OT Security Assessment: What It Examines, What It Costs, and Why Nobody Scans a PLC

An IT auditor optimises for confidentiality. Patch the host, rotate the credential, encrypt the channel, and if something falls over during testing you restore from backup and apologise. None of that survives contact with a plant.

A controller running a process cannot be patched on a Tuesday because the vendor released a fix. Patching it may void the safety certification of the machine it drives. It may require the line to stop, which may require a production planning decision made weeks ahead. Some of this equipment has a design life of twenty-five years and runs an operating system that stopped receiving fixes a decade ago, and that is not negligence, it is the economics of a machine that cost several million and works perfectly.

So the assessment question changes. It is not is this system patched. It is what can reach this system, from where, and what would happen if it did. That reframing is the whole discipline.

Every credible OT assessment is organised around the Purdue Enterprise Reference Architecture, because it is how the plant itself is built. It gives you a vocabulary for the only question that matters: what sits between the internet and the thing that moves.

Level 3.5, the industrial DMZ, is where most findings concentrate. It is the boundary between the business network and the process network, and in a large number of plants it either does not exist, or it exists on a network diagram and not in the firewall rules. The most common serious finding in this work is not an unpatched controller. It is a flat path from a corporate laptop to Level 1.

Below the DMZ you stop meeting HTTPS and start meeting protocols designed in the 1970s and 1980s for serial links on a closed network, later wrapped in Ethernet without changing their assumptions.

This matters to an assessment in a specific way. If Modbus TCP on port 502 has no authentication, then any host that can route to a controller can command it. There is no credential to steal and no exploit to write. The entire security control is the network path. So the assessment spends its time on reachability, segmentation and remote access, not on vulnerability counts.

It also gives you a fast test of a prospective assessor. Ask which protocols they expect to find at your site and what they would do with a Modbus capture. An IT firm with a new OT line on the price list will talk about CVEs. Someone who has done the work will ask whether your engineering workstation and your historian are in the same broadcast domain.

This is the question every plant manager asks first, and it deserves a precise answer rather than reassurance.

A controller is not a server. It is a real-time device with a network stack sized for a predictable number of concurrent sessions from a predictable set of peers. A scanner that opens hundreds of connections, sends malformed packets to probe for a service banner, or simply sweeps a port range can exhaust that stack. The observable outcomes range from a dropped poll cycle to a CPU fault that puts the controller into STOP. On a process that is running, a controller in STOP is a stopped process, and depending on what it was controlling, that can be a safety event rather than an availability one.

Controller vendors have warned about this for years, and a competent assessor treats it as a design constraint rather than a risk to accept. Passive capture during production, active work only on equipment the plant has agreed to take offline, in a planned window, with the process owner in the room.

Three names come up constantly and are routinely confused, including by people selling the work.

NIST SP 800-82 Rev 3

Revision 3 landed in 2023 and broadened the title from industrial control systems to operational technology, which reflects reality: building management, medical devices and transport systems have the same problem shape as a factory. It is a guide, so nobody certifies you against it, but it is the most complete checklist available and it maps onto NIST SP 800-53 controls, which means findings translate into language your IT function already speaks. This is what we audit against, and it is why our service page is called a NIST SP 800-82 audit.

IEC 62443

The international series, and the one that produces a certificate. 62443-3-2 is the part that matters most to an assessment: it defines zones and conduits, which is the formal way of writing down what may talk to what. 62443-3-3 defines security levels SL 1 to SL 4, so a requirement can be stated as a target rather than a sentiment. If a customer or an insurer has asked for evidence, they usually mean this.

NIS 2

Not a technical standard at all. It is EU law, and it brings energy, water, waste, food, manufacturing, chemicals and digital infrastructure into scope as essential or important entities, with management personally accountable. NIS 2 tells you that you must manage the risk. It does not tell you how. The other two do. If you are in scope, see our NIS 2 readiness work.

