# OT audit

Prepare an evidence-based audit that protects production and safety.

SecNet.Work | 2026.10 | 2026-10-21

In OT, availability, physical processes and safety must be assessed together. A suitable office-network scan can have unacceptable control-system consequences. NIST SP 800-82 Rev. 3 is the final reference. The September 2026 Rev. 4 is an initial public draft; do not present draft proposals as binding requirements. This pack does not instruct attacks or unapproved production tests.

## Work boundary
Manufacturing, energy and building control. Consider active tests only with written authorization, plant approval, a suitable window and rollback.

## Process

### 1. Define boundaries and safety
Agree scope with production, safety and OT engineering. Record critical functions, outage effects and prohibited audit actions. Explicitly assign authority to stop risky activity.

Expected evidence: Approved scope and stop authority

### 2. Establish passive visibility
Reconcile the inventory, engineering drawings and authorized passive observation. Record model, firmware, owner and communication dependencies. Do not default to unsupported active discovery.

Expected evidence: Asset and dependency map

### 3. Trace paths and changes
Trace remote maintenance through identity, network path, session and approval. Compare zone/conduit design with actual flows and rules. Check approval and version consistency for PLC project changes.

Expected evidence: Access path and change trail

### 4. Validate recoverability
Do not confuse the existence of a backup with recoverability. Examine engineering stations, configurations, licences and spares. Test restoration offline or in an approved maintenance window.

Expected evidence: Restore test and dependency list

### 5. Close with the plant
Describe findings through affected processes and consequences. When patching is not feasible, assign isolation, monitoring and supplier support. Retesting remains subject to safety and production approval.

Expected evidence: Owned action and safe retest

## One control, three perspectives

### Operator
Could the audit affect production?
Validate passive methods and stop conditions.
Evidence: Maintenance approval and test boundary

### Auditor
Does the drawing represent the actual network?
Compare diagrams with authorized traffic evidence.
Evidence: Rules, flows and sample

### Leader
Which process can stop, and for how long?
Review safety and recovery risk together.
Evidence: Business impact and verified recovery

## Evaluate evidence

**Claim:** Remote maintenance is controlled.

**Weak support:** A firewall is drawn on the diagram.

**Stronger support:** Approval, individual identity, time bounds and actual rules were verified for the same maintenance path.

**Rationale:** A device’s presence does not prove correct configuration or that every path traverses it.

## Decision desk
The plant inventory is incomplete and production is running.
Start: start

### start
What comes first?

- **Agree scope with the plant and reconcile passive records** (good)
  You improve visibility without putting production at risk. Compare the drawing with the real access path.
  Next: verify

- **Start an unapproved active scan** (risk)
  Unexpected traffic can affect legacy equipment. This method is inappropriate without authorization and plant approval.
  Next: repair

- **Close without a rationale** (incomplete)
  Deferring an open issue is not closure evidence. Record the uncertainty, owner and next verification step.
  Next: revise

### verify
The VPN is time-limited but a second supplier connection remains open.

- **Assess the second path with the plant and close it safely** (good)
  Controlling one path does not cover all maintenance access. Plan the change with dependencies and rollback.
  Next: planned

- **Accept the claim without testing** (risk)
  The initial claim and observed result differ. Support closure with a repeatable check in the same scope, rather than a promise or ticket status.
  Next: revise

### repair
A scan caused a production alarm.

- **Stop testing, follow plant procedures and preserve the record** (good)
  Safety and plant coordination come first. Do not resume without impact assessment and renewed authorization.
  Next: planned

- **Delete the earlier record and close** (risk)
  Deleting the earlier decision undermines learning and accountability. Link the new action to the prior record and keep the rationale and residual risk visible.
  Next: revise

### supported
This decision is supported by the evidence in the example. Verify closure conditions in your own scope.

### revise
The decision lacks support. Record the rationale and required evidence, then reassess.

### planned
A remediation path is defined. Keep the matter open until implementation and verification are complete.

## Worked example
Entirely fictional.
- Asset: OT-001
- Critical process: Example filling line
- Safety impact: Unplanned stop risk
- Access path: Supplier maintenance gateway
- Observation: Second persistent path
- Control: Approved window and isolation
- Owner: Plant OT owner
- Retest: Passive flow + session check

## Closure checklist
- [ ] Plant and safety approval exists.
- [ ] Active methods separately authorized.
- [ ] All remote-access paths reviewed.
- [ ] Recovery is not inferred from file presence.

## Official sources
- [NIST SP 800-82 Rev. 3 — Final](https://csrc.nist.gov/pubs/sp/800/82/r3/final)
- [NIST SP 800-82 Rev. 4 — Initial public draft, September 2026](https://csrc.nist.gov/pubs/sp/800/82/r4/ipd)

https://secnet.work/learn/toolkits/ot-audit