Rate where you honestly stand on each OT Top 10 practice for your plant or production environment. This is a directional self-check, not an assessment — nothing is sent unless you choose to email it.
OT-01 Identity and Access ControlChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
OT-02 Validated Asset InventoryChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
OT-03 Strict Network SegmentationChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
OT-04 OT-Specific Incident Response and Recovery PlanChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
OT-05 Manage Known VulnerabilitiesChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
OT-06 Remote Access PathwaysChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
OT-07 Continuous MonitoringChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
OT-08 System ResiliencyChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
OT-09 Supply Chain SecurityChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
OT-10 Review ProcessesChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
