Regulatory Playbook
OT Security Gap Assessment Toolkit 2026
A Passing IT Review Is Not OT Risk Reduction
The pattern is familiar. An organisation passes an IT-oriented security review, then discovers during an incident that nobody knew a vendor tunnel existed, or that a segmented zone allowed any traffic from the business network. A firewall inventory is not a segmentation assessment. An antivirus rollout is not malware control on the assets that matter.
The Shieldworkz OT Security Gap Assessment Toolkit 2026 is built for the practitioners who actually run the assessment. It contains 10 assessment domains and 77 questions, each with the evidence to request, what good looks like and the risk if the control is missing. Eighteen questions are tagged Critical-if-missing and drive the gap rules. The method is designed so that two assessors working from the same evidence reach similar scores. It is an assessment methodology, not a certification.
Why Matters Right Now
Most OT programmes can say which controls they believe they have. Far fewer can show that those controls cover the assets that matter, are configured and operated as intended, cannot be bypassed and would work under pressure.
Controls fail in five quiet ways. Coverage (a control on managed Windows hosts misses the controller), configuration (a rule permits any source to the historian), bypass (MFA on the approved path while a forgotten tunnel skips it), effectiveness (backups run, but controller projects were never included) and usability under pressure (a plan exists, but nobody can authorise isolating a plant network).
Official guidance is converging on the basics. The toolkit's Top 20 gap list draws in part on the May 2025 CISA, FBI, EPA and DOE primary mitigations and the August 2025 OT asset inventory guidance. Internet-exposed devices, default credentials and unmanaged remote access sit at the top for good reason.
Regulators are asking for proof. NIS2, NERC CIP, the CEA Regulations and NCA OTCC apply to entities in their scope. The toolkit tests the common themes and helps you gather evidence, while leaving clause-level mapping and applicability to you and your regulator.
Evidence ages and environments change, which is why the toolkit treats assessment as a cycle: scope, collect, validate, score, prioritise, remediate, re-assess.
Why You Should Download This Toolkit
This is a working kit, not a framework summary. Every section produces something your team can use on Monday.
A 60-minute rapid triage. Twenty deliberately blunt questions for the OT security lead and a plant engineer, each pointing to the Critical-tagged questions you should assess first.
Ten domains, 77 questions. From asset inventory and IT/OT segmentation to identity, vulnerability management, monitoring, recovery, engineering change, third parties and governance.
A scoring method that resists optimism. A 0 to 5 scale with evidence-confidence caps, so a policy or screenshot supports a 3 at most, and the gap between credited and uncredited scores shows your quickest wins.
The Top 20 OT security gaps. Each with why it matters, the evidence to check, a risk level and the recommended next action.
A risk prioritisation matrix. A priority index built from consequence, likelihood and control weakness, because a critical CVSS score on an isolated host can matter less than a medium weakness on a critical process with a remote path.
Ready-to-use templates. An evidence collection checklist, sample findings, an executive reporting template, a 30/60/90-day remediation roadmap and a printable assessor worksheet.
If your team has been asked to run an OT assessment and needs a scope statement, an evidence register, scored findings and a sequenced plan that operations will accept, this toolkit is built for exactly that brief.
Key Takeaways
Critical gaps override the average. With any Critical gap open, the readiness band cannot be reported above Developing, whatever the score.
Evidence beats assertion. Confidence is capped at 3 for current but unverified artefacts, 2 for verbal or partial evidence and 0 where none exists.
Score the weakest critical scope. A control that covers most sites but not the critical process unit scores as the unit, and partial coverage cannot exceed 2.
Gap class is not fix-first priority. A finding with safety impact 5 and exposure 4 or 5 is Priority 1 regardless of the index.
Assess safely. No active scans on live control networks without engineering approval. Prefer document review, walk-downs, configuration exports and passive analysis.
Start where everything depends. Collect architecture diagrams, the asset inventory, the remote access register and firewall exports first, because discrepancies there change the rest of the assessment.
Legacy is assessable; undocumented is not. Unsupported systems are normal in OT. The gap is the compensating control nobody recorded or evidenced, so each unsupported asset needs an owner, a decision and proof the compensation works.
