Network Audit for Critical Infrastructure: OT and ICS Considerations

Network auditing in critical infrastructure environments operates under fundamentally different constraints than enterprise IT auditing, driven by the presence of Operational Technology (OT) and Industrial Control Systems (ICS) that govern physical processes in sectors such as energy, water treatment, chemical manufacturing, and transportation. Disruption or misconfiguration in these environments carries consequences measured not only in data loss but in physical safety events, public health impacts, and national security risk. This page covers the scope, structure, regulatory framing, and professional considerations specific to OT/ICS network audits across US critical infrastructure sectors.

• Definition and scope
• Core mechanics or structure
• Causal relationships or drivers
• Classification boundaries
• Tradeoffs and tensions
• Common misconceptions
• Checklist or steps (non-advisory)
• Reference table or matrix

Definition and scope

An OT/ICS network audit is a structured examination of the communication architecture, device configurations, security controls, and data flows within industrial and operational technology environments. The scope encompasses Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), Human-Machine Interfaces (HMIs), and the network infrastructure—both wired and wireless—that interconnects them.

The Cybersecurity and Infrastructure Security Agency (CISA) identifies 16 critical infrastructure sectors where OT/ICS systems are operational. Within those sectors, the audit scope extends beyond traditional IT assets to include field devices, industrial protocols (Modbus, DNP3, EtherNet/IP, PROFINET), and safety instrumented systems (SIS). A complete network audit scope definition for a power utility, for example, must account for substations, energy management systems (EMS), and the communication pathways connecting them—not merely the corporate IT perimeter.

The National Institute of Standards and Technology defines ICS security scope in NIST SP 800-82 Rev. 2, "Guide to Industrial Control Systems (ICS) Security", distinguishing between IT-centric and OT-centric control planes. The fundamental distinction is that OT systems prioritize availability and real-time process integrity over confidentiality—reversing the CIA triad priority order standard in enterprise IT auditing.

Core mechanics or structure

OT/ICS network audits proceed through discrete phases that mirror the network audit methodology applied in IT environments but with significant modifications for industrial safety constraints.

Phase 1 — Pre-engagement and safety review. Before any active scanning or enumeration, auditors coordinate with plant engineers and safety officers to identify devices where network probes could cause process disruption. This includes identifying "no-touch" PLCs, safety controllers, and relay protection devices.

Phase 2 — Passive network discovery. Unlike IT audits, active scanning is frequently restricted in OT environments. Passive discovery using network taps, span ports, or purpose-built OT visibility platforms (such as those conforming to IEC 62443 principles) captures device fingerprinting, protocol mapping, and traffic baseline analysis without injecting packets into the control network.

Phase 3 — Architecture and segmentation review. The audit maps the Purdue Enterprise Reference Architecture (PERA) zones: Level 0 (field devices), Level 1 (control), Level 2 (supervisory), Level 3 (operations/site), and the demilitarized zone (DMZ) separating Level 3 from Level 4 (enterprise IT). Each zone boundary, firewall policy, and data diode is documented. This directly overlaps with network segmentation audit practices applied specifically to industrial zone hierarchies.

Phase 4 — Configuration and protocol analysis. Device configurations on switches, firewalls, historians, and HMIs are reviewed against hardening baselines. Industrial protocol usage is analyzed for unauthenticated command exposure—a common vulnerability in legacy Modbus TCP and DNP3 implementations that lack authentication by design.

Phase 5 — Vulnerability identification. Passive or low-impact scanning is used against non-safety-critical assets. Results are correlated against the ICS-CERT advisories published by CISA and the NIST National Vulnerability Database (NVD) for OT-specific CVEs.

Phase 6 — Reporting. Findings are categorized by operational risk, not only CVSS score, because a high-CVSS vulnerability on an isolated OT segment may carry lower operational risk than a medium-CVSS misconfiguration on a boundary firewall bridging the corporate and control networks. The network audit reporting structure for critical infrastructure must include operational impact ratings alongside technical severity.

Causal relationships or drivers

The growth in OT/ICS network audit activity is driven by three converging regulatory and threat pressures.

Regulatory mandate. The North American Electric Reliability Corporation Critical Infrastructure Protection standards (NERC CIP) impose enforceable audit requirements on bulk electric system operators. NERC CIP-007-6 specifies controls for systems security management, including patch management and ports/services review. NERC CIP-005-6 mandates electronic security perimeter controls. Non-compliance penalties reached a maximum of $1 million per violation per day under the Federal Power Act, as authorized by the Federal Energy Regulatory Commission (FERC). For water sector entities, the America's Water Infrastructure Act of 2018 (AWIA) requires risk and resilience assessments for community water systems serving more than 3,300 persons (EPA AWIA page).

Threat landscape expansion. The convergence of OT and IT networks—driven by remote monitoring, cloud historian integrations, and vendor remote access—has expanded the attack surface of industrial systems. CISA documented adversary reconnaissance of ICS environments in its Alert AA22-103A, which detailed APT activity targeting energy sector ICS.

Insurance and procurement requirements. Cyber insurance underwriters and federal procurement frameworks increasingly require evidence of OT-specific security audits as a condition of coverage or contract award, creating demand independent of regulatory schedules.

Classification boundaries

OT/ICS network audits are distinguished from adjacent audit types along three axes:

By system type: IT network audits address servers, endpoints, and cloud resources. OT audits address PLCs, RTUs, DCS controllers, HMIs, and historians. Hybrid environments require both methodologies applied with clear scope demarcation.

By protocol coverage: Standard IT audits address TCP/IP stack services. OT audits additionally cover industrial protocols—DNP3, Modbus RTU, PROFIBUS, IEC 61850 GOOSE, and OPC-UA—that do not appear in conventional IT audit tooling.

