Build a usable inventory
We recommend collecting asset identifiers, functions, owners and support status, including PLCs, SCADA and engineering workstations. Record necessary connections and supplier access as well. The NIST OT security guide addresses specific performance, reliability and process safety requirements. This context helps plan measures that suit the installation, instead of automatically transferring practices from an administrative network without examining their effect on the operating systems.
Define access boundaries
A proposal can group assets by function and approve the communications required between them. For maintenance access, we recommend individual identification, authorization and an expiry date. Each exception should have an owner and a reason. In a hypothetical forestry monitoring example, sending data to a dashboard does not necessarily require giving its user programming access to the controllers installed in the field.
Plan changes and recovery
We recommend assessing updates and configurations during a window agreed with operations and maintenance, with a documented rollback path. The team should know where program and configuration backups are held and how to verify restoration. Defined exercises help review contacts and priorities if a system becomes unavailable. The project should include responsibilities and a review routine; buying a device alone does not guarantee lasting protection.
What to assess for your project
- Inventory assets, functions and owners.
- Map communications and external access.
- Approve changes and test recovery.
- Define regular reviews and response contacts.
COM3
How COM3 can help
COM3 can help assess industrial networks, map connections and design segmentation and access within the approved scope. Implementation can include documentation, tests and organization of configurations for recovery, working with the teams responsible for cybersecurity, maintenance and operational continuity so technical measures support the agreed operating procedures.
Topics in this article
Further reading and references
Technical sources consulted for the fundamentals of this content. Project recommendations are an editorial synthesis by COM3.