botminds.aiRequest a demo
SystemHSE, Process Safety & OT Security

OT Cybersecurity Compliance

OT cybersecurity compliance on one zone drawing: each control proved once, cited to its record, and tested against the access log whenever a new export lands.

See the demoBook a demo
Follow the vendor test from 06:12 to 09:52 ↓
The problem

OT cybersecurity compliance, proved again for each rule set at each site

A firewall rule review, an account list and a vendor contract get proved once for the industrial security standard, again for the pipeline rule, again for the information security standard and again for the company's own. Each site keeps its own spreadsheet of mappings, and few of them carry a reason.

Vendor remote access is approved by ticket and checked on a quarterly sample. A service account switched on the morning after that sample closes can stay enabled until the next one, while the proof on file says the control holds. New devices reach the network before the zone drawing, and evidence passes its refresh date unnoticed.

Built forOT security leadsCompliance managersControl systems engineersVendor access coordinatorsInternal auditors

The Problem Today

Each site proves the same control again for every rule set, and a quarterly sample sees only the sessions it picks.

270
proofs if each control is proved per rule set, at four sites our estimate

Proved by hand today

  • Firewalls
  • Accounts
  • Contracts
  • Drawings
  • Contracts never meet logsNobody reads a vendor clause against the gateway
  • Drawings drift from plantsNew devices connect before they reach the drawing

The Solution

  1. Each rule, line by lineYour own copies of each rule set and your own standard, split into lines
  2. Prove once, answer allOne cited proof answers each requirement it meets, at each site it fits
  3. Policy tested on practiceA contract's words tested on each record in the export
  4. Gap goes to its ownerRaised to a named owner on a clock, countersigned, held until closed

Built-in controls

  • Reads exported records; no link to the control network
  • Gaps, lots and packs need a second signer
  • Each answer cites the record it rests on

What You Get

Security leads see where each control breaks, and auditors follow each answer to its record.

88
proofs answer the same lines, each control proved once per site our estimate
  • Audit packs by siteEach gap listed beside its owner and due date
  • Stale proof caughtEach late proof listed, with its renewal asked
  • Vendor access heldA broken proof holds the vendor's next session
The gas plant, 06:12 to 09:52

A morning of OT cybersecurity compliance at the gas plant, 06:12 to 09:52

A gas plant, a refinery, an offshore field and a pipeline control center answer four rule sets. One morning, a test on the fresh gateway export breaks a proof last quarter's sample passed.

demoThe sites, the people, the vendors and the figures are sample data.

  1. 0106:12

    Four written rules hold on the morning export, and recordings fall short

    Practice tester

    The gateway, directory and firewall exports land before the shift, and each written rule is tested on each record they hold. Four pass, including an owner and a reason on 312 of 312 boundary rules and multi-factor on 1,486 remote sign-ins. Recordings are kept 90 days against a 12-month rule, already a gap. The vendor test has not run on this export.

  2. 0209:40

    One boundary rule review answers 23 lines across four rule sets

    OT security lead

    At the pipeline control center she picks the boundary rule review on the OT DMZ. One proof, the signed firewall rule review with its change record, answers 23 requirement lines across four rule sets. At the other three sites the same control answers 18 across three, because the pipeline rule is assessed only at the control center. There, 125 of 192 lines held have current proof.

  3. 0309:41

    Vendor access is still proved by last quarter's sample of 10 sessions

    OT security lead

    Back at the gas plant, vendor access by approved session sits on machinery monitoring, the zone the compressor vendor reaches through its conduit. Its proof is the third-quarter sample: 10 of 38 sessions, all approved, read up to the day before a new service account was switched on. That proof answers 11 lines here across three rule sets; the panel offers a practice test.

  4. 0409:42

    Enabled 41 days, and 9 of 14 sessions with no approval behind them

    Practice tester

    It reads clause 14.3 of the contract and the company standard, then all 61 accounts, 11 of them vendor, and each session. The compressor vendor's service account was enabled and never disabled: 41 days. Five sessions match an approval; nine match none. The test breaks 7 of the proof's 11 lines and leaves 4 standing, so answered lines at the plant drop from 66 to 59 of 160.

