Home / Services / OT Cybersecurity Assessment for Industrial Plants
Chemical · Oil and gas · Power · Water and wastewater · Manufacturing · Ports and terminals
OT cybersecurity assessment for industrial plants
The short answer: an operational technology (OT) cybersecurity assessment is a structured review of the control systems that run a plant: the supervisory control and data acquisition (SCADA) and distributed control systems (DCS), the programmable logic controllers (PLCs), the safety systems, and every network path that reaches them. On a live plant it should be plant-safe, which means passive network capture and hands-on review with operations, not active scanning of running controllers. It should start at the perimeter, where the plant touches business IT, the cloud, and vendors, and go down to the field devices. You should come away with an asset inventory, a network map, findings ranked by risk to operations, and a remediation roadmap. Red Tiger Security, founded in 2008 in The Woodlands, Texas, has done more than 500 plant-safe OT assessments this way.
What an OT assessment actually looks at
An IT security review stops at the servers and laptops. A plant assessment has to follow the process all the way to the equipment that moves product, opens valves, and trips breakers.
The perimeter
Where the plant touches business IT, the internet, the cloud, and vendors. Firewalls and the industrial demilitarized zone (DMZ) between IT and OT, remote access for original equipment manufacturers (OEMs) and integrators, and any cellular or satellite links nobody wrote down.
The control room
Human-machine interface (HMI) and engineering workstations, historians, domain controllers, and backups. Who can log in, how patches and antivirus get there, and whether a USB stick or a shared password could reach the process.
The field
PLCs, RTUs, safety instrumented systems (SIS), drives, and analyzers. Firmware, default credentials, and which conversations on the network are normal for this plant and which are not.
How a plant-safe assessment runs on a live plant
Nothing here needs the plant to come down, and nothing is sent at a running controller without operations agreeing to it first.
1. Scope with operations
Agree on sites, zones, and what is off limits. Operations and the control engineers are in the room from the first call, not just IT.
2. Walk the plant and listen
Passive capture from switch span ports, configuration review of firewalls and switches, and a walk-down of the control room and field cabinets. This builds the asset inventory and network map.
3. Report and roadmap
Findings ranked by risk to operations, mapped to the standard you answer to, and a roadmap that fits capital projects and outage windows. A board-level summary in plain language.
After the report, Red Tiger can fix the immediate need, such as vendor remote access, a flat network, or shared accounts. If you want the team to stay, a small firewall and sensor go in at the plant and the team watches those assets with 24x7 MSP + Metrics and Reports.
Types of OT assessment, side by side
Each one answers a different question. Most plants start with a plant-safe technical assessment, then use the others where they fit.
| Assessment type | What it does | Risk to a running plant | What you get | Best fit |
|---|---|---|---|---|
| Questionnaire or paper gap assessment | Interviews and document review against a framework | None | A gap list against the framework, no proof of what is on the network | A first look at policy and program maturity |
| IT-style vulnerability scan | Active scanner pointed at plant addresses | High. Older PLCs and HMIs can freeze or fault when scanned | A list of software vulnerabilities, often missing the field devices | Business IT, not live control networks |
| Plant-safe technical assessment | Passive capture, configuration review, and a walk-down with operations | Very low. Nothing is sent at running controllers | Asset inventory, network map, risk-ranked findings, roadmap, board summary | Any live plant, and the base for compliance work |
| OT penetration test | Controlled attack paths, usually from IT toward OT | Medium. Done on staging systems or in agreed windows | Proof of which paths an attacker could actually use | After the assessment, to test the fixes |
| Continuous monitoring | Sensor and firewall at the plant, watched 24x7 | Very low. Passive | Alerts and recurring metrics and reports | After the assessment, to keep watch on the same assets |
Which standard your plant answers to
The same plant-safe assessment can be written up against the framework or rule that applies to you.
