10 Questions to Choose an OT Assessment Firm
When you choose an OT cybersecurity assessment firm, you must evaluate operational maturity alongside technical credentials. In the industrial sector, a security review cannot disrupt production, compromise safety interlocks, or violate proprietary process controls. To find a partner who respects these constraints, you must assess their plant-floor experience before signing a contract. The following ten questions are designed to expose vendors that lack industrial expertise or those whose primary goal is selling security hardware rather than building resilient systems.
1. What control systems have the people doing the work actually worked on?
Generic IT certifications like CISSP or CISM demonstrate knowledge of enterprise networks, and OT certifications such as ISA/IEC 62443 Expert, GICSP or GRID demonstrate that someone understands industrial security concepts. All of them are worth having. None of them, by itself, proves competence on a running plant, because the OT certifications do not require field experience to obtain. So ask for both, the certification and the engagements behind it: which sites, industries and device classes have the assessors worked on, how many production control networks have they scanned, and what do they do differently for each class of controller? If a firm relies solely on IT-centric frameworks without mapping them to NIST SP 800-82 guidance, they likely lack the foundational vocabulary required for meaningful industrial engagement.
2. Can you describe your approach to passive monitoring versus active scanning?
This is the single most important technical distinction in OT security. Active vulnerability scanners send packets that can crash legacy PLCs, disrupt SCADA communications, or trigger unexpected equipment behavior. A competent firm will start with passive network visibility—using tap-based sensors to observe protocols like Modbus, DNP3, OPC UA, and PROFINET without injecting traffic into the process bus. During our walkdowns, we consistently verify that assessment tools are configured to listen only. If an assessor suggests running aggressive port scans against programmable logic controllers, they pose an immediate operational risk. See how we secure unconnectable assets with passive techniques in our passive monitoring guide.
3. Have you assessed facilities with similar vendor ecosystems (Rockwell, Siemens, Schneider)?
The useful customer-facing idea is that cybersecurity controls must be designed around operations rather than imposed on top of them. – Red Trident Positioning
Industrial environments are fragmented by proprietary protocols and vendor-specific architectures. An assessor familiar with Rockwell Automation’s FactoryTalk ecosystem may struggle to identify configuration drift in a Siemens PCS7 environment. Ask for case studies detailing engagements within your specific technology stack. Experience matters because the attack surface changes drastically depending on whether you are managing Honeywell Experion, ABB Ability, or custom-built automation solutions. Generalist IT firms often treat all devices as generic endpoints, missing the nuanced security configurations unique to industrial controllers.
4. How do you coordinate assessment activities with plant maintenance windows?
In IT, downtime is often scheduled for patching. In OT, uptime is paramount, and maintenance windows are dictated by production cycles, raw material availability, and mechanical wear. A professional OT firm will never schedule high-risk activities during peak production. Instead, they should propose assessments during planned outages, turnarounds, or low-load periods. Furthermore, they must provide a clear scope of work that defines exactly when and how testing occurs. If a firm cannot articulate a strategy for aligning their work with your Operations team’s calendar, they are unlikely to succeed in a live facility.
5. What is your policy on remote access during assessments?
Remote access introduces significant risk if not strictly controlled. While some assessments require remote connectivity to view HMI screens or log data, this access must be ephemeral, monitored, and restricted. The best firms use jump-boxes or zero-trust network access (ZTNA) solutions that provide temporary, audited sessions. They should explicitly state that they will not leave backdoors, persistent accounts, or unmonitored tunnels in your network after the engagement ends. Additionally, ask if they require physical presence for certain tests; reliance on remote-only assessments often indicates a lack of willingness to engage with the physical layer of the control system.
6. Can you demonstrate experience with virtualized SCADA and HMI environments?
Many modern facilities have migrated historical data servers, engineering workstations, and even operator stations to virtual machines hosted on Windows Server or VMware ESXi. This creates a hybrid environment where IT infrastructure supports OT functions. Assessors must understand how virtualization impacts security, including hypervisor hardening, snapshot management, and isolation between VMs. In one internal assessment record, we observed HMI workstations used for SCADA control while remaining joined to the enterprise domain and being used for non-company email and streaming. This misconfiguration is common, but identifying it requires deep knowledge of both virtualization and industrial protocols. Ensure your potential vendor has reviewed similar virtualized setups.
7. How do you handle findings that require immediate operational intervention?
Sometimes, an assessor will discover a condition that poses an immediate threat to safety or production continuity. A rigid, report-driven firm might simply document the issue and move on. A superior partner will establish a communication protocol for “stop-work” conditions. They should have a clear escalation path that involves plant leadership and safety engineers before taking any corrective action. This question tests their respect for the operational hierarchy. You want a partner who acts as a consultant, guiding you toward remediation, not a dictator who halts production without consulting the Plant Manager.
