Clear ownership for the systems your facility depends on.
An inherited system. A supplier with remote access. An audit finding nobody has closed. A recovery plan that depends on another team.
Zeroday helps industrial facilities define the issue, review the evidence and coordinate the work your decision requires. Connect operational priorities with the people responsible for the systems.
Select a situation, then a participant. See how the operational question connects to ownership, evidence and a decision.
Illustrative scope map
Supplier remote accessAgreed system boundary
One operational question. Connected responsibilities.
Owner to identify
IT/OT owner
Clarify who governs the supplier’s access to the agreed environment and who reviews the supporting evidence.
Evidence to review
Current access inventory and named approval responsibilities.
Records of agreed access reviews and unresolved exceptions.
Decision supported
Who owns the access decision, and what evidence is still needed?
Read all scoping examples
Compare the ownership, evidence and decision in all three illustrative situations. These examples describe possible responsibilities; your engagement defines the actual scope and authorized owners.
Supplier remote access
Operations & site leadership
Identify the operational need for supplier access and the decision requiring an authorized site owner.
Evidence to review
The service or process the supplier supports.
Named internal approver and the operational constraints to consider.
IT/OT owner
Clarify who governs the supplier’s access to the agreed environment and who reviews the supporting evidence.
Evidence to review
Current access inventory and named approval responsibilities.
Records of agreed access reviews and unresolved exceptions.
Controls & maintenance
Explain which equipment or operational functions require provider support and where access responsibilities intersect.
Evidence to review
Equipment and support dependencies within the agreed scope.
Known constraints and the technical owners needed for review.
Supplier / integrator
Explain the support requirement and provide records within the provider’s responsibility.
Evidence to review
The purpose and agreed scope of supplier access.
Provider responsibilities and available access-support records.
Decision supported
Who owns the access decision, and what evidence is still needed?
Operational system handover
Operations & site leadership
Define what the handover must support and who will accept the remaining responsibilities.
Evidence to review
The operational boundary and decision date, if known.
Named receiving owner and open business decisions.
IT/OT owner
Review the system responsibilities and supporting services the receiving team needs to understand.
Evidence to review
Included systems, interfaces and responsibility records.
Access ownership, documentation gaps and shared-service dependencies.
Controls & maintenance
Identify the operational knowledge and equipment-specific materials that the receiving team depends on.
Evidence to review
Available configuration, version and maintenance records.
Outstanding technical questions and provider dependencies.
Supplier / integrator
Make the handover evidence, retained responsibilities and outstanding items clear to the receiving team.
Evidence to review
Available handover materials and their owners.
Open items, support boundaries and responsibilities after transition.
Decision supported
What can be handed over with evidence, and which gaps still need an owner?
Critical process recovery
Operations & site leadership
Define the critical process and the operational outcome the recovery review needs to support.
Evidence to review
The process boundary and required digital functions.
Site owners responsible for readiness and return-to-service decisions.
IT/OT owner
Review the supporting digital services, access and materials the process depends on.
Evidence to review
Recovery materials, access needs and named owners.
Dependencies on shared systems and known evidence gaps.
Controls & maintenance
Contribute process knowledge and the prerequisites that equipment-specific recovery work depends on.
Evidence to review
Available configurations, versions, tools and owner-approved procedures.
Dependencies and untested steps requiring further review.
Supplier / integrator
Clarify specialist support, materials and provider involvement needed within the agreed recovery scope.
Evidence to review
Provider support responsibilities and material availability.
Requirements for any separately scoped, authorized exercise.
Decision supported
What is ready, what remains untested and who owns the next action?
Illustrative responsibilities only. Your scope establishes the actual owners, evidence requirements and authorizations. This is not an assessment of your facility.
Cybersecurity across operational systems
What is OT cybersecurity for industrial facilities?
OT cybersecurity for industrial facilities addresses security risks in the systems that monitor or control equipment and processes, including their supporting digital services. It connects security requirements with operational constraints, system ownership and recovery needs. Zeroday offers three ways to scope that work: an OT Security Assessment reviews available evidence and gaps; OT Finding-to-Closure Support connects agreed findings to actions, owners and evidence; and Critical Process Recovery Readiness reviews one process's digital dependencies, recovery materials and responsibilities.
Start with the operational issue, then define the engagement. Industrial facilities depend on equipment, operational applications and supporting services owned by different teams. Start with a named system or process and a question that matters to the operation.
Ownership is unclear
Several providers support the environment, but approval, access review or evidence responsibilities remain unresolved. Establish who owns the decision and what evidence is needed.
A system or supplier has changed
An acquisition, equipment handover or vendor transition leaves uncertainty about dependencies, available records or ongoing responsibilities. Define the affected boundary and the gaps that need attention.
Findings remain open
The report exists, but actions depend on internal teams, integrators or suppliers. Turn agreed findings into work packages with accountable owners and a usable status record.
Recovery depends on assumptions
One process needs materials, access and supporting services to recover. Separate documented readiness from dependencies and conditions that still need checking.
Three scoped engagements
Buy the work your team needs to move forward.
Each engagement can stand alone. Start with the unresolved decision; the proposed scope identifies what is included, what your team supplies and how the outputs will be reviewed.
We need a clearer picture
OT Security Assessment
Understand the evidence, gaps and priorities within an agreed environment.
Buy this when you need a clearer picture of a named operational environment, an inherited system or a requirement that current evidence does not answer.