  5. 0509:46

    The contract clause beside the export lines, and the tester's stated doubt

    OT security lead

    The finding puts the contract wording next to the gateway lines: each session, its length, and its approval record or a blank. The tester says the account state is read straight from a field, that it is 90% sure on approvals, and that approvals given outside the approval system are invisible to it. She raises the gap as High, on a 14-day clock, owned by the vendor access coordinator.

  6. 0609:48

    Countersign stays greyed out until the clause and the log are both opened

    Compliance manager

    He did not raise the gap, so the countersignature falls to him. The panel tracks what he has opened: the signed contract at clause 14.3 first, then the export lines for the vendor's account. Only then can he sign. A send-back would carry a reason that resets severity or owner. He reads both and countersigns at 09:52.

  7. 07After 09:52

    The anti-surge tuning request for the compressor is held at the gate

    Vendor access coordinator

    On the vendor access screen the compressor vendor's account now reads enabled 41 days, outside any session. Its next request, controller tuning during Train 3 commissioning, shows Held with the gap named, and Approve is greyed out. A metering vendor's request waits too: its contract carries no OT clause.

  8. 08Same morning

    Nine sessions to explain with the vendor, each one on its own line

    Vendor access coordinator

    His own list opens on the review: the 9 sessions with no approval record, to be explained with the vendor one line at a time. A session nobody can explain keeps the gap open. Below sit three session requests and two gaps he owns: a contract with no OT clause, 5 days late, and an induction that leaves out the OT rules.

  9. 09Any time after

    Run, break, raise, two opens and a countersign, minute by minute

    Internal auditor

    Each act by a person or an agent is listed, newest first: the test started at 09:42, the break at 09:45, the raise at 09:46, the clause opened at 09:48, the export lines at 09:51, the countersignature at 09:52. No entry can be changed afterwards. The auditor reads and exports it and acts on nothing.

270 proofs rule set by rule set, or 88 when each control is proved once

Counted from the sample: 22 controls on the zone drawings, each with a proof record at each site.

Gas plant, one proof per control per rule set62
Refinery, the same way62
Offshore field, the same way62
Pipeline control center, where the pipeline rule adds its own84
Proofs, rule set by rule set, across four sites270
Proofs when each control is proved once at each site22 controls on the drawings x 4 sites88

estimatedOur estimate.

Seven lines move at the gas plant, and the four that still hold stay answered

The test breaks only the lines it tested; stale and waiting lines stand as they were.

Requirement lines held at the gas plantBefore the testAfter the test
Answered with current proof6659
With no current proof3037
On stale proof2828
Waiting for a check of rev 43636
All lines held here160160

demoSample data, from the working solution.

Around the zone drawing

Gap clocks, stale proof, a mapping lot and the drawing against the asset list

More of the team's week on the same four sites.

Gaps on a clock22 open gaps, 3 past their date, each on a clock: High 14 days, Medium 45, Low 90. Late ones go to the security lead to decide.
Proof past its date19 proofs past their refresh interval, each with its site, how late it is, the lines it carries and its owner. One button asks every owner for renewal.
A mapping lot, sampled36 changed lines of the company standard, each with a proposed control and the agent's confidence. Lines under 80% are always sampled; the rest at random.
Devices missing from the drawingThe asset export zone by zone beside the drawing. 18 Train 3 devices are not on it; the agent proposes a zone for each, and the site engineer places them.
Clocks and sample sizesGap clocks, the lot sample and the pack sample. One person proposes a change and another approves it; an open lot or pack keeps its rule.
The same tests at the refineryVendor accounts hold there. Event logs from one unit's control servers stopped arriving, already a gap, and 2,214 remote sign-ins all used multi-factor.

demoSample data, from the working solution.

What the quarterly sample and the mapping spreadsheet let through

Each one sat in records the team already exported.

A vendor account that opened the morning after the sample closed

The last sample read 10 of 38 sessions, all approved. The full test found the account enabled 41 days, with 9 of its 14 sessions unapproved.

A recording rule the gateway does not meet

The company standard asks for 12 months of session recordings. The gateway settings export shows 90 days.

