# OT Security Assessment Aligned to IEC 62443 > Source: https://netray.co/tools/ot-security-iec-62443-readiness-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A quick maturity self-assessment for plant OT security that follows the main themes of IEC 62443, with a score band and prioritised actions. ## Category compliance-legal ## Industry Discrete Manufacturing ## Audience - IT manager - OT engineer - CISO - Plant manager ## Tool **Kind:** assessment **Questions:** #### How complete is your inventory of OT assets (PLCs, HMIs, switches, engineering stations)? **Help:** IEC 62443 style risk work starts with knowing what is on the network. **Options:** ##### No inventory, or only an old spreadsheet **Score:** 0 ##### Partial inventory, updated occasionally **Score:** 1 ##### Complete inventory with owner and location, updated yearly **Score:** 2 ##### Complete inventory kept current, with firmware versions and support dates **Score:** 3 #### How is the plant network divided into zones and conduits? **Options:** ##### Flat network, office and plant share it **Score:** 0 ##### Some VLANs but no filtering between them **Score:** 1 ##### Zones with firewalls between plant and enterprise networks **Score:** 2 ##### Documented zones and conduits, default deny, industrial DMZ in place **Score:** 3 #### How are user accounts handled on OT systems? **Options:** ##### Shared logins and default passwords are common **Score:** 0 ##### Mix of named and shared accounts **Score:** 1 ##### Named accounts with role based access on most systems **Score:** 2 ##### Named accounts, multi-factor for remote and privileged access, regular access reviews **Score:** 3 #### How do you handle patches and firmware updates for OT systems? **Help:** IEC 62443-2-3 covers patch management for control system environments. **Options:** ##### No process, patches rarely applied **Score:** 0 ##### Ad hoc, mostly at vendor request **Score:** 1 ##### Defined schedule with vendor compatibility checks and a test step **Score:** 2 ##### Tracked vulnerabilities per asset, tested patching, documented compensating controls where patching is impossible **Score:** 3 #### How is remote access by vendors and integrators controlled? **Options:** ##### Always-on VPN or remote tools straight into the plant **Score:** 0 ##### VPN with shared credentials **Score:** 1 ##### Named accounts through a jump host with approval **Score:** 2 ##### Time-boxed, approved, multi-factor, logged or recorded sessions via the DMZ **Score:** 3 #### What monitoring exists for OT network activity? **Options:** ##### None **Score:** 0 ##### Firewall logs kept locally, rarely reviewed **Score:** 1 ##### Central logging from plant firewalls and servers **Score:** 2 ##### Central logging plus passive OT monitoring and alert triage **Score:** 3 #### How ready are you to respond to a cyber incident that stops production? **Options:** ##### No plan **Score:** 0 ##### Generic IT incident plan only **Score:** 1 ##### OT specific plan with contacts and isolation steps **Score:** 2 ##### OT plan exercised in the last 12 months with manual operations fallback **Score:** 3 #### Are backups of OT configurations (PLC programs, HMI projects, switch configs) tested? **Options:** ##### No backups **Score:** 0 ##### Backups exist on engineering laptops **Score:** 1 ##### Central backups, restore not tested **Score:** 2 ##### Central versioned backups with restore tests at least yearly **Score:** 3 #### Has a documented security risk assessment been done for the plant systems? **Help:** IEC 62443-3-2 describes risk assessment for system design, including target security levels. **Options:** ##### Never **Score:** 0 ##### Informal discussion only **Score:** 1 ##### Documented once, not refreshed **Score:** 2 ##### Documented with target security levels per zone and refreshed after major changes **Score:** 3 #### Do purchase specifications and supplier contracts include security requirements for new OT equipment? **Help:** IEC 62443-4-1 and 4-2 describe secure development and component requirements that buyers can ask for. **Options:** ##### No security requirements **Score:** 0 ##### Mentioned informally by IT **Score:** 1 ##### Standard clause covering passwords, patching and remote access **Score:** 2 ##### Requirements tied to IEC 62443 references and checked at acceptance **Score:** 3 **Bands:** #### Exposed **Min:** 0 **Max:** 24 **Verdict:** Basic controls are largely missing. A single infected laptop or exposed vendor connection could reach production systems. **Recommendations:** - Build an asset inventory before anything else - Put a firewall between the office network and the plant, deny by default - Replace default and shared passwords on the most critical systems - Close always-on vendor remote access and route it through a controlled jump host #### Basic **Min:** 25 **Max:** 49 **Verdict:** Some controls exist but they are inconsistent between plants or systems. Gaps in access, patching and response are likely. **Recommendations:** - Document zones and conduits and remove any-any firewall rules - Introduce named accounts and multi-factor authentication for remote access - Write an OT incident plan with isolation steps and