An OT security programme set up against ISA/IEC 62443 drifts quietly: new assets join the plant network, temporary firewall rules become permanent, vendor connections multiply and the controller logic backup from commissioning is the only one anyone can find. This health check measures that drift with ten programme metrics, each with a formula, a data source type, thresholds and an owner, plus a findings log and a remediation map. It is run quarterly by the OT security lead with site engineering, checked by the second line or internal audit, and signed off by the accountable owner for the industrial estate. It suits asset owners in manufacturing, utilities, energy, water and building automation, and assumes a programme already exists.
What this health check covers
The IEC 62443-2-1 Asset Owner Security Programme Guide explains how to set up the programme: roles, policies, risk assessment and the elements that ISA/IEC 62443-2-1 expects of an asset owner. This page tests whether that programme is still working across sites. It measures outcomes across the estate, such as inventory coverage, zone conformance, patch or compensating control status and drill frequency, rather than the configuration of any single product. Products used by the programme have their own checks, for example the OT Security Platform guide for the monitoring platform.
If you searched for OT security KPIs, an ICS security audit checklist or IEC 62443 assessment metrics, this is the working version. It is not a 62443 conformity assessment: certification against the standard is done by accredited bodies, and the OT Security Assessment Guide covers full assessments.
Key takeaways
- Inventory coverage is the denominator for everything: zone conformance, patch status and monitoring coverage are only as true as the asset list they are measured against.
- Drift shows up at the boundaries: stale IT to OT firewall rules and unapproved vendor connections are the fastest growing exposures on most sites.
- Patched or compensated, never just unpatched: OT assets often cannot be patched quickly, so the metric counts assets with either the fix or a recorded compensating control.
- Recovery is measured by usable backups: a controller logic backup counts only if it matches the running version and is stored offline, and each site restores at least one controller a year on a test bench.
- Thresholds are starting points: the bands are NHI Mgmt Group recommendations; set them per site with process safety and operations, and record why.
How to use this template
Copy the metrics table and findings log into your own tracker, one column per site plus an estate total. Collect each figure from the data source types described, score it against the thresholds, and record every amber or red result as a finding with an owner and a due date. Agree any data collection that touches live control networks with operations first: passive methods and existing exports are preferred. Keep each quarter's results so the trend per site is visible; drift is a trend, not a single score.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Vendor connection and remote session review (O10) | Monthly | Site OT engineer | OT security lead | Remote access session log extract, approved supplier list, reconciliation |
| IT to OT firewall rule review (O6) | Quarterly | OT network engineer | OT security lead | Rule base export, rule owner confirmations, removed rule list |
| Full metric run (O1 to O10), per site | Quarterly | OT security lead | [Head of operations or accountable plant manager] | Metric workbook, findings log, sign-off record |
| Controller logic restore test and OT incident drill (O7, O9) | Yearly per site, or after major change | Control systems engineer; incident lead | [Head of engineering] | Restore test record, drill report and actions |
| Independent re-performance | Yearly | Internal audit or second line | Audit or risk committee | Re-performed samples, variance notes |
Metrics
Scope is industrial automation and control system assets and the networks that connect them, Purdue levels 0 to 3.5 or your equivalent. NHI Mgmt Group recommended thresholds; adjust to your risk appetite.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| O1 | OT asset inventory coverage | Assets seen on OT networks in the period that are in the asset register with owner, zone and firmware version / assets seen on OT networks in the period | Passive network monitoring asset list; OT asset register | ≥ 95% | 85% to below 95% | Below 85% |
| O2 | Zone and conduit conformance | Observed flows between zones that match a documented conduit / all observed inter-zone flows | Zone and conduit model; network flow records | ≥ 98% | 90% to below 98% | Below 90% |
| O3 | Unsupported operating system share | OT hosts running an operating system or firmware past vendor end of support / OT hosts in the register | Asset register with version fields; supplier lifecycle notices | ≤ 10%, each with a plan | Above 10% to 25% | Above 25%, or any without a plan |
| O4 | Patch or compensating control rate | Applicable security advisories closed by a patch or a recorded compensating control within the site's target time / applicable advisories due in the period | Advisory triage log; change records; compensating control register | ≥ 90% | 70% to below 90% | Below 70% |
| O5 | OT monitoring coverage | Zones whose traffic is monitored and whose alerts reach a monitored queue / zones in the zone model | Monitoring sensor coverage map; alert routing records | ≥ 95% | 75% to below 95% | Below 75% |
| O6 | IT to OT firewall rule review | Rules on IT to OT and DMZ boundary firewalls with a named owner, business reason and review in the last 12 months / rules on those firewalls | Firewall rule base export; rule review records | ≥ 95%, no any-to-any rules | 80% to below 95% | Below 80%, or any any-to-any rule |
| O7 | Backup of controller logic | Controllers whose latest backup matches the running logic version and is stored offline / controllers in the register | Engineering workstation project store; backup catalogue; version comparison | ≥ 95% | 80% to below 95% | Below 80% |
| O8 | Removable media control | Removable media events on OT hosts that passed through a scanning station or an approved device list / removable media events on OT hosts | Endpoint device control logs; scanning station logs | ≥ 98% | 90% to below 98% | Below 90% |
| O9 | OT incident drill rate | Sites that ran an OT-specific incident exercise with operations in the last 12 months / sites in scope | Exercise reports; after action records | 100% | 75% to below 100% | Below 75% |
| O10 | Vendor connection count | Third-party remote connections to OT in the period that were not on an approved, time-bound request (count); alongside approved active connections per site | Remote access session logs; access request records; approved supplier list | 0 unapproved | 1 to 2 unapproved, closed within 24 h | 3 or more, or any open beyond 24 h |
Notes on the formulas
- O1 uses observed assets as the denominator: the register cannot measure its own gaps. Compare it with what passive monitoring sees, and count assets in isolated or serial-only segments through site walkdowns. The joint CISA-led guidance Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators describes a systematic approach and taxonomy. See the OT Asset Visibility Guide.