Agreed scope
The systems, interfaces, applicable requirements and available evidence included in the review. Identify the internal owner and the providers whose input is needed.
Useful starting input
The reason for the review, broad system context, existing assessment material if available and the people responsible for the environment.
What your team receives
A record of the agreed boundary and evidence reviewed.
Prioritized gaps, operational relevance and evidence limitations.
Recommended actions for responsible teams and providers.
A leadership readout of priorities, unknowns and remaining decisions.
Decision supported: Which gaps should receive attention first, and what work should follow?
Scope boundary: An assessment evaluates gaps within the agreed scope. It does not itself implement every recommendation or certify compliance.
Use the evidence already available
When should we reuse an OT assessment instead of commissioning another?
An existing report is useful when its system boundary, review criteria, evidence and limitations are clear and relevant to the current decision. Compare the environment it covered with the systems, suppliers and responsibilities in place today. Record changes and unanswered questions before deciding what additional review is necessary.
Where findings are already established, the next purchase may be OT Finding-to-Closure Support: agreed actions, implementation owners, dependencies and evidence for review. Where the report leaves a material scope or evidence question unanswered, define a targeted OT Security Assessment around that gap. An old report alone does not establish the present condition of the environment.
The decision to make: what can the existing evidence support, what requires another review, and what is ready to move into an owned work package?
02 / Move agreed findings forward
OT Finding-to-Closure Support
Buy this when a defined group of findings remains open because ownership, dependencies or evidence requirements are unclear.
Agreed scope
The findings to address, responsible owners, supporting providers and evidence needed to review progress. Consider site constraints and maintenance windows when agreeing actions.
Useful starting input
The finding source, why the issue remains open, current ownership and known dependencies on another team or supplier.
What your team receives
Work packages connecting agreed findings to actions and owners.
Evidence requirements and dependencies for the work.
Follow-through across participating teams and providers.
A record of completed actions, outstanding items and decisions requiring an authorized owner.
Decision supported: What is supported by evidence, what remains unresolved and who owns the next step?
Scope boundary: Zeroday coordinates and reviews agreed work. Authorized site teams and technical providers control live-system changes. A completed action is not automatically a closed finding; evidence and review criteria matter.
03 / Clarify recovery readiness
Critical Process Recovery Readiness
Buy this when an important operational process depends on systems or services whose recovery arrangements are unclear, incomplete or changing.
Agreed scope
One process, its required digital functions and included dependencies. Identify the teams responsible for equipment, operational applications, access and supporting services.
Useful starting input
The process that matters, the recovery question, relevant handover or transition plans and the technical owners involved.
What your team receives
A process and dependency boundary.
A register of recovery materials, access needs and responsibilities.
An ordered recovery workpack and readiness-gap record.
A distinction between reviewed evidence, demonstrated conditions where scoped, and untested steps.
Decision supported: What is ready, which assumptions remain and what work is needed next?
Scope boundary: Restoration exercises require a separately agreed scope and site authorization. A readiness review does not guarantee recovery or authorize equipment to return to service.
The buying committee
Give each participant a clear role.
Site and operations leadership
Identify the process or service that matters, the consequence of uncertainty and the business decision the engagement must support.
IT/OT and controls owners
Explain the environment, evidence availability, access constraints and provider dependencies. Identify who can review technical findings.
Maintenance, integrators and suppliers
Contribute system knowledge and records within your responsibilities. Clarify handover gaps and who is authorized to perform agreed work.
Executive sponsor and procurement
Confirm scope, deliverables, responsibilities and review criteria. Keep additional implementation or specialist work visible as a separate scoping decision.
What happens next
Agree the job before work begins.
01 / Clarify
Define the issue
Discuss operational context, the decision needed and the people involved. Identify which engagement fits.
02 / Scope
Agree the work
Define included systems, deliverables, evidence, responsibilities and review criteria. Address access, site constraints and dependencies. Use the buyer guide's acceptance criteria for each OT engagement to make the review concrete.
03 / Review
Record the outcome
Review evidence and agreed actions with responsible owners. Record outputs, limitations, unresolved items and remaining decisions.
Engagement leadership:Andres Torres, Founder and Executive Lead, Industrial Cybersecurity, leads Zeroday Cyber's executive relationship and program direction. Technical review and specialist work are assigned according to the agreed scope and qualifications required for your environment.
Buyer questions
Questions before commissioning the work.
Can you work with our existing integrator and IT provider?
Yes. Zeroday works alongside your operations team and existing providers. The scope identifies the input, decisions and implementation responsibilities required from each participant.
What if we do not know which engagement we need?
Start with the issue and decision. Uncertainty about evidence may point to an assessment; known findings may need follow-through; a process recovery question may need a readiness review.
Does this include monitoring or emergency response?
These engagements cover assessment, finding coordination and recovery readiness. Monitoring, emergency response, engineering projects and major implementations are not implied by these scopes.
Before we talk
A useful first message starts with the decision.
Share a short, nonconfidential description of:
The facility type and system or process needing attention.
What triggered the request: an assessment, open finding, supplier change or recovery question.
The decision your team needs to make and any relevant target date.
The internal owner and kinds of providers already involved.
Whether an existing report, finding list or recovery plan is available.
Keep passwords, network diagrams, equipment configurations and confidential operational records out of the public form. Evidence and access arrangements can be agreed after the scope is understood.
Bring the unresolved issue. Define the work together.
Tell us what needs attention, who is involved and the decision your facility needs to make. We will determine whether a focused engagement makes sense.