Concepts
OT security maturity explained
Maturity is not how much technology you own — it is how reliably the same thing happens the next time. This page describes the ten capability areas the atlas scores, and what reactive versus mature looks like in a real plant.
Why should I care?
Most OT incidents exploited a missing routine, not a missing product: an unmanaged vendor path, an unowned inventory, an untested backup. Maturity work removes the routines that keep failing.
Scale
The five levels
Level 0 — Not started
Nobody owns OT security; the plant assumes IT covers it.
Level 1 — Initial
Individual heroics. Some firewalls, some spreadsheets, no cadence.
Level 2 — Defined
Written zones, conduits, inventory and roles. Consistency begins.
Level 3 — Managed
Measured, reviewed and exercised. Deviations are detected, not discovered.
Level 4 — Optimised
Engineering and security plan changes together; controls are tested continuously.
Capability areas
Ten areas, with what each end of the scale looks like
Vendor, protocol and asset specifics so a score is evidence-based rather than a feeling.
Asset inventory
A network drawing from a commissioning project, plus tribal knowledge.
Every controller, drive, relay and workstation carries make, firmware, protocol set, zone and process criticality — e.g. a ControlLogix on CIP/44818, an S7-1500 on 102/TCP, a Modicon on 502/TCP with UMAS in use.
Network architecture
Flat cell networks; the historian is queried directly from the business VLAN.
Zones by consequence with an industrial DMZ; substation station-bus traffic such as ABB Relion GOOSE stays layer-2 isolated.
Access control
Shared HMI logins and vendor default passwords, including on Unitronics Vision panels.
Named accounts, MFA at the boundary, keyswitches out of REMOTE, and controller access protection enabled where the platform offers it.
Remote access
Always-on vendor VPN or a cellular modem on the remote site with a public IP.
Brokered, approved, time-bound and recorded sessions; no direct path to 20256/TCP, 44818/TCP or 102/TCP from the internet.
Monitoring & detection
Switch logs, if anyone reads them.
Passive protocol-aware sensors alerting on program download, mode change, firmware write, PROFINET DCP discovery and unexpected GOOSE publishers.
Vulnerability management
Advisories arrive by email and are triaged by CVSS.
Applicability checked against inventory, ranked by reachability and process consequence, tracked to a compensating control when patching is not possible.
Backup & recovery
Project files on an engineer's laptop.
Offline, version-controlled logic and project backups for every PLC, DCS and SIS, with restores rehearsed on a bench.
Incident response
The IT playbook, which starts by isolating hosts.
An OT plan written with operations that names safe process states, escalation to the control-room supervisor and evidence capture that does not stop the line.
Threat hunting
None; detection is entirely alert-driven.
Baselines per zone and scheduled hunts — unexpected engineering traffic, default credentials on field devices, new masters polling Modbus or DNP3.
Governance & culture
Security is an interruption to production.
Named OT security owner, budget, metrics and joint change review with engineering.
How to use it
Scoring honestly
- Score the worst site you operate, not the flagship one — the attacker will find the worst site.
- Evidence beats intent: if a control is not written down and not verifiable, it is Level 1.
- Pick the three lowest areas and fund those; breadth beats depth in early programmes.
- Re-score twice a year and after any major architecture, vendor or acquisition change.
Expert notes+
- Inventory maturity gates everything downstream — you cannot monitor, patch or restore what you have not listed.
- A mature programme can say, per zone, which protocols are allowed and who is allowed to write to a controller.
- Backups of controller logic are the single highest-return early investment in most plants.