- O2 depends on a current zone model: zones and conduits come from the ISA/IEC 62443-3-2 risk assessment. If the model has not been updated after plant changes, mark O2 red regardless of the number. See OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits.
- O4 counts the decision, not just the patch: ISA-TR62443-2-3 covers patch management in the IACS environment. An advisory closed by a compensating control counts only when the control is recorded with an owner and review date.
- O7 requires a version match: a backup taken before the last logic change does not count. Restore at least one controller per site per year on a test bench.
- O10 is a programme measure: it counts unapproved third-party connections across the estate. The configuration of the remote access tooling itself is a separate product check.
How to collect the data
- Agree the method with operations: prefer passive network monitoring and existing exports. Do not run active scans on control networks without an approved change and an engineer present.
- Export the asset register: owner, zone, function, operating system or firmware version, support status and criticality, for O1, O3 and O7.
- Export observed assets and flows: asset list and inter-zone flow summary from passive monitoring sensors for a fixed window, for O1, O2 and O5.
- Export boundary firewall rule bases: rules on IT to OT and DMZ firewalls with hit counts, owners and last review date (O6).
- Pull the advisory triage log: applicable advisories, decision (patch, compensate, accept), target date and closure, joined to change records (O4). The ICS Advisory Triage and OT Vulnerability Management Guide covers the triage process.
- Pull logic backup records: backup catalogue and the running logic version per controller from engineering workstation records (O7).
- Pull device control and session logs: removable media events and scanning station logs (O8); remote access session logs joined to approved requests (O10).
- Collect exercise records: drill reports and actions per site (O9).
- Sample and verify: walk down five assets per site from the network list to the cabinet, and five rules from the rule base to their owner. Record variances.
Red flags that need action now
- Devices talking across zones with no documented conduit, especially direct traffic from the corporate network to level 1 or 2 (O2).
- Any any-to-any or broad subnet rule on an IT to OT boundary firewall (O6).
- A third-party connection to OT that nobody approved, or a vendor session left open after the work window (O10). Follow the OT remote access compromise playbook if activity is unexplained.
- Safety-related or critical controllers with no logic backup that matches the running version (O7).
- Monitoring sensors installed but alerts routed to nobody (O5).
- Removable media used on engineering workstations without scanning (O8).
- Advisories marked "compensated" with no recorded control or owner (O4).
- A site that has never run an OT incident exercise with operations staff (O9).
Findings log
| Finding ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-OT-01 | [Number] assets on [site] network not in the register | O1 | [High / Medium / Low] | [Role] | [Date] | [Open / In progress / Closed / Risk accepted] |
| HC-OT-02 | [Number] inter-zone flows with no conduit between [zone] and [zone] | O2 | [Severity] | [Role] | [Date] | [Status] |
| HC-OT-03 | [Number] boundary firewall rules without owner or review | O6 | [Severity] | [Role] | [Date] | [Status] |
| HC-OT-04 | [Number] controllers without a current logic backup | O7 | [Severity] | [Role] | [Date] | [Status] |
| HC-OT-05 | [Finding] | [Metric] | [Severity] | [Role] | [Date] | [Status] |
Raise findings per site so plant managers own their own actions. Risk accepted findings carry an expiry date, the approver's name and the process safety sign-off where relevant.
Remediation map
| Finding type | Metrics | Where the fix is explained |
|---|---|---|
| Inventory gaps | O1, O3 | OT Asset Visibility Guide |
| Zone, conduit and firewall drift | O2, O6 | OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits; IEC 62443-3-2 OT Risk Assessment Guide |
| Unpatched or unsupported systems | O3, O4 | OT Patch Management Guide |
| Monitoring gaps | O5 | OT Network Security Monitoring Guide |
| Missing or untested logic backups | O7 | OT Backup, Recovery and Golden Image Guide; PLC Security Guide |
| Uncontrolled removable media | O8 | Removable Media and USB Control Guide |
| No OT incident practice | O9 | OT Incident Response Guide; OT Ransomware Response Playbook |
| Unapproved vendor access | O10 | OT Third-Party and Integrator Access Guide; OT Remote Access Guide |
Related guides
- IEC 62443-2-1 Asset Owner Security Programme Guide: the programme this health check tests.
- OT Security Maturity Model: place the metric results on a maturity level.
- NIST SP 800-82 OT Security Guide: the NIST view of OT controls behind several metrics.
- OT Security Policy Template: the policy the thresholds should be written into.
- OT and ICS Identity and Access Guide: shared engineering accounts and vendor identities behind O10.
References
Framework anchors for the metrics: NIST CSF 2.0 ID.AM-01 and ID.AM-02 (O1, O3), PR.IR-01 (O2, O6), ID.RA-01 and PR.PS-02 (O3, O4), DE.CM-01 and DE.CM-06 (O5, O10), PR.DS-11 (O7), RS.MA-01 (O9); NIST SP 800-53 Rev. 5 CM-8, SC-7, SI-2, SI-4, CP-9, MP-7, IR-3, AC-17 and MA-4.
- ISA: ISA/IEC 62443 Series of Standards
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA: Foundations for OT Cybersecurity, Asset Inventory Guidance for Owners and Operators
- NIST: CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: IEC 62443-2-1 Asset Owner Security Programme Guide, OT Security Maturity Model, OT Security Guide, OT Asset Visibility Guide.