// OF-01 · Assess
OT network assessment: know what is there, how it connects and where the risk is.
An audit of your industrial network as it really is today, done read-only and without touching production. You leave with an accurate diagram, a usable inventory and a risk register ranked by operational impact.
The problem
In most plants the OT network has grown project by project. Each integrator left its own switch, its own VPN and its own firewall exception. The documentation, where it exists, describes the network of five years ago.
The result is predictable: nobody can confidently answer simple questions. How many PLCs are connected? Which machines talk to the corporate network? Who gets in remotely, and how?
Without those answers there is no sensible segmentation, no defensible investment plan and no evidence for management or for NIS2.
What we review
- Inventory of OT and IT/OT assets: PLCs, HMIs, SCADA, historians, engineering workstations, switches, firewalls and gateways.
- Communication flows and industrial protocols (Modbus/TCP, PROFINET, EtherNet/IP, OPC UA, S7 and others) between cells, levels and the corporate network.
- Mapping to the Purdue model and the IT/OT boundary: what sits where it should and what crosses levels without control.
- Remote access by vendors and integrators: VPNs, remote-access tools, modems and forgotten 4G links.
- Redundancy, single points of failure and critical dependencies (DNS, AD, NTP, licensing, cloud).
- Configuration of the main network devices and the firewall rules at the boundary.
How we work
Everything is read-only. No agents on controllers, no aggressive active scanning and no configuration changes.
- Collection of existing documentation, configuration exports and asset lists.
- Remote sessions with your technical team and, where it helps, a site visit.
- Passive traffic capture on a SPAN or TAP port, always agreed in advance and within a defined window.
- Validation of findings with the people who run the plant before the report is closed.
What you get
- Diagram of the current network, in an editable format, showing real zones, levels and links.
- Asset and flow inventory your team can keep up to date.
- Risk register ranked by operational impact, urgency and mitigation effort.
- Action backlog split into quick wins, medium-term and structural actions.
- A list of critical questions to put to your vendors and integrators.
- Debrief session with the technical team and an executive summary for management.
Who it is for
Industrial operations and SMEs with an OT network, up to about 500 users, on one or several sites. It is especially useful before a segmentation project, after an acquisition, when you change integrator or when management needs to know where it stands on NIS2.
Frequently asked questions
How long does an OT network assessment take?
It depends on the number of sites and the documentation available. For a mid-sized site, fieldwork typically fits in a few days and the report follows in the next weeks. The timeline is fixed in the proposal.
Do we need to stop production?
No. The work is read-only and traffic capture is passive. Any connection to a SPAN or TAP port is agreed in advance with your maintenance team.
Do you work with our integrator or MSP?
Yes. The assessment is vendor-independent and designed to produce a plan your integrator, MSP or in-house team can carry out.
Does the assessment count as NIS2 evidence?
It is a starting point: an asset inventory, a risk analysis and a prioritised action plan are things the cybersecurity regime requires. It does not replace legal advice on how your entity is classified.
Last updated: November 2026.