In an office, a service outage is an inconvenience. In a plant or a hospital, an interrupted process authority is a physical risk. So the method inverts here: availability outranks confidentiality, and what counts as a routine test in IT requires express authorisation on the floor.
A conventional network scan can knock a twenty-year-old PLC offline because it handles unexpected packets badly. I have watched it happen. Whoever audits OT has to understand that the usual tooling is the problem, not the solution.
The starting point is almost always the same: nobody has a reliable inventory of what is actually connected to the industrial segment.
Passive identification of assets, protocols and flows: PLCs, HMIs, SCADA, historians, medical devices and everything somebody connected without recording it. This is consistently the deliverable that surprises the client most.
Verification of the separation between corporate and process networks against the Purdue model: firewalls, industrial demilitarised zones, vendor remote access and undocumented jump paths.
Techniques applicable to your specific architecture, with the expected operational impact on the physical process rather than on data confidentiality.
Findings mapped to the obligations applicable to essential and important entities, with measures prioritised by real risk.
The method is the same; the constraints and the vocabulary change completely from one to the next.
Production lines, continuous and batch process control, plant management systems.
Connected medical devices, imaging systems, clinical record integration and ward networks.
Substations, telecontrol, distributed generation and metering systems.
Pumping stations, network telemetry and treatment plants.
Access control, HVAC, video surveillance and everything sharing a network without needing to.
Yes, and that is the default mode. The bulk of the assessment uses passive traffic capture, review of firewall and switch configurations, and interviews with operations staff. None of those activities touch the process segment. Active testing is reserved for planned shutdowns or backup environments.
The NIS2 Directive requires essential and important entities to adopt proportionate risk management measures, and explicitly names policies for assessing the effectiveness of those measures. In practice, the way to evidence that assessment in an industrial environment is a documented technical audit. National transpositions set out the specific obligations and the sanction regime, including management body accountability.
Complete isolation almost never exists. In most plants I have assessed there was at least one path: vendor remote access for maintenance, an engineering laptop that connects to both networks, a USB update drive or a data link to the corporate management system. Testing that isolation assumption is precisely the point of the work.
Describe the environment and the reason behind the engagement. I will reply with the recommended mode and an estimated order of effort.