Services for every level of the plant.
Assessment, compliance and engineering services for OT and ICS environments, scheduled around production and delivered alongside your control engineers.
OT risk assessment
A structured evaluation of cyber risk to safety, production and the environment, developed with the people who operate the site.
We review architectures, interfaces and control system designs, then assess risk zone by zone in accordance with IEC 62443-3-2, establishing target security levels and a risk register your operations team recognises and can act on.
Deliverables
- Asset inventory organised by site, zone and Purdue level
- Zone and conduit model of the site
- High-level and detailed risk assessments
- Risk register scored against your likelihood and consequence matrix
- Prioritised risk treatment plan
Vulnerability and gap assessment
A configuration-level review of the systems that keep the process running, performed without disrupting operations.
Hosts and network devices are assessed against your corporate standard and recognised baselines such as CIS Benchmarks. Testing is passive by default; any active technique is agreed with operations in advance.
Deliverables
- Installed software and unauthorised application review
- Windows services, patch level and Group Policy gap assessment
- User and privileged account review
- Switch and firewall configuration review
- Consolidated findings with prioritised remediation guidance
IEC 62443 compliance programs
A single control set that sites can implement and auditors can verify, even where multiple standards apply.
We rationalise overlapping requirements into a unified control register and track implementation by site and zone, giving management clear visibility of compliance posture.
Deliverables
- Unified control register mapped to IEC 62443, NIST SP 800-82 and ISO/IEC 27001
- National regulatory frameworks
- Compliance tracker per site and zone
- Gap assessment and remediation roadmap
- Audit evidence packs
Architecture and segmentation
Network designs that enforce segmentation without impeding operations.
From reference architectures to site-level drawings, we design zones, conduits and DMZ services, and sequence changes such as switch upgrades to fit planned shutdown windows.
Deliverables
- OT reference architecture with zones and conduits
- DMZ design for historian, patching and remote access
- Network and system architecture diagrams per site
- Firewall rule and switch configuration reviews
- Lifecycle management plans for OT assets
Backup and disaster recovery
Assurance that control systems can be restored after an incident, with defined recovery time and recovery point objectives.
We conduct business impact analysis, develop site recovery procedures and validate that backups restore successfully.
Deliverables
- Business impact analysis
- Backup procedures and validation for servers, workstations, HMIs, PLCs and drives
- Site recovery procedures and one point lessons
- Disaster recovery plans
- Training for site personnel
Penetration testing and hardening
Controlled testing of the attack surfaces adversaries target first, followed by durable system hardening.
Testing focuses on the DMZ, remote access paths and enterprise-to-control network links, scoped with operations so live control is never put at risk.
Deliverables
- Scoped penetration testing of IT and OT boundaries
- Remote access and vendor connection review
- System hardening against CIS Benchmarks
- Retest and closure report
ISO/IEC 27001 internal audit
Independent internal audits that prepare your information security management system for certification.
We conduct Stage 1 and Stage 2 internal audits with your process owners and report findings in a format your certification body can rely on.
Deliverables
- Stage 1 documentation review
- Stage 2 implementation audit
- Audit questionnaires and interviews
- Statement of Applicability review
- Compliance report with corrective actions
Bars indicate the Purdue levels each service covers, from Level 0 at the base to Level 5 at the top. Amber denotes the industrial DMZ.
Engagement methodology.
A defined sequence from initial site walkdown to sustained compliance, planned around your shutdown windows.
Scope and inventory
Define the system under consideration, collect drawings and build an asset inventory by Purdue level.
Assess
Stakeholder interviews, configuration reviews and passive testing. No live controller is touched without your approval.
Prioritise
Rate risks against your corporate risk matrix so the register reflects operational priorities.
Remediate
Schedule remediation around shutdowns and track every action to closure with accountable owners.
Sustain
Maintain controls, evidence and reporting in ByteLock GRC between audits.
Not sure where to start?
Most engagements begin with a risk assessment. Tell us about your facility and we will propose a scope.