How Shieldworkz Supports Your Assessment
Running the toolkit for one site with a spreadsheet works. The strain appears when you repeat it across sites, frameworks and changing environments, because the difficulty is carrying information through six hand-offs without losing traceability.
OThello Assess. Structures your documentation, validates assessment inputs, maps evidence to IEC 62443, NIS2, NERC CIP, OTCC and CENELEC TS 50701, identifies gaps and prioritises remediation, so the process is repeatable instead of rebuilt each cycle.
Fast baselines. Sub-24-hour assessment cycles establish a current posture while your engineers stay focused on remediation.
Independent review. A second assessor on Critical-tagged questions, as the toolkit recommends, reduces bias and strengthens what you show your board or regulator.
Compliance and monitoring programmes. IEC 62443 and NIS2 readiness, OT threat intelligence and OT SOC design that turn findings into lasting capability.
OThello Assess supports preparation and structured analysis. It does not replace an assessor's judgement or certify an environment, and you do not need it to use the toolkit.
Download the Toolkit
If your organization runs OT, ICS, manufacturing, energy, oil and gas, utilities or other critical infrastructure, this toolkit will help you find your real gaps before an incident or an auditor does.
Fill out the form to download the OT Security Gap Assessment Toolkit 2026 and book a free 30-minute technical briefing with our OT security experts.
See how OThello Assess and our OT security experts can turn your evidence into a defensible assessment. Fill in your details and our team will be in touch to arrange your session.
Download your copy today!
Prepare for IEC 62443 Gap Assessment With Verified Evidence and Clear OT Security Priorities.
A Passing IT Review Is Not OT Risk Reduction
The pattern is familiar. An organisation passes an IT-oriented security review, then discovers during an incident that nobody knew a vendor tunnel existed, or that a segmented zone allowed any traffic from the business network. A firewall inventory is not a segmentation assessment. An antivirus rollout is not malware control on the assets that matter.
The Shieldworkz OT Security Gap Assessment Toolkit 2026 is built for the practitioners who actually run the assessment. It contains 10 assessment domains and 77 questions, each with the evidence to request, what good looks like and the risk if the control is missing. Eighteen questions are tagged Critical-if-missing and drive the gap rules. The method is designed so that two assessors working from the same evidence reach similar scores. It is an assessment methodology, not a certification.
Why Matters Right Now
Most OT programmes can say which controls they believe they have. Far fewer can show that those controls cover the assets that matter, are configured and operated as intended, cannot be bypassed and would work under pressure.
Controls fail in five quiet ways. Coverage (a control on managed Windows hosts misses the controller), configuration (a rule permits any source to the historian), bypass (MFA on the approved path while a forgotten tunnel skips it), effectiveness (backups run, but controller projects were never included) and usability under pressure (a plan exists, but nobody can authorise isolating a plant network).
Official guidance is converging on the basics. The toolkit's Top 20 gap list draws in part on the May 2025 CISA, FBI, EPA and DOE primary mitigations and the August 2025 OT asset inventory guidance. Internet-exposed devices, default credentials and unmanaged remote access sit at the top for good reason.
Regulators are asking for proof. NIS2, NERC CIP, the CEA Regulations and NCA OTCC apply to entities in their scope. The toolkit tests the common themes and helps you gather evidence, while leaving clause-level mapping and applicability to you and your regulator.
Evidence ages and environments change, which is why the toolkit treats assessment as a cycle: scope, collect, validate, score, prioritise, remediate, re-assess.
Why You Should Download This Toolkit
This is a working kit, not a framework summary. Every section produces something your team can use on Monday.
A 60-minute rapid triage. Twenty deliberately blunt questions for the OT security lead and a plant engineer, each pointing to the Critical-tagged questions you should assess first.
Ten domains, 77 questions. From asset inventory and IT/OT segmentation to identity, vulnerability management, monitoring, recovery, engineering change, third parties and governance.
A scoring method that resists optimism. A 0 to 5 scale with evidence-confidence caps, so a policy or screenshot supports a 3 at most, and the gap between credited and uncredited scores shows your quickest wins.
The Top 20 OT security gaps. Each with why it matters, the evidence to check, a risk level and the recommended next action.
A risk prioritisation matrix. A priority index built from consequence, likelihood and control weakness, because a critical CVSS score on an isolated host can matter less than a medium weakness on a critical process with a remote path.