8. Do you offer remediation support, or just identification of problems?
Finding vulnerabilities is the easy part; fixing them without breaking the process is the challenge. Look for firms that follow a full lifecycle approach, moving from Assess to Remediate/Fix. According to Red Trident’s service taxonomy, effective OT security requires a structured progression through Advise, Assess, Remediate, Train, Monitor, and Respond. If a firm only provides a list of findings and then disappears, you will be left with a massive backlog of unaddressed risks. The best partners help you prioritize fixes based on business impact, suggesting practical workarounds if immediate patching is impossible due to legacy system constraints. Explore our remediation strategies to see how we bridge the gap between discovery and resolution.
9. Are you independent of product sales?
Vendor neutrality is critical. Some cybersecurity providers earn revenue primarily by selling firewalls, intrusion detection systems, or air-gap appliances. While these products have their place, a biased firm may recommend expensive hardware solutions when a policy change or network segmentation adjustment would suffice. An unbiased assessor evaluates your entire environment—people, processes, and technology—and recommends a mix of administrative, physical, and technical controls. Independence ensures that their recommendations are driven by risk reduction, not commission structures. Always ask about their conflict-of-interest policies and revenue models.
10. Who will actually perform the work, and what is their background?
Sales teams often promise world-class expertise, but the actual fieldwork may be performed by junior analysts or contractors with limited industrial experience. Before signing a contract, request the resumes of the lead assessors who will visit your site. Verify that they have hands-on experience with the specific protocols and vendors mentioned in Question 3. In the assessments we’ve run, we’ve found that seasoned engineers who understand the physics of the plant floor provide significantly more value than pure IT auditors. Look for professionals who speak the language of operators—terms like “trip,” “interlock,” “RTO,” and “MTD” should be part of their daily vocabulary.
Operational Context Over Technical Checklists
The landscape of OT cybersecurity is evolving rapidly. Recent developments in AI-driven security testing agents show that autonomous entities can now identify and exploit vulnerabilities without human intervention. This shift underscores the need for robust, continuous monitoring rather than one-time point-in-time assessments. However, no amount of advanced technology can replace the judgment of an experienced practitioner who understands the trade-offs between security and availability.
When evaluating potential partners, remember that OT security is not about achieving perfect compliance with IT standards. It is about building security into operations, ensuring that safeguards enhance rather than hinder productivity. Firms that fail to grasp this distinction will produce reports that sit on a shelf, gathering dust while real threats accumulate. Review our comprehensive framework for balancing safety, uptime, and compliance to ensure your chosen partner aligns with these principles.
At Red Trident, we operate as a service-disabled veteran-owned small business (SDVOSB) based in Houston, Texas. We deliver OT/ICS assessments, penetration testing, and program development aligned to IEC 62443 and NIST SP 800-82. Our approach is grounded in practical, customized solutions that account for safety, reliability, and the unique constraints of industrial environments. We do not impose generic frameworks; we build programs that fit your operation.
Frequently Asked Questions About OT Assessments
What is the typical timeline for an OT cybersecurity assessment?
Timelines vary based on site size and complexity, but a standard onsite assessment typically lasts three to five days. This includes preliminary interviews, passive network sniffing, HMI reviews, and initial debriefs. The final report usually follows within two weeks of site completion. Larger facilities or those with multiple geographic locations may require phased approaches over several months.
Can an assessment cause my plant to shut down?
A well-conducted assessment using passive monitoring techniques should never cause a shutdown. Risks arise only when active scanning or intrusive testing is performed improperly. Firms without deep control-system experience limit active testing to isolated engineering stations or test benches, and for them that is the right call. Firms that have performed active scans on live production networks for years do it on the production network itself, after the passive phase, with tools and settings chosen per device class and a window agreed with operations, because that is where the version, service and configuration detail lives. The question to ask is not whether they scan, but who will run it and what they have run it on before. Always ensure your contract explicitly prohibits unapproved active scanning on production assets.
Do you need access to our source code or process chemistry?
No. Assessments focus on the security of the control systems, not the intellectual property of your manufacturing process. Assessors may need to view HMI screens or network diagrams to understand data flow, but they do not require access to recipe files, chemical formulas, or proprietary algorithms. Standard non-disclosure agreements (NDAs) protect your sensitive information throughout the engagement.
How does an OT assessment differ from a SOC audit?
A SOC 2 audit primarily evaluates the security controls of a service provider hosting data for others. An OT assessment evaluates the integrity and availability of industrial processes. While there is overlap in governance and access control, OT assessments delve deeper into protocol security, firmware integrity, and physical safety implications. OT audits are far more technical regarding hardware and real-time performance.
What deliverables can we expect after the assessment?
You should receive a comprehensive risk report detailing findings mapped to relevant standards (such as IEC 62443 or NERC CIP), a prioritized remediation roadmap, and a summary executive briefing. Depending on the scope, you may also receive updated network architecture diagrams, gap analyses, and recommendations for improving monitoring capabilities. The goal is actionable intelligence, not just a list of failures.
Schedule Your Free OT Security Consultation
Selecting the right partner is the first step toward securing your industrial assets. If you are ready to evaluate your current posture or need guidance on building a robust OT cybersecurity program, Red Trident offers free consultation calls. We bring decades of combined experience in advising plant managers, OT engineers, and CISOs on practical, maintainable security strategies. Contact us today to discuss how we can help you build security into your operations.