Devices on the network that the drawing never shows

18 Train 3 devices appear in the asset export and on no zone. A zone is proposed for each, with the unsure ones flagged.

Proof that quietly went out of date

19 proofs passed their refresh date, carrying 94 lines. Those lines read stale until a newer record arrives.

demoSample data, from the working solution.

Who raises a gap, who countersigns it, and who only reads

The raiser never countersigns, and the auditor holds no button.

OT security lead
Sees
The zone drawing, test results, gaps and stale proof
Signs
Raises gaps, re-maps lines sent back, prepares site packs
Compliance manager
Sees
The clause and the export lines behind each gap, the sampled mapping lines
Signs
Countersigns gaps or returns them with a reason, closes them, signs lots and packs, approves settings
Site control systems engineer
Sees
Devices by zone, and gaps in her own systems
Signs
Places new devices on the drawing, confirms vendor work windows
Vendor access coordinator
Sees
Vendors, contracts, accounts and session requests
Signs
Approves vendor sessions, explains past sessions, owns vendor gaps
Internal auditor
Sees
Every screen, without a single action open to her
Signs
Nothing; downloads the pack file and the audit trail
Who does the reading

Seven agents behind the OT controls, and the line each one stops at

They split, propose, collect, test, watch and assemble. People decide.

Rule reader

Splits each loaded rule set into requirement lines with their references.

  • Never quotes licensed text outside your own space
  • Never invents a reference
Crosswalk mapper

Proposes the control that answers each line, with a reason and how sure it is.

  • Never signs a mapping; a person checks the lot on a sample
Evidence collector

Builds each control's proof from exports and signed records, citing the line each statement rests on.

  • Never connects to the control network
Practice tester

Tests a contract or written rule on every record of an export.

  • Never closes a finding
  • States what it cannot see
Freshness watcher

Tracks each proof's age against its interval and drafts renewal requests.

  • Never extends a date
Drawing keeper

Matches exported devices to zones and proposes a zone for each new one.

  • Never changes the drawing; the site engineer places devices
Pack builder

Assembles each site's pack by rule set, with every gap and its owner.

  • Never hides a gap
  • Never claims a line it does not hold, and never signs

What OT security leads ask about OT cybersecurity compliance

What is OT cybersecurity compliance software?

OT cybersecurity compliance software keeps the evidence that your control systems meet each security rule set you answer to. This one splits each loaded rule set into lines, ties each line to the control and cited proof that answers it at each site, and tests written rules against exported records.

Does it connect to the control network?

No. It reads exported records and signed documents: firewall, gateway, directory and asset exports, training records, contracts and drawings. It cannot change a device, an account or a rule. When an account must be disabled, the site engineer does it in the gateway, and the next export proves it.

Which rule sets can it map?

The ones you load from your own licensed copies: the industrial security standard, a pipeline control rule where it applies, an information security standard as you apply it to OT, and your company standard. Each mapping is proposed with a reason and checked by a person on a sample before it counts.

How is OT vendor remote access tested?

The practice tester reads the vendor contract and your standard, then every account and session in the gateway export, and matches each session to an approval record. It reports which lines break and which still hold, says what it cannot see, and leaves the gap to the OT security lead.

What happens when the zones and conduits drawing falls behind the plant?

The asset export is compared with the drawing, zone by zone, and devices on the network but missing from the drawing are listed, each with a proposed zone. The site engineer places them.

What does the OT security audit pack hold?

One pack per site, by rule set, covering the lines held there, each with its proof or its gap and the gap's owner. The OT security lead prepares it, the compliance manager opens a fixed sample of answers before signing, and the auditor downloads the file and the trail.

HSE, Process Safety & OT Security

More for the HSE, process safety and OT security teams

All 10 solutions →
Management of Change

See what a change reaches before anyone answers a checklist.

1-min demoPre-Startup Safety Review

Every tick tested against its record, and only named people say go.

1-min demoMajor Accident Hazard Reporting

Sentences with owners, and numbers open to the records behind them.

1-min demo

Bring one vendor contract
and last month's gateway export.

We'll test the contract's words against every session in the export, and show which of your proofs still hold.

Book a demoBrowse solutions