Ready-to-use templates. An evidence collection checklist, sample findings, an executive reporting template, a 30/60/90-day remediation roadmap and a printable assessor worksheet.
If your team has been asked to run an OT assessment and needs a scope statement, an evidence register, scored findings and a sequenced plan that operations will accept, this toolkit is built for exactly that brief.
Key Takeaways
Critical gaps override the average. With any Critical gap open, the readiness band cannot be reported above Developing, whatever the score.
Evidence beats assertion. Confidence is capped at 3 for current but unverified artefacts, 2 for verbal or partial evidence and 0 where none exists.
Score the weakest critical scope. A control that covers most sites but not the critical process unit scores as the unit, and partial coverage cannot exceed 2.
Gap class is not fix-first priority. A finding with safety impact 5 and exposure 4 or 5 is Priority 1 regardless of the index.
Assess safely. No active scans on live control networks without engineering approval. Prefer document review, walk-downs, configuration exports and passive analysis.
Start where everything depends. Collect architecture diagrams, the asset inventory, the remote access register and firewall exports first, because discrepancies there change the rest of the assessment.
Legacy is assessable; undocumented is not. Unsupported systems are normal in OT. The gap is the compensating control nobody recorded or evidenced, so each unsupported asset needs an owner, a decision and proof the compensation works.
How Shieldworkz Supports Your Assessment
Running the toolkit for one site with a spreadsheet works. The strain appears when you repeat it across sites, frameworks and changing environments, because the difficulty is carrying information through six hand-offs without losing traceability.
OThello Assess. Structures your documentation, validates assessment inputs, maps evidence to IEC 62443, NIS2, NERC CIP, OTCC and CENELEC TS 50701, identifies gaps and prioritises remediation, so the process is repeatable instead of rebuilt each cycle.
Fast baselines. Sub-24-hour assessment cycles establish a current posture while your engineers stay focused on remediation.
Independent review. A second assessor on Critical-tagged questions, as the toolkit recommends, reduces bias and strengthens what you show your board or regulator.
Compliance and monitoring programmes. IEC 62443 and NIS2 readiness, OT threat intelligence and OT SOC design that turn findings into lasting capability.
OThello Assess supports preparation and structured analysis. It does not replace an assessor's judgement or certify an environment, and you do not need it to use the toolkit.
Download the Toolkit
If your organization runs OT, ICS, manufacturing, energy, oil and gas, utilities or other critical infrastructure, this toolkit will help you find your real gaps before an incident or an auditor does.
Fill out the form to download the OT Security Gap Assessment Toolkit 2026 and book a free 30-minute technical briefing with our OT security experts.
See how OThello Assess and our OT security experts can turn your evidence into a defensible assessment. Fill in your details and our team will be in touch to arrange your session.
Download your copy today!
Prepare for IEC 62443 Gap Assessment With Verified Evidence and Clear OT Security Priorities.
A Passing IT Review Is Not OT Risk Reduction
The pattern is familiar. An organisation passes an IT-oriented security review, then discovers during an incident that nobody knew a vendor tunnel existed, or that a segmented zone allowed any traffic from the business network. A firewall inventory is not a segmentation assessment. An antivirus rollout is not malware control on the assets that matter.
The Shieldworkz OT Security Gap Assessment Toolkit 2026 is built for the practitioners who actually run the assessment. It contains 10 assessment domains and 77 questions, each with the evidence to request, what good looks like and the risk if the control is missing. Eighteen questions are tagged Critical-if-missing and drive the gap rules. The method is designed so that two assessors working from the same evidence reach similar scores. It is an assessment methodology, not a certification.
Why Matters Right Now
Most OT programmes can say which controls they believe they have. Far fewer can show that those controls cover the assets that matter, are configured and operated as intended, cannot be bypassed and would work under pressure.
Controls fail in five quiet ways. Coverage (a control on managed Windows hosts misses the controller), configuration (a rule permits any source to the historian), bypass (MFA on the approved path while a forgotten tunnel skips it), effectiveness (backups run, but controller projects were never included) and usability under pressure (a plan exists, but nobody can authorise isolating a plant network).
Official guidance is converging on the basics. The toolkit's Top 20 gap list draws in part on the May 2025 CISA, FBI, EPA and DOE primary mitigations and the August 2025 OT asset inventory guidance. Internet-exposed devices, default credentials and unmanaged remote access sit at the top for good reason.
