Most plants have a network drawing, but it is often several years out of date.
This is normal in an operating plant. Each project tends to leave something behind that is not recorded: a switch installed during a turnaround, a laptop that was brought in for commissioning and stayed connected, or a modem installed by a vendor for remote support.
These changes are not added to the drawing. No one intends to hide them, but updating the drawing is rarely the most urgent task.
The difference between the drawing and the plant is where much of the risk lies. A health check measures that difference.
A review, not a programme
The term “security assessment” can sound more demanding than a health check is.
There is no standard to meet, nothing is graded and nothing is reported to anyone outside your organization. The findings belong to you. We do not attack any system, and we do not run scans that could disturb a controller.
A health check also does not require a shutdown. If it did, few plants would be able to arrange one.
The six areas we review
What is connected to the network
Every device is listed and compared with the drawing. This is where most unexpected findings come from.
Which devices can reach the internet, and by which route
We look at which devices can reach the internet and through which connections. The answer often includes devices no one expected.
Who can open the cabinets
We also check whether physical access is recorded. Physical access is part of security, but it is often left out of reviews because it is not a network question.
What vendors can do when they connect remotely
We look at what remote access reaches once it is open, and whether there is a record of who used it and what they did.
Which computers run unsupported software
Most plants have some, often for valid operational reasons. The aim is to know which computers they are and what they are connected to.
What is backed up, and whether a restore has been tested
A backup that has never been restored cannot be relied on, so we check both.
How the findings are ranked
The order of the findings affects what happens next, so it is worth understanding before you commission any assessment.
We rank findings by potential impact, not by how easy they are to fix or by the score a tool assigns.
These approaches produce very different plans. Ranking by ease produces a list that starts with minor issues and may run out of budget before reaching the most important one. Ranking by impact means the first discussion is about the issue that could stop your plant.
What you receive
A findings list, ranked by potential impact, with what it would take to address each finding.
A current network diagram, showing the network as it is today, which often differs from the existing drawings.
A briefing for the people who approve the budget, explaining the findings in terms they already use.
Common reasons for a health check
The most common reason is a budget request. Someone has been asked what OT security should cost next year and has no information to base a figure on. A programme cannot be costed without knowing what is connected, and an out-of-date drawing does not provide that.
Other common reasons are an insurer asking questions, a customer sending a security questionnaire, or an incident where it is unclear how far it reached. In that last case, an accurate network diagram is especially important.
When to choose a different service
A health check is suitable for plants of any size or age.
If you already know your gaps and want them measured against a published standard, a gap assessment is the better choice. It is a different exercise with a different output.