An OT security checklist scores each plant or warehouse on ten checks. The IT lead and the site lead both sign the evidence behind each one. Every line scores 2, 1 or 0, and then the sites go in order by what a stop at each would cost production.
Last reviewed 2026-11-08 by Manish Sharma.
This sheet is for IT heads and plant or warehouse leads at manufacturers and distributors in India and the GCC. Each site they run already sits on the office network. OT, or operational technology, covers “a broad range of programmable systems and devices that interact with the physical environment,” in the words of SP 800-82 Rev. 3. That is US federal guidance from NIST, used here for its definition. It binds no firm in India or the GCC. The edition dates from September 2023 and is the current final one as of November 2026. At a plant or warehouse, for example, OT includes controllers, operator PCs, scanners and dock systems.
A zone gathers devices under one set of rules. The buffer zone, in turn, is the layer between production and office through which data crosses. For more on how this works, see zones and the buffer between them. The checks cover plants and warehouses as they run today. Offices count only when they connect to production, and scoring a branch office on its own has its own sheet.
OT Security Checklist Points, Signed by IT and the Plant Team
Each site gets one sheet, and each of its ten lines carries two signatures. The plant or warehouse lead gathers the evidence on the floor. The IT lead then checks it against IT’s own records, and both sign the line once they agree.
A line earns 2 when its evidence is dated inside the window, agrees with the floor and has both signatures. It drops to 1 if the evidence is older than the window, reaches only part of the site or has one signature. It scores 0 when the leads find nothing to check, or when what they find is the gap.
Not applicable fits only a line about something the site lacks, such as check 7 at a plant with no aisles or docks. Both leads then sign the reason, and two points come off the site’s maximum. If a check is built on a list, choose three entries and walk out to each on the floor.
There is no score a site has to reach. Totals let you set sites side by side and see whether one improves between readings.
For example, look at check 9 on one filling line. The plant lead brings the note from the last manual operation drill, held eight months earlier. It also lists two open items and an owner for each. IT confirms the date in the shift log, and with a twelve-month window the line earns 2. Twelve months is our suggested window, and the firm can pick another; any change at the site also calls for a fresh look.
The OT Security Checklist and the Site Evidence Behind Each Check
The ten checks are split over three tables. For every check, a row gives the evidence, the condition for 2 points and the signer.
Paste the tables into a spreadsheet and give each site its own tab. That makes a plain OT security checklist template, with check 6 at one plant still check 6 at every other.
Equipment at the Site and the Zones That Hold It
Checks 1 to 3 ask what equipment the site holds and how the network divides it.
| No. | Check | Evidence at the site | 2 points when | Signed by |
|---|---|---|---|---|
| 1 | Device list | A list gives each device’s maker, model, firmware or software version, date of last update and owner. | Three devices picked from the list match their labels and screens when the plant lead walks to them. | The plant lead signs, then IT checks the list. |
| 2 | Zone map | One dated map shows the production, buffer and office zones. | Both teams signed it inside the window, and the walk also finds every device in its zone. | Both leads sign. |
| 3 | Flow review | A list of every flow between zones gives its reason and last review date. | Every flow has a reason, and each review date falls inside the window. | IT signs, with the plant lead for production flows. |
Check 1 asks for the update date as well as the version. The date shows how long a controller has gone without an update.
The flow list in check 3 goes beside the firewall rules at each zone boundary. A firewall is the device that allows or blocks traffic between zones by rule. If a rule has no matching flow on the list, the line scores 1. The review date on the flow list shows whether it still describes the site. For one site, that list can then serve as the document the UK NCSC’s OT architecture guidance (March 2024) asks for in its fourth principle: “Identify and document connectivity within your OT system.”
Outside Routes Into the Line and Machines Left Unpatched
Checks 4 to 6 of the OT security checklist follow routes in from outside and machines that wait for updates.
| No. | Check | Evidence at the site | 2 points when | Signed by |
|---|---|---|---|---|
| 4 | Supplier access | Each supplier account has one named person and an end date, and a log lists contractor laptops and tools. | No dormant or expired account remains, no factory password works and remote sign-in asks for a second step. | IT signs for accounts, the plant lead for the log. |
| 5 | Internet exposure | A dated scan of the site’s public addresses lists what answers. | It falls inside the window and finds no production device that outsiders can reach. | IT signs, once the plant lead confirms each address. |
| 6 | Unpatched devices | A list names each device on old software, such as a controller awaiting a shutdown. | Each one names the rule that shields it and its next shutdown window. | Both leads sign. |
For check 4, factory passwords, the contractor laptop log and multi-factor sign-in (a second proof of identity beyond the password) on every remote session are Signisys checks. The dormant account test comes from a May 2025 fact sheet on OT threats by CISA and other US federal agencies, which says to “disable dormant accounts.”
Check 5 draws on the same fact sheet, which says critical infrastructure entities “should identify their public-facing assets and remove unintentional exposure.”