Regulators are asking for proof. NIS2, NERC CIP, the CEA Regulations and NCA OTCC apply to entities in their scope. The toolkit tests the common themes and helps you gather evidence, while leaving clause-level mapping and applicability to you and your regulator.
Evidence ages and environments change, which is why the toolkit treats assessment as a cycle: scope, collect, validate, score, prioritise, remediate, re-assess.
Why You Should Download This Toolkit
This is a working kit, not a framework summary. Every section produces something your team can use on Monday.
A 60-minute rapid triage. Twenty deliberately blunt questions for the OT security lead and a plant engineer, each pointing to the Critical-tagged questions you should assess first.
Ten domains, 77 questions. From asset inventory and IT/OT segmentation to identity, vulnerability management, monitoring, recovery, engineering change, third parties and governance.
A scoring method that resists optimism. A 0 to 5 scale with evidence-confidence caps, so a policy or screenshot supports a 3 at most, and the gap between credited and uncredited scores shows your quickest wins.
The Top 20 OT security gaps. Each with why it matters, the evidence to check, a risk level and the recommended next action.
A risk prioritisation matrix. A priority index built from consequence, likelihood and control weakness, because a critical CVSS score on an isolated host can matter less than a medium weakness on a critical process with a remote path.
Ready-to-use templates. An evidence collection checklist, sample findings, an executive reporting template, a 30/60/90-day remediation roadmap and a printable assessor worksheet.
If your team has been asked to run an OT assessment and needs a scope statement, an evidence register, scored findings and a sequenced plan that operations will accept, this toolkit is built for exactly that brief.
Key Takeaways
Critical gaps override the average. With any Critical gap open, the readiness band cannot be reported above Developing, whatever the score.
Evidence beats assertion. Confidence is capped at 3 for current but unverified artefacts, 2 for verbal or partial evidence and 0 where none exists.
Score the weakest critical scope. A control that covers most sites but not the critical process unit scores as the unit, and partial coverage cannot exceed 2.
Gap class is not fix-first priority. A finding with safety impact 5 and exposure 4 or 5 is Priority 1 regardless of the index.
Assess safely. No active scans on live control networks without engineering approval. Prefer document review, walk-downs, configuration exports and passive analysis.
Start where everything depends. Collect architecture diagrams, the asset inventory, the remote access register and firewall exports first, because discrepancies there change the rest of the assessment.
Legacy is assessable; undocumented is not. Unsupported systems are normal in OT. The gap is the compensating control nobody recorded or evidenced, so each unsupported asset needs an owner, a decision and proof the compensation works.
How Shieldworkz Supports Your Assessment
Running the toolkit for one site with a spreadsheet works. The strain appears when you repeat it across sites, frameworks and changing environments, because the difficulty is carrying information through six hand-offs without losing traceability.
OThello Assess. Structures your documentation, validates assessment inputs, maps evidence to IEC 62443, NIS2, NERC CIP, OTCC and CENELEC TS 50701, identifies gaps and prioritises remediation, so the process is repeatable instead of rebuilt each cycle.
Fast baselines. Sub-24-hour assessment cycles establish a current posture while your engineers stay focused on remediation.
Independent review. A second assessor on Critical-tagged questions, as the toolkit recommends, reduces bias and strengthens what you show your board or regulator.
Compliance and monitoring programmes. IEC 62443 and NIS2 readiness, OT threat intelligence and OT SOC design that turn findings into lasting capability.
OThello Assess supports preparation and structured analysis. It does not replace an assessor's judgement or certify an environment, and you do not need it to use the toolkit.
Download the Toolkit
If your organization runs OT, ICS, manufacturing, energy, oil and gas, utilities or other critical infrastructure, this toolkit will help you find your real gaps before an incident or an auditor does.
Fill out the form to download the OT Security Gap Assessment Toolkit 2026 and book a free 30-minute technical briefing with our OT security experts.
See how OThello Assess and our OT security experts can turn your evidence into a defensible assessment. Fill in your details and our team will be in touch to arrange your session.
Download your copy today!
Prepare for IEC 62443 Gap Assessment With Verified Evidence and Clear OT Security Priorities.
