OT Security Health Check & Maturity Assessment
Get a clear picture of current cyber states and formulate an improvement roadmap to strengthen OT security postures while optimising operational performance.
Assessment Overview
For resource and energy companies, a better understanding of current cyber states and formulating a roadmap to strengthen OT security postures - without compromising operational performance - will bring huge benefits to them as operators.
An OT Security Health Check and Maturity Assessment provides an understanding of where you are at, identifies where you want to be and gives you steps for how to get there, delivering:
- Have a view of the current state and determine a target state
- To have a clear and prioritised action plan
- To determine short term testing objectives
- Have recommendations to align with and support strategic pillars
- Assess the state of OT Cyber Security governance
- Have risk identification
- To benchmark information to other business of similar operations and size
- To have findings to be communicated/documented in a way that would be readily understood by the business
- To identify opportunities for modernisation
Our Approach
Following an Agile, outcome-based approach, the four stages are delivered in an approximate 3-week duration.
3 Week Duration
Initiation & Planning
Review of key technology artefacts and identification of stakeholder groups prior to engagement.
Review and analysis of existing documentation, standards and architecture information to determine a baseline for the information and standards that exist and establish areas in which relevant information is not available.
This may cover areas such as:
- A view of the current state and determine a target state
- A clear and prioritised action plan
- Short term testing objectives
- Recommendations to align with and support strategic pillars
- An approach to move to a mature OT Cyber Security state
- Risk identification
- A benchmark information to other businesses of similar operations and size
- Findings communicated/documented to the business
- Opportunities for modernisation identified
Workshops & Discovery
Engagement with key functional business and technology stakeholders.
This stage is an active participation engagement – either onsite and/or virtually to discuss and work through the OT Security Health Assessment items. This will include personnel and teams who manage and maintain the relevant OT infrastructure. After reviewing the client’s provided information, the following workshops may need to be conducted:
Office Workshop
- OT Cyber Security Governance Policy
- OT Interconnection Architecture
- OT IR and DR Management
Site Workshop
- Industrial Control Systems (ICS)
- Distributed Control Systems (DCS)
- Safety Instrumentation Systems (SIS)
- Energy Management System (EMS)
Analysis
Analyse collated quantitative and qualitative data for findings report & presentation.
After the workshops Denver Technology will document and analyse the information gathered during the preceding stage including:
- Heat map findings
- Action list and risk-based prioritisation
- Identify industry standards/ frameworks to be adhered to
- Identify quick wins e.g. risk effort matrix
- Identify modernisation and innovation opportunities
- Compare and contrast to other “known” mining organisations
Report & Present
Provision of report and recommendations presentation to stakeholders and Leadership Team.
The final stage of the approach involves the collation and final analysis of the information collected as part of the OT Security Health Assessment. The assessment will produce the following final deliverables:
Draft Report | A draft report will be delivered to client stakeholders for review – allowing for feedback/request any clarifications prior to final report.
Final Report | OT Security Health Assessment Final Report containing the findings, analysis, recommendations, and action items gathered during the preceding stages of the assessment.
Report Presentation | OT Security Health Assessment Final Report containing the findings, analysis, recommendations, and action items gathered during the preceding stages of the assessment will be presented.