Regulatory Playbook
IEC 62443 OT Readiness Scorecard
From Confidence to Demonstrable IEC 62443 Readiness
Ask a plant security team whether they are ready for an IEC 62443 assessment, and the answer is usually a confident estimate built from what they know: the firewalls are configured, the policies are signed, the vendors are on a VPN. An assessor works differently. They sample, and they ask to see. What they credit is what can be shown, scoped to the systems under assessment and traced to a requirement, not what the team believes to be true.
That gap between confident belief and demonstrable evidence is rarely a missing-technology problem. It is missing knowledge of scope, missing proof, and missing links between the two, and these weaknesses compound: an incomplete asset inventory produces unreliable zones, which produce indefensible Security Level targets, which produce controls that cannot be mapped to anything an assessor can verify.
Shieldworkz built the IEC 62443 OT Readiness Scorecard to close exactly that gap, following dependency order from scope through to proof:
A 20-domain scorecard: covering governance, asset inventory, architecture, zones and conduits, risk assessment, Security Levels, access control, segmentation, monitoring, backup, patch management, incident response, and more, each anchored to the relevant IEC 62443 part.
A dual 0-5 scoring model: every checkpoint is scored once on maturity and once on evidence quality, with the credited score set to the lower of the two, exactly how an assessor actually works: they can only credit what they can verify.
A 58-point operational checklist: turning all 20 domains into checkpoints with the evidence expected and an entry column, ready for domain owners and engineers to complete directly.
Gating checkpoints that cap the overall band: specific checkpoints, marked with a diamond, that many other results depend on; a gating checkpoint credited below 3 limits your overall readiness band regardless of the average score.
This is a readiness indicator, not a certification or compliance determination, and the guide is explicit about that boundary throughout. A high score means you would be able to demonstrate more under assessment. It does not mean you meet any requirement or Security Level.
Why This Scorecard Matters
Most readiness is lost in the same recurring places, and the scorecard is structured to catch each one before an assessor does.
Incomplete asset inventory undermines every downstream artefact: zones, risk assessment, Security Level targets, vulnerability tracking, and backup scope are all built on it; a device missing from the inventory is missing from all of them, often the highest-consequence ones.
Documented conduits routinely permit more than the firewall actually enforces: a common pattern is a conduit definition that allows specific flows while the underlying ACL permits far more, and assessors test enforcement against definition, so the gap becomes visible immediately.
Legacy systems are assessable; undocumented shortfalls are not: a legacy component that cannot meet a requirement natively is normal, but an undocumented compromise reads as negligence, while a documented, justified, and evidenced one reads as a decision.
Remote and vendor access is usually described, not counted: organisations can typically describe the approved pathway but not the legacy ones, a modem an integrator left behind, a vendor-owned cellular gateway, a remote-support tool installed on an engineering workstation.
Every weakness pattern in the guide is labelled by source, a concept the IEC 62443 series addresses, a Shieldworkz practitioner recommendation, an illustrative threshold, or a fictional example, so a team never mistakes a scoring convention for the text of the standard itself.
Why Downloading This Scorecard Is Critical for Your Organization
If your organisation is preparing for an IEC 62443-based assessment, self-initiated, customer-driven, or regulatory, the gap between what your team believes it has and what an assessor will actually credit is the single biggest source of surprise findings. This scorecard exists to surface that gap on your own timeline, not the assessor's.
Here what the full package puts in your hands:
A 19-KPI/KRI tracker: measurable indicators with formulas and named owners, so readiness is monitored continuously rather than re-discovered at the next assessment cycle.
An executive readiness dashboard: with a fully worked fictional example, so CISOs and plant management see exactly how domain scores roll up into a single, board-ready readiness view.
Interpreting-results guidance: readiness bands, gating rules, and a clear explanation of the difference between readiness and compliance, so scores are never over-claimed.
A fictional worked case study: walking a facility from fragmented documentation to assessment-ready, plus a standalone printable Assessment Readiness Worksheet domain owners can use directly.
Key Takeaways From the Scorecard
Credit the lower of maturity and evidence, always. A control you rate 4 on maturity but can only evidence informally at a 1 is credited as a 1. This single rule reflects exactly how assessors work, and it is the rule most self-assessments skip.
A control configured once is not evidence that it operates. Review records, test results, and logs across more than one cycle are what demonstrate operation; many organisations have the control but not the record that proves it runs.
Weak evidence has a recognisable shape. A policy document with no corroborating artefact, an undated screenshot, “we have a SOC” without proof of what it monitors, “MFA is enabled” without a coverage report, these are the exact patterns auditors are trained to probe first.
Documentation organised by author, not by requirement, hides coverage gaps. Without a mapping from document to requirement, an assessor must infer which document supports which checkpoint, and the organisation cannot see where its own coverage is thin.
Gating checkpoints cap the result regardless of the average. A strong overall score cannot offset a single gating checkpoint, such as an unregistered remote-access pathway, credited below 3; that checkpoint caps the whole band.
“Everything is critical” fails the same way as “nothing is.” Without a stated, defensible basis for asset criticality, nothing can be sampled, prioritised, or justified in front of an assessor.
Evidence weak collection wastes the weeks that should go to remediation. Evidence assembled just before an assessment, from email threads, screenshots, and recollection, is usually undated, unattributed, and of uncertain scope, and an assessor simply cannot rely on it.
How Shieldworkz Supports Your IEC 62443 Readiness Journey
Scoring your own readiness tells you where the gaps are. Closing them before an assessor finds them, especially at scale across multiple sites, is where Shieldworkz comes in.
OThello Assess: builds the reconciled, dated asset inventory this scorecard treats as the foundation every other domain depends on, verified against discovery and walk-down, in sub-24-hour assessment cycles.
OT network detection and response: generates the operating evidence, segmentation test results, deviation alerts, log retention, that moves a checkpoint from Level 3 defined-and-implemented to Level 4 measured-and-consistently-operated.
Zone, conduit, and Security Level workshops: structuring a documented, defensible risk-assessment method and deriving SL-T per zone and conduit, replacing the blanket “all OT is SL 2” pattern this guide flags as a common gap.
Regulatory and certification readiness engagements: translating this scorecard's 20 domains, together with NIS2 and other frameworks where they overlap, into a sequenced remediation plan ahead of your actual assessment date.
Facilities that engage us during the scoring process don't just complete a self-assessment. They walk into their actual IEC 62443 assessment already knowing what the assessor will ask to see, because they have already shown it to themselves first.
Download the Scorecard
An assessor will only credit what you can show. This scorecard exists so you find out what that is before the assessment, not during it.
Fill in the form to receive your free copy of the IEC 62443 OT Readiness Scorecard. You'll also have the option to book a no-obligation consultation with a Shieldworkz OT security expert, who can help you run your first scorecard pass and prioritise remediation against your gating checkpoints first.
Schedule a Demo With Shieldworkz OT Security Experts
Download your copy today!
Prepare for IEC 62443 Assessment With Evidence, Not Assumptions.
