boundaries and critical systems.
- OT incident response plan that covers safe manual operation, and is exercised with tabletop drills.
- Incident reporting within the time your regulator requires.
Recover
- Backups of configurations, logic and system images, stored offline and restored in tests.
- Recovery plans with the vendor contacts and spare parts needed to rebuild.
Manage change and suppliers
- Change management that includes a security review of control-system changes.
- Supplier security requirements in contracts, including for remote support and new projects (IEC 62443-2-4).
- Security built into projects from the specification onwards, verified at FAT and SAT.
People and assurance
- Training for engineers, operators and contractors on OT-specific risks.
- Periodic independent audit against your standard and regulator's requirements, with tracked remediation.
These are the foundations. An independent assessment shows which are in place, which are missing and what to fix first.