OT / ICS Security evaluation questionnaire

This evaluation is stored in your browser only. We cannot see it, and it is not tied to any account. Save it to a link or create an account to keep it across devices — you can export it at any time either way.

All 66 vendors in this category.

• baselineRFIWhat OT/ICS-specific protocols does the platform natively parse and understand (Modbus, DNP3, S7comm, EtherNet/IP, BACnet, etc.), and how many are supported out of the box versus requiring custom parsers?weight 3
  Answer key — what a strong answer shows

  Look for a specific protocol list and clarity on native vs. custom-built support; generic 'OT visibility' claims without named protocols are a red flag.

• baselineRFPDescribe the asset-discovery methodology for OT environments — passive network monitoring only, or does it include active scanning — and what is the documented safety record for active scanning on fragile legacy control systems?weight 3
  Answer key — what a strong answer shows

  Passive-only is safer for fragile OT gear; if active scanning is offered, look for a real safety track record and opt-in controls, since a scan that crashes a PLC is a serious operational risk.

• baselineRFIHow does the platform handle IT/OT network segmentation validation — can it verify that Purdue Model boundaries are actually enforced, not just documented?weight 3
  Answer key — what a strong answer shows

  Look for active validation against real traffic/flows, not just a static policy review.

• baselineRFIWhat is the vulnerability intelligence source for OT-specific CVEs (ICS-CERT/CISA advisories, vendor PSIRTs), and how quickly are newly disclosed ICS vulnerabilities correlated against the discovered asset inventory?weight 3
  Answer key — what a strong answer shows

  Strong answers name ICS-CERT/CISA advisories specifically and state a correlation latency, not just 'we track vulnerabilities.'

• baselineRFPDetail anomaly detection for OT-specific attack patterns (unauthorized PLC logic changes, abnormal command sequences) versus generic IT-style network anomaly detection repurposed for OT.weight 3
  Answer key — what a strong answer shows

  Look for OT-native detection logic built for control-system semantics, not a generic NDR product with an OT label bolted on.

• baselineRFIDoes the platform provide risk scoring specific to safety-instrumented systems (SIS) and safety-critical assets, distinguishing them from general OT assets?weight 3
  Answer key — what a strong answer shows

  Safety-critical systems warrant distinct, higher-priority risk treatment — a vendor with no answer likely treats all OT assets uniformly.

• baselineRFPExplain deployment architecture for air-gapped or highly segmented OT networks — can the platform operate fully on-prem/offline, and how are updates/signatures delivered without direct internet access?weight 3
  Answer key — what a strong answer shows

  Look for a genuine offline/air-gapped deployment mode with a documented update mechanism, not an assumption of cloud connectivity.

• baselineRFIWhat incident response capability exists specific to OT — can the platform support safe isolation of a compromised OT asset without disrupting physical process operations?weight 3
  Answer key — what a strong answer shows

  Isolating an OT asset carelessly can halt a physical process — look for OT-aware response actions, not IT-style automatic quarantine.

• baselineRFIWhat is the pricing model — per asset, per site, or a flat enterprise tier — and how does cost scale for a large industrial customer with many geographically distributed facilities, each with its own asset population?weight 3
  Answer key — what a strong answer shows

  Look for transparent, predictable per-site/per-facility scaling economics; OT deployments often span many distributed sites, and unclear multi-site pricing creates real budget risk.

• baselineRFIDoes the platform map coverage to OT-specific compliance frameworks (IEC 62443, NERC CIP) with audit-ready reporting, and can it demonstrate compliance-relevant evidence (e.g., asset inventory completeness, network segmentation validation) directly to an auditor?weight 3
  Answer key — what a strong answer shows

  Native OT-framework compliance mapping and audit-ready reporting are a distinct, higher-value capability than generic IT-compliance reporting repurposed for OT — ask for the specific frameworks supported.

• baselineRFPDescribe the vendor/systems-integrator ecosystem for deployment support — does the vendor have established partnerships with OT integrators experienced in the customer's specific industrial processes, or does deployment rely entirely on the vendor's own limited field team?weight 3
  Answer key — what a strong answer shows

  OT deployments often require deep, plant-specific operational knowledge beyond generic cybersecurity expertise — a mature integrator ecosystem indicates a more scalable, lower-risk deployment path than a small vendor-only field team.

