ICS / OT Security Maturity Assessment

About this model

About this assessment

About the ICS / OT Security maturity model

Operational technology security operates under fundamentally different constraints from enterprise IT. In an OT environment, availability is paramount — a misconfigured firewall rule or a poorly timed patch can halt a production line, disrupt power generation, or compromise the physical safety of workers and the public. Systems that run industrial processes were often designed decades before cybersecurity was a concern, and many will remain in service for years to come. Security strategies that assume you can simply update, replace, or isolate equipment at will do not survive contact with reality on a plant floor.

Effective OT security must work within the constraints of physical processes, not against them. It requires understanding that a programmable logic controller running a 15-year-old firmware version is not a vulnerability to be patched on a Tuesday cycle — it is a business-critical asset that needs compensating controls, careful monitoring, and a recovery plan that accounts for the fact that restoring a control system is not the same as reimaging a laptop. This model assesses whether your organisation has moved beyond the assumption that an air gap is sufficient protection and toward a mature, integrated approach that treats OT security as a discipline in its own right.

The ICS / OT Security maturity model covers 24 questions across 6 areas that span the full lifecycle of operational technology security — from knowing what devices you have, through segmenting and monitoring your networks, to responding to incidents without causing further harm to physical processes. It is designed for organisations that operate industrial control systems, SCADA environments, building management systems, or any technology that bridges the digital and physical worlds.

The assessment is accessible to both OT engineers who understand process safety and IT security professionals who are extending their remit into operational environments. It surfaces the gaps that matter most: whether you can see your OT assets, whether your IT and OT networks are properly separated, whether you can detect anomalous behaviour in industrial protocols, and whether your incident response plans account for the unique constraints of shutting down and restarting physical processes safely.

Who this assessment is for

• OT security managers and ICS security engineers responsible for protecting industrial environments
• CISOs and IT security leaders extending their programmes to cover operational technology
• Plant managers, operations directors, and engineering leads who own OT environments
• Risk and compliance teams assessing cybersecurity across converged IT/OT landscapes
• Consultants and auditors evaluating OT security posture for critical infrastructure organisations
• Safety and reliability engineers seeking to understand how cybersecurity intersects with process safety

The three maturity levels

• Level 1 — Air-Gap Dependent: OT environments are largely unmanaged from a cybersecurity perspective. The organisation assumes physical separation or an air gap provides sufficient protection. There is no inventory of OT assets, no monitoring of industrial network traffic, and no formal process for patching or hardening control systems. If a cyber incident affected OT, the response would be improvised and could compromise process safety.

• Level 2 — Boundary-Defined: The organisation has identified its IT/OT boundary and implemented segmentation controls. An OT asset inventory exists, network traffic is monitored at key points, and there are defined processes for managing vulnerabilities within the constraints of operational availability. Incident response plans address OT-specific scenarios, and there is a governance structure that brings IT security and OT engineering together.

• Level 3 — Converged: IT and OT security are managed as a unified programme with shared visibility, coordinated threat intelligence, and continuous monitoring of industrial protocols. The organisation maintains deep situational awareness of its OT environment, can detect and respond to threats without disrupting safe operations, and continuously refines its controls based on threat landscape changes and lessons learned from exercises and incidents.

The 6 areas assessed

1. OT Asset Inventory & Visibility

Whether the organisation knows what OT devices, controllers, and network components exist in its environment, including their firmware versions, communication paths, and criticality to physical processes. You cannot secure what you cannot see — and in OT, undiscovered assets are often the oldest, most vulnerable, and most critical.

2. IT/OT Network Segmentation

How effectively the organisation separates IT and OT networks and controls data flow between them. This area covers DMZ architecture, boundary enforcement, data diode or one-way gateway use, and the management of remote access into OT environments. Poor segmentation is the primary pathway through which IT-side compromises reach control systems.

3. OT Vulnerability & Patch Management

How the organisation manages vulnerabilities in systems that often cannot be patched without operational downtime. This area assesses whether there is a structured approach to identifying vulnerabilities, coordinating with equipment vendors, applying compensating controls when patching is not feasible, and scheduling maintenance windows for critical updates.

4. OT Monitoring & Anomaly Detection

Whether the organisation can observe network traffic and device behaviour within its OT environment and detect deviations from normal operating patterns. This area covers passive network monitoring, baseline establishment, protocol-aware detection for industrial protocols (Modbus, DNP3, OPC UA, EtherNet/IP), and alerting on unauthorised changes to controller logic or configuration.

5. OT Incident Response & Recovery

How the organisation would respond to a cybersecurity incident that affects operational technology, and whether it can restore control systems safely. This area assesses whether IR plans account for OT-specific constraints — safety-first shutdown procedures, control system backup and restore, coordination between IT responders and operations staff, and the ability to maintain or safely halt physical processes during an incident.

6. OT Governance & Workforce

Whether there is a clear governance model for OT security that bridges the traditional gap between IT security teams and OT engineering. This area covers organisational structure, OT-specific policies, cross-training between IT and OT staff, integration of cybersecurity with process safety programmes, and whether the workforce has the skills to secure industrial environments.

How this model relates to other frameworks

This is an original, simplified maturity model and is not derived from or intended to replace any of the following. However, organisations that use this assessment may also find value in these established frameworks:

• IEC 62443 — the international standard series for industrial automation and control system (IACS) security
• NIST SP 800-82 Rev. 3 — guide to operational technology security from the National Institute of Standards and Technology
• NERC CIP — mandatory cybersecurity standards for the North American bulk electric system
• MITRE ATT&CK for ICS — a knowledge base of adversary tactics and techniques targeting industrial control systems
• CISA Cross-Sector Cybersecurity Performance Goals — baseline security practices recommended by the US Cybersecurity and Infrastructure Security Agency for critical infrastructure
• UK CAF (Cyber Assessment Framework) — the NCSC framework for assessing cyber resilience of organisations providing essential services

Frequently asked questions