Across this kind of work the same findings recur, and almost none of them are the ones an IT-shaped mind expects. In rough order of how often they appear and how much they matter:

• Remote access nobody owns. A machine builder or integrator has standing access for support, often through their own VPN concentrator, often with a shared account, frequently still active years after commissioning. The plant did not grant it, the plant cannot revoke it, and in many cases the plant does not know it exists.
• A cellular router in a cabinet. Installed by a contractor to avoid a change request, connected directly to the control network, bypassing every firewall on the site diagram. This is the single most direct internet-to-Level-1 path found in practice.
• The DMZ that exists only on paper. Level 3.5 is drawn on the architecture document, but the firewall rules contain an any-any permit added during a commissioning weekend and never removed.
• The engineering workstation. A Windows machine with the vendor programming software, local admin, no EDR because the vendor said it interferes, email and a browser, and a direct path to every controller. It is usually the most dangerous host on the site.
• Flat Level 2. Every HMI, historian and workstation in one broadcast domain, so compromise of any one of them reaches all controllers.
• Backups that have never been restored. Controller logic is backed up to a folder on the engineering workstation, which is inside the blast radius of the thing the backup exists to survive.
• Shared credentials with no expiry. One operator account, one password, known to everyone including three people who left, because the shift cannot stop to reset it.
• No logging below the DMZ. If something did happen at Level 1 or 2, there would be no record of it. This is the finding that most often turns a two-day incident into a two-month one.

Notice what is not on that list: unpatched controller firmware. It appears in every report, and it is almost never the top finding, because the controller is not reachable by anyone who is not already past the other eight.

Discrete manufacturing

Usually Profinet or EtherNet/IP depending on whether the plant is a Siemens or a Rockwell house, often both after an acquisition. The characteristic problem is the machine builder: each line arrives as a sealed package with its own controller, its own switch, its own remote support arrangement and its own idea of a password. Segmentation between lines is frequently nonexistent.

Water and wastewater

DNP3 and Modbus, geographically dispersed sites, and telemetry over cellular or radio to remote pumping stations that no one has physically visited in months. Small utilities are in NIS 2 scope and frequently have no dedicated security staff at all. The remote site is the assessment priority, not the headworks.

Energy and utilities

DNP3 and IEC 61850 in substations, the most mature regulatory environment, and usually the best existing segmentation. Here the assessment tends to be about proving and documenting what is already reasonably built, because someone is going to audit it formally.

Building automation

BACnet/IP, and the most neglected category by a wide margin. HVAC, access control, lifts and metering are installed by facilities rather than IT, are frequently reachable from the corporate network or directly from the internet through a supplier portal, and sit inside data centres and hospitals where the physical consequences of losing them are severe.

Stage 1 is the one that gets skipped and should not be. Before anything is plugged in, the assessor needs the network drawings, the asset owner, the maintenance window calendar, and a written rule of engagement stating explicitly what may be touched. If a prospective supplier wants to start scanning in week one, that tells you what you need to know.

Stage 2 produces the artefact most plants have never had: an asset inventory built from observed traffic rather than from a spreadsheet somebody maintained until 2019. It is common for this stage alone to surface devices nobody present knew were connected.

Stage 5 should give you findings organised by Purdue level and expressed as 62443 zones, prioritised by what an attacker could actually reach, not by CVSS score. A CVSS 9.8 on a controller sitting behind a properly configured conduit matters less than a CVSS 5.0 on the jump host that everyone shares a password for.

Published prices are rare in this market, which is itself informative. Broad bands for a single site:

• $8,000 to $15,000. A small single-line facility, one control network, under fifty devices. Often a document and configuration review with a short passive capture.
• $18,000 to $35,000. The common case. A full site, several production areas, mixed vendors, three to four weeks. Our SP 800-82 audit starts at $18,000 per site.
• $40,000 upward. Multiple plants, safety instrumented systems in scope, or a regulated sector where the report is going to an authority.
• Per site, not per company. Watch for this in any quote. Two plants are two engagements, because the second plant is a different network with different equipment. A multi-site programme should be cheaper per site, but it is not one price.