• baselineRFIWhat OT-specific threat intelligence feed does the platform use (distinct from general IT threat intel), covering known ICS-targeting malware families and threat actor groups specifically focused on industrial environments?weight 3
  Answer key — what a strong answer shows

  OT-targeting threats (e.g., ICS-specific malware families) require distinct threat intelligence from general IT feeds — a vendor should name a real OT-specific intelligence source rather than repurposing generic IT threat intel.

• baselineRFPDetail monitoring for third-party/vendor remote-access into OT environments (a common real-world OT breach vector — a contractor's remote-access credentials being compromised) — is this a native monitored capability or entirely out of scope?weight 3
  Answer key — what a strong answer shows

  Third-party remote access is one of the most common real OT breach vectors — a vendor with no answer here has a significant real-world coverage gap regardless of how strong their core anomaly detection is.

• baselineRFIIs a named incident-response retainer with genuine OT/ICS expertise available (distinct from a generic IT incident-response team applying IT playbooks to an OT environment), and what is the team's track record of real OT-specific incident engagements?weight 3
  Answer key — what a strong answer shows

  Generic IT incident responders often lack the specialized knowledge to safely respond to an OT incident without risking physical process disruption — ask specifically about OT-experienced responders and real engagement history.

• baselineRFIWhat is the platform's false-positive rate specifically in an OT context, given that a false alarm triggering an unnecessary safety shutdown or production halt has a much higher real-world cost than a false alarm in a typical IT environment?weight 3
  Answer key — what a strong answer shows

  The cost asymmetry of false positives is far higher in OT (a false alarm can halt physical production) than in IT — a vendor should have a specific, OT-context-aware answer, not a generic IT-derived accuracy figure.

• baselineRFPExplain deployment consistency for a large multi-site industrial customer — can detection quality and asset coverage be maintained uniformly across many distributed facilities with varying levels of IT/OT network maturity, or does quality degrade at less-mature sites?weight 3
  Answer key — what a strong answer shows

  A vendor should give an honest answer about whether facilities with less-mature IT/OT convergence get materially weaker coverage — a common real-world gap for large industrial organizations with uneven site maturity.

• baselineRFPComplete the OT Cybersecurity Systems Specification requirements (TVE spreadsheet Sheet 2A), covering High-Level, Functional, User Interface, Integration, System Security, Environmental, and Testing/Validation Requirements for the proposed OT security technology.weight 3
• baselineRFPFor each of the five Representative Architectures (Separate OT-IT, One-Way Data Flow, No DMZ, DMZ, and DMZ with Segmentation), articulate relevant design considerations and deployment strategies, and depict where the proposed technology is placed within the architecture, marking up the provided architecture diagrams.weight 3
• baselineRFPDemonstrate the technology's ability to detect and respond to adversarial cyber activity on OT networks in the energy sector through a collective defense approach.weight 3
• baselineRFPDemonstrate how the technology utilizes artificial intelligence to identify anomalies, reduce false positives, and update OT asset information.weight 3
• baselineRFPDemonstrate the technology's advanced analytics capability to enable the user to identify systems that have been compromised and pinpoint where.weight 3
• baselineRFPDemonstrate how the technology increases system resilience in energy delivery control systems or components.weight 3
• baselineRFPDemonstrate autonomous defense solutions deployed at remote endpoints to protect against in-band and out-of-band attacks, including hardware, firmware, or software that protects, defends, or hardens deployed OT.weight 3
• baselineRFPDemonstrate the ability to deliver anonymized, aggregated threat data to a separate platform for collective analysis and information sharing.weight 3
• baselineRFPDescribe the Vendor's flexibility with respect to lightweight contracts and simple invoice/payment options intended to facilitate speedy deployments of OT cybersecurity technologies across the utility sector, and the ease of use and simplicity of the Vendor's proposed Deployment Execution Strategies and Methods.weight 3
• baselineRFPProvide Industrial Control Systems Security Review/Assessment.weight 3

These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.