The problem
Network documentation at most plants was frozen on commissioning day. Since then there have been expansions, integrators working against the clock, “temporary” remote access that remains in place and devices connected to solve an urgent problem. The result is familiar: nobody at the plant can look at the network and state with confidence what is connected and what it communicates with.
There is a second problem: OT cannot be investigated recklessly. An aggressive scan of the kind used in offices can take an old PLC out of service. Many plants therefore live with uncertainty for years: they know they should look, but fear that looking could stop production.
Scope
- Document review and interviews with operations, maintenance and IT.
- Passive traffic capture at agreed network points: no active scanning of control equipment.
- Inventory of assets observed on the network: controllers, HMIs, servers and third-party equipment.
- Map of actual communications: who talks to whom, including connections nobody remembered.
- Review of existing segmentation and all internal and integrator remote access.
- Assessment against IEC 62443 and the applicable NIS2 or ENS obligations.
Deliverables
- An inventory validated with your team, not a raw tool export.
- An accurate network map in an editable format, ready to serve as the reference diagram.
- A findings report prioritised by process impact, not by a generic score.
- A 12-to-24-month action plan showing sequence, estimated effort and the regulatory requirement addressed by each measure.
- A four-page executive summary written for management.
Questions we are asked before engagement
Does the plant need to stop, or do you touch the control equipment?
No. Fieldwork consists of passive capture at network points agreed with your team. If a specific check requires anything more, it is proposed in writing and performed only in an agreed window—or it is not performed.
How much time will you need from my people?
Approximately 8 to 16 hours in total: interviews with operations and IT, one escort during on-site work and an inventory validation session. We do the rest.
What if you find something serious halfway through the project?
We tell you immediately, together with a proposal for immediate containment. A critical finding does not wait for the final report.