By regulatory framework: IT audits may align to NIST CSF, SOC 2, or PCI DSS. OT audits in the electric sector must align to NERC CIP. Chemical sector facilities subject to the Chemical Facility Anti-Terrorism Standards (CFATS), administered by CISA, face separate audit requirements. Nuclear facilities fall under Nuclear Regulatory Commission (NRC) Regulatory Guide 5.71.

A network audit for enterprises in non-industrial sectors does not substitute for an OT-specific audit even when the enterprise operates on the same physical campus as an ICS environment.

Tradeoffs and tensions

Availability vs. thoroughness. The primary operational tension in OT audits is between audit completeness and process continuity. Active scanning that would be routine on an IT network can crash legacy PLCs or disrupt control loops. Auditors face a structural choice: restrict to passive methods (lower risk, lower coverage) or negotiate controlled active scanning windows during planned maintenance periods (higher coverage, scheduling complexity).

Patch cadence vs. stability. ICS vendors often require months or years to test and approve firmware updates. Published CVEs may remain unpatched not due to negligence but due to vendor qualification timelines, creating documented vulnerability windows. NIST SP 800-82 acknowledges this tension explicitly, and audit findings must account for compensating controls rather than flagging unpatched firmware as unmitigated risk in every instance.

Segmentation depth vs. operational integration. Deep Purdue-model segmentation reduces lateral movement risk but conflicts with operational demands for real-time data sharing between control and enterprise layers. The design tradeoff is captured in IEC 62443-3-3, which defines security levels (SL 1–4) against which segmentation architectures are assessed.

Auditor access vs. safety protocols. Physical access to OT environments involves safety training requirements—confined space, arc flash, lockout/tagout (LOTO)—that IT-background auditors may not hold. This limits the qualified auditor pool and increases coordination overhead for field-level assessments.

Common misconceptions

Misconception: Air-gapping eliminates the need for OT network audits.
Air-gapped networks still contain internal lateral movement paths, removable media ingress points, and misconfigured internal communications. The 2010 Stuxnet incident—documented extensively by the Idaho National Laboratory and others—demonstrated that air-gapped ICS environments are vulnerable to compromise through indirect vectors. Air-gap status reduces external exposure but does not eliminate audit necessity.

Misconception: Standard IT network audit tools apply to OT environments without modification.
Tools that send SYN packets or perform OS fingerprinting can cause denial-of-service conditions on legacy PLCs. Purpose-built OT passive monitoring platforms are required for discovery on live control networks. The network audit tools landscape for OT is distinct from the enterprise IT toolset.

Misconception: NERC CIP compliance equals comprehensive OT security.
NERC CIP applies specifically to bulk electric system assets and exempts distribution-level assets below certain thresholds. Compliance with NERC CIP standards does not guarantee coverage of all ICS assets in a utility environment, nor does it address OT security in non-electric sectors. The NERC CIP framework explicitly scopes "high," "medium," and "low" impact assets—and assets classified as "low impact" face significantly fewer mandatory controls (NERC CIP-002-5.1a).

Misconception: OT network audits and IT network audits can be run concurrently without coordination.
Simultaneous IT and OT audit activities—particularly penetration testing on the IT network—can trigger failsafes, alarms, or communications disruptions in adjacent OT systems. Joint change control approval is required before any audit activity in converged environments.

Checklist or steps (non-advisory)

The following sequence reflects the documented phases of an OT/ICS network audit as described in NIST SP 800-82 and IEC 62443-2-1.

1. Scope document executed — System boundary defined to enumerate all OT/ICS assets, zones, and interconnections in scope.
2. Safety briefing completed — Plant operations and safety officers have reviewed audit plan; "no-touch" asset list finalized.
3. Network topology diagram obtained or constructed — All Purdue model zone boundaries, DMZs, firewalls, data diodes, and remote access points documented.
4. Passive discovery deployed — Network taps or span ports established; traffic capture running on all OT zone boundaries.
5. Asset inventory compiled — All OT/ICS devices enumerated with firmware version, vendor, and protocol exposure.
6. Industrial protocol analysis performed — Unauthenticated command exposure, broadcast domains, and protocol-level anomalies recorded.
7. Firewall and ACL review completed — Rule sets on boundary devices reviewed against approved communication matrices; reference firewall rule audit standards for boundary device review.
8. Vulnerability correlation run — Identified assets cross-referenced against CISA ICS-CERT advisories and NVD OT-specific CVE feeds.
9. Remote access pathways documented — All vendor VPN, jump servers, and cellular modem connections inventoried and reviewed.
10. Findings classified by operational impact — Each finding rated by both CVSS score and operational consequence (safety, availability, regulatory).
11. Compensating controls documented — Where patches are unavailable, existing mitigations (segmentation, monitoring, access controls) recorded.
12. Report delivered to OT and IT stakeholders — Separate technical and executive summaries produced; remediation tracked per network audit findings remediation workflows.

Reference table or matrix

References

• CISA — Critical Infrastructure Sectors
• CISA ICS-CERT Advisories
• NIST SP 800-82 Rev. 2 — Guide to Industrial Control Systems (ICS) Security
• NIST National Vulnerability Database (NVD)
• NERC CIP Standards
• NERC CIP-002-5.1a Asset Identification
• FERC — Cybersecurity and Critical Infrastructure
• EPA — America's Water Infrastructure Act (AWIA)
• CISA Alert AA22-103A — APT Cyber Tools Targeting ICS
• NRC Regulatory Guide 5.71 — Cyber Security Programs for Nuclear Facilities
• ISA/IEC 62443 Standards Overview — ISA