Any industrial plant
ISA/IEC 62443 for zones, conduits, and security levels, and NIST Special Publication 800-82, the National Institute of Standards and Technology guide to OT security. [1,2]
Chemical, oil and gas, power
Pipeline security directives from the Transportation Security Administration (TSA), North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) standards for the electric grid, and CISA cross-sector goals. [3,4,5]
Water and maritime
America's Water Infrastructure Act (AWIA) risk and resilience assessments, EPA water guidance, and the U.S. Coast Guard cyber rule at 33 CFR 101 Subpart F for ports, terminals, and vessels. [6,7] See USCG Regulated Sector.
What to ask any OT assessment provider
Is it passive on live OT?
Ask exactly what touches a running controller, and who from operations signs off before anything active happens.
Does it go to the field devices?
A review that stops at the firewall or the Windows servers misses the PLCs, RTUs, and safety systems where the risk to the process sits.
Who walks the plant?
Look for people who have worked in control rooms and can talk to operators and to the board, with the training to back it up.
Frequently asked questions
What is an OT cybersecurity assessment?
It is a review of the systems that control a physical process: SCADA, DCS, PLCs, safety systems, and the networks and remote access that connect them. It finds what is on the network, how it can be reached, and which weaknesses could affect safety or production, then ranks the fixes.
Will the assessment disrupt production or take the plant down?
A plant-safe assessment should not. Red Tiger uses passive network capture, configuration review, and a walk-down with operations. Nothing is sent at running controllers unless operations agrees to it, usually on a staging system or during an outage window.
How is an OT assessment different from an IT penetration test?
An IT penetration test actively attacks servers and applications. An OT assessment starts from how the plant runs, protects availability and safety first, and goes down to field devices that IT tests do not reach. A penetration test can follow the assessment once the fixes are in.
How long does an OT assessment take?
It depends on the number of sites and zones. A single plant is often a few days on site plus time to analyze the capture and write the report. Multi-site programs are scheduled site by site around operations.
What standards can the findings map to?
ISA/IEC 62443, NIST SP 800-82, NERC CIP, TSA pipeline security directives, AWIA for water utilities, and the Coast Guard cyber rule at 33 CFR 101 Subpart F, depending on what your plant answers to.
What do we get at the end?
An asset inventory, a network map, findings ranked by risk to operations, a remediation roadmap that fits your capital projects, and a plain-language summary for the board.
What happens after the assessment?
Red Tiger can fix the immediate need, such as vendor remote access, segmentation, or shared accounts. If you want the team to stay, a small firewall and sensor go in at the plant and the team watches those assets 24x7 with 24x7 MSP + Metrics and Reports.
Where is Red Tiger Security based, and where do you work?
Red Tiger Security was founded in 2008 in The Woodlands, Texas. The team has done more than 500 plant-safe OT assessments and trained more than 4,500 engineers and operators, and works on plants across the United States and internationally.
References
Numbers match the bracketed citations on this page. Sources checked Nov. 4, 2026.
- ISA, ISA/IEC 62443 series of standards. https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security. https://csrc.nist.gov/pubs/sp/800/82/r3/final
- TSA, Surface transportation cybersecurity toolkit and pipeline security directives. https://www.tsa.gov/for-industry/surface-transportation-cybersecurity-toolkit
- NERC, Critical Infrastructure Protection (CIP) standards. https://www.nerc.com/pa/Stand/Pages/ReliabilityStandards.aspx
- CISA, Cross-Sector Cybersecurity Performance Goals. https://www.cisa.gov/cross-sector-cybersecurity-performance-goals
- EPA, Cybersecurity for the water sector. https://www.epa.gov/waterriskassessment/epa-cybersecurity-water-sector
- eCFR, 33 CFR Part 101 Subpart F, Cybersecurity. https://www.ecfr.gov/current/title-33/chapter-I/subchapter-H/part-101/subpart-F
Request a plant-safe OT assessment
On the live plant, with operations and the control engineers in the room. From the perimeter down to the field devices, then the fixes, and 24x7 MSP + Metrics and Reports if you want the team to stay.
Prefer to call? +1.877.387.7733 · info@redtigersecurity.com · The Woodlands, Texas
Tell us about the plant
First name, work email, and company. That is all it takes.
Thanks, . The Red Tiger team will reply by email to set up a call.