Run the check 5 scan from outside the firm’s network to see what an outsider reaches. Include any address a supplier holds as well.
For check 6, why plant machines resist office-style patching explains the delay; the line asks only for a shield and a date.
Aisle Wireless, Plant Alerts and the Manual Fallback
Checks 7 to 10 cover the warehouse floor, shared alerts and running a line by hand.
| No. | Check | Evidence at the site | 2 points when | Signed by |
|---|---|---|---|---|
| 7 | Wireless survey | A dated survey covers the aisles and docks, taken while stock filled the racks. | It is inside the window, and the warehouse lead confirms full racks that day. | Both leads sign. |
| 8 | Plant traffic watched | The record shows the last plant alert, its date and who saw it in each team. | It is dated inside the window, and one person from each team saw it. | Both leads sign. |
| 9 | Manual drill | The last drill record gives the date, the line, what ran by hand and open items. | It took place inside the window, and every open item names who closes it. | The plant lead signs, with IT. |
| 10 | Joint sign-off | One signed page names who approves a zone change, answers an alert and leads an incident. | Each role has a person from IT and one from the plant, both still in post. | Both leads sign. |
Check 7 asks for full racks, as the survey has to match the aisles on a busy day. A survey of an empty building earns 1 at best.
For check 9, the drill record shows a test at one line. The CISA fact sheet names business continuity and disaster recovery plans, fail-safe mechanisms, software backups and standby systems, among other items, that “should all be routinely tested to ensure safe manual operations in the event of an incident.”
Key Takeaway A line counts only once the plant lead finds its record on the floor and IT matches it to its own files.
Putting Sites in Order by What a Stop Would Cost
When every site has a signed sheet, lay the totals side by side. The order below puts production first, then the share of points, then one tie-break.
Production Impact Comes Before Points
Place each site in one of three tiers before looking at its points. We suggest these tiers, and a firm can adjust them. In tier 1, a stop halts output or dispatch the same day. Tier 2 holds sites where buffer stock covers a day or more, and tier 3 holds sites where a stop delays neither.
Sites in tier 1 come first. Within a tier, the site with the lower share of points goes ahead. A site’s share is its points divided by its own maximum, which leaves out any not-applicable line. If two sites tie, the one with the longer check 6 list goes first.
We suggest building work before repairs at a site with 0s across several lines of the OT security checklist. Start it from the nine-step build plan for each site.
An Example With One Plant and One Warehouse
Plant P and Warehouse W are fictional. Plant P runs a packing line near Pune, and Warehouse W ships from outside Dammam.
| Site | Tier | Points | Share | Order |
|---|---|---|---|---|
| Plant P | Tier 1 | 12 of 20 | 60% | First, as a tier 1 site |
| Warehouse W | Tier 2 | 9 of 18 | 50% | Second, despite the lower share |
Warehouse W has no remote supplier. Check 4 is therefore not applicable there, and with both signatures on that reason, W is scored out of 18. W ends up with the lower share of the two. However, a stop at Plant P halts same-day output, while W holds two days of stock, and tier decides first.
Plant P’s open lines then set the work. In this example, check 5 found a production address open to the internet. Check 9, meanwhile, had no drill on record, and both gaps come before anything at Warehouse W.
When to Run the OT Security Checklist Again
Parts of the sheet, or all of it, need a fresh reading when the site changes in one of these ways:
- after a fix, for the lines it touched;
- for a new supplier route;
- for new machines or racking;
- after a zone change;
- when either lead hands over;
- after an incident.
Without any of these events, the whole sheet still comes due once per window. File past sheets beside the new one, too, as a falling total shows where to look first. Each total describes the site on the day both leads signed, and a change the following week can put it out of date.
Key Takeaway Tier comes before share: a site where a stop halts output that day goes first, even against a lower-tier site with a weaker score.
Where an OT Security Audit Checklist Stops, and Who Can Help
Two signatures confirm that the evidence is there and that it matched the floor on the day they went on. They do not judge whether the zone design is sound, and safety engineering on the line falls outside the sheet. For both, we suggest a specialist who knows the plant.
The sheet also stays on the production side. For the office network and India’s CERT-In incident reporting duties, use the office-side network audit. Link uptime between sites is a separate subject again.
Outside help makes sense when a production zone answers from the internet or nobody holds the supplier account list. It also fits a site with no manual drill on record. A firm with several plants may want one outside team to run an OT security audit checklist across them all, to read every site the same way.
Our infrastructure and networking services and our multi-site network solution cover this work, and Signisys gains when firms hire it. The sheet still works with your own two leads and no outside help. If your sheets show 0s, start with a site network review with our engineers before you plan fixes. Nothing changes on your network during the review, and the findings are yours to keep. No charge, with a fixed scope.
OT Security Checklist FAQ
What if the plant team and IT disagree on a point?
What should the first sheet record when a site has no device list at all?
How long does a site’s evidence stay current?
What should a site do with a 0 that only a shutdown can fix?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.