What moves the number: the count of distinct control networks, whether safety instrumented systems are in scope, whether you have current drawings, and whether the site can provide a span port. A site with no drawings and no mirror capability costs more because the first week becomes discovery. Full pricing across every service is on our pricing page.

If nobody outside your organisation has asked, you are not in a NIS 2 sector, and your control network genuinely has no route to the business network or the internet, then the money is better spent elsewhere first. Confirm that isolation is real rather than assumed, because the two most common ways it turns out to be assumed are a vendor support laptop and a cellular router installed by a maintenance contractor and forgotten.

If you have a flat network and you already know it, you do not need an assessment to tell you. You need the segmentation project, and an assessment afterwards to evidence that it worked. We will say that on the scoping call rather than take the engagement.

What is an OT security assessment?

An OT security assessment examines the technology that runs a physical process: controllers, HMIs, SCADA servers, historians, engineering workstations, and the network between them. It answers what can reach the control system, from where, and what would happen if it did. It is organised around the Purdue model and is passive by default, because active scanning can fault the controllers it is meant to protect.

How is it different from an IT security audit?

The priorities invert. In IT, confidentiality generally wins and a system can be patched or rebooted to fix a finding. In OT, safety and availability win, equipment may not be patchable without voiding a safety certification, and the same vulnerability scanner that is routine on an office network can stop a production line. The assessment therefore concentrates on network reachability, segmentation and remote access rather than on patch levels.

Will the assessment stop production?

It should not. Competent OT assessment is passive during production: traffic is copied from a span or mirror port and analysed offline, and nothing is transmitted to a controller. Active testing happens only on equipment the plant has agreed to take offline, in a planned window, with the process owner present.

Why can a port scan break a PLC?

A controller is a real-time device with a minimal network stack sized for a small, predictable number of sessions. A scanner that opens many connections or sends malformed probes can exhaust that stack, cause dropped poll cycles, or fault the CPU into STOP. A controller in STOP means the process it controls has stopped.

How much does an OT security assessment cost?

Broadly $8,000 to $15,000 for a small single-line facility, $18,000 to $35,000 for a full site with several production areas, and $40,000 upward for multi-site or safety instrumented scope. Atlant Security prices an SP 800-82 audit from $18,000 per site. Note that credible pricing is per site, not per company.

How long does it take?

Three to four weeks for a single site: roughly a week of scoping and safety agreement, one to two weeks of passive capture and configuration review, and a week for analysis and reporting.

Should we follow NIST SP 800-82 or IEC 62443?

Both, for different purposes. SP 800-82 Rev 3 is the more complete checklist and maps onto NIST SP 800-53, so audit against it. IEC 62443 is the certifiable international standard and defines zones, conduits and security levels, so report against it when a customer, insurer or regulator wants evidence. NIS 2 is the legal obligation that makes one of them necessary.

Does NIS 2 apply to our plant?

If you operate in energy, water, waste, food, manufacturing, chemicals, transport, health or digital infrastructure in the EU and exceed the size thresholds, you are likely in scope as an essential or important entity, with management personally accountable. NIS 2 requires you to manage the risk but does not specify the controls, which is why it is normally implemented against IEC 62443 or SP 800-82.

What deliverables should we expect?

An asset inventory built from observed traffic, a protocol and communication map, findings organised by Purdue level and expressed as 62443 zones, a prioritised remediation roadmap ordered by reachability rather than CVSS score, and an executive summary suitable for a board or an insurer.

Can our existing IT auditor do this?

Only if they can tell you which protocols they expect to find and why they will not scan Level 1 while you are running. Those two answers separate a firm that has worked in a live plant from one that has added a line to the price list.

Next Step

Find out what can reach your controllers

A scoping call establishes what you run, what drawings exist, and whether a span port is available. You get a fixed price for your actual site, and you read the report before you pay.

Last Updated: September 2026 · Author: Alexander Sverdlov, CISSP, Founder and Principal Security Consultant

Price ranges reflect observed market rates in 2026 and vary by site, sector and scope. Protocol port numbers are defaults and are frequently changed in practice.