What Is an OT/ICS Gap Assessment?
A gap assessment compares your current security posture against a recognised standard — IEC 62443, NIST CSF 2.0, or NIS2 — and identifies precisely where the gaps are. In OT environments this means examining not just technology, but the policies, procedures, people, and physical controls that together determine whether your industrial processes are adequately protected.
Unlike a vulnerability assessment, a gap assessment does not require active scanning. It is a structured interview, observation, and documentation review process that produces a clear picture of where you stand and what needs to change — prioritised by operational risk, not theoretical severity.
What We Consistently Find
In every OT environment we assess, the pattern is the same: compliance frameworks have been satisfied on paper while the controls that actually matter have been deferred, misapplied, or never implemented at all. Architectural deficits, process and policy mismatches, and legacy systems that cannot be patched are not market problems — they are what we find, engagement after engagement, across sectors.
What We Assess
- Network architecture and zone/conduit model (IEC 62443-3-2)
- Asset inventory completeness and classification
- Access control policies — logical and physical
- Patch and vulnerability management processes for OT assets
- Incident detection and response capability
- Vendor and remote access governance
- Security awareness and training maturity
- Supply chain and third-party risk controls
- Business continuity and disaster recovery for OT systems
Our 3-Phase Assessment Methodology
Deliverables
- Current state maturity scoring against chosen framework
- Gap register with risk weighting and operational impact
- Visual Resilience Roadmap — phased by effort and priority
- Executive summary for board/management reporting
- Debrief session with engineering and leadership teams