a manual operations fallback - Start central backups of PLC and HMI projects and test one restore #### Developing **Min:** 50 **Max:** 74 **Verdict:** A reasonable foundation is in place. The next gains come from monitoring, tested patching and a documented risk assessment. **Recommendations:** - Run a zone based risk assessment and set target security levels - Add central logging and passive OT monitoring - Exercise the incident plan with plant staff, not only IT - Add security clauses to equipment purchase specifications #### Established **Min:** 75 **Max:** 100 **Verdict:** Controls are defined and mostly practised. Focus on evidence, regular review and independent assessment against the standard if customers require it. **Recommendations:** - Schedule yearly reviews of firewall rules, accounts and the asset inventory - Consider an independent IEC 62443 gap assessment for key sites - Track metrics such as patch age and remote session counts - Extend the programme to newly acquired plants ## Content **Intro:** IEC 62443 is the main family of standards for industrial automation and control system security. This ten-question self-assessment borrows its themes (zones, access, patching, monitoring, response, supplier requirements) so an IT manager can see roughly where the plant stands before paying for a formal assessment. **Sections:** #### How to use this assessment **Body:** Answer based on what is true on the plant floor today, not on policy documents. If plants differ, run it once per plant and compare. The score is a percentage of the maximum, mapped to four bands. It is a screening tool: it will not certify anything and it does not replace a formal risk assessment, but it helps decide how much to invest and where to start. **Bullets:** - Ask the plant electrician or controls engineer to answer with you - Pick the answer that is true for most systems, not the best one - Re-run after each major project to track progress #### What IEC 62443 covers **Body:** The series has four groups. General covers terminology and concepts. Policies and procedures covers the security programme of asset owners (62443-2-1), service providers (2-4) and patch management (2-3). System covers risk assessment (3-2) and system security requirements with security levels (3-3). Component covers secure product development (4-1) and technical requirements for components (4-2). Security levels run from 1 to 4, describing protection against increasingly capable attackers. See the reference table in the related tools for a summary of each part. #### How to read your band **Body:** Exposed and Basic results mean investment in fundamentals pays back fastest: inventory, segmentation, account hygiene and remote access. Developing means you can move toward risk based decisions, such as setting a target security level for each zone. Established means you should collect evidence, test response and consider external assessment if customers in aerospace, defense or automotive supply chains ask for it. A high score on policy with a low score on patching or monitoring usually signals a gap between paper and practice. #### Common mistakes **Body:** Treating OT like office IT is the most common error: aggressive scanning or untested patching can stop a line. Another is assuming air gaps still exist when ERP, MES and remote support links have quietly bridged them. Teams also confuse compliance with security, collecting documents without changing controls. Finally, many plants forget suppliers: a new CNC or inspection system arrives with default passwords and a vendor modem unless the purchase specification says otherwise. **Cta:** If you want to connect your ERP to shop floor data without adding risk to Level 2 systems, Netray can review the integration design. We build read-only, on-premise options. **Faq:** #### Does this assessment make us IEC 62443 compliant? **Answer:** No. It is a self-assessment that follows the standard's themes. Formal conformance involves documented processes, defined security levels and often an independent assessor. Use the score to plan, not to claim compliance. #### Who should answer the questions? **Answer:** A mix of IT, controls engineering and plant maintenance. IT knows firewalls and accounts, but only the controls team knows how PLCs and HMIs are really maintained. Disagreements between them are useful findings. #### What is a target security level? **Answer:** In IEC 62443-3-2, a risk assessment sets a target security level (SL-T, from 1 to 4) for each zone. Later you compare it with the capability of components and the achieved level of the system. #### Is IEC 62443 mandatory for manufacturers? **Answer:** Not in itself in most places. It is a voluntary standard, but customers, insurers and regulations such as NIS2 in Europe may point to it or to similar controls. Check your own contractual and legal obligations. ## Search terms ot security assessment, iec 62443 assessment, iec 62443 gap analysis template, ot cybersecurity maturity assessment, industrial control system security assessment, manufacturing cybersecurity assessment, iec 62443 self assessment, ics security checklist manufacturing --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json