ZERODAY CYBERSECURITY
Home · Ongoing OT Services · Insights · Contact
Establish a useful starting position: a defined system review, supported findings and clear priorities. Decide what your team can own and what needs continuing support.
An OT Security Assessment reviews a defined operational environment against agreed security criteria. Zeroday examines available evidence with technical owners, identifies gaps and limitations, and connects priorities to recommended actions. You receive a documented boundary, evidence record and findings your team can review. The assessment supports a decision about the work needed next, including whether a separately scoped ongoing service would be useful.
Start when a customer requirement needs an answer, a system change raises security questions, an inherited environment lacks a clear baseline or leadership needs supported priorities. Name the process or system and the decision the review must inform.
A production line, cell, processing area, operational system or agreed group of systems. Identify included control-system components, supporting services, access arrangements and provider interfaces where relevant.
The scope defines the review criteria, evidence sources, participating owners and limitations. An inventory is an input; it does not automatically establish complete coverage.
The triggering requirement or question, broad system context, available documentation and existing findings. Identify the technical owner, applicable site constraints and providers whose records or knowledge are needed.
Missing documentation can be addressed explicitly. Agree whether the job covers available-evidence review or additional information gathering.
Assessment options include IEC 62443-3-3 gap assessments and reviews aligned with NIST CSF 2.0 and NIST SP 800-82 OT guidance. The applicable framework and depth belong in the scope; a framework name alone does not define the engagement.
Confirm the operational question, included systems, applicable criteria, evidence inputs and acceptance responsibilities.
Review available records with technical owners. Record supported observations, missing inputs, assumptions and questions requiring further work.
Explain gaps, operational relevance and recommended actions. Identify who needs to act, what remains uncertain and where another scope is required.
Site access, discovery, scanning, testing and live-system activity require explicit agreement and authorization. The assessment does not imply unrestricted access or permission to change production systems.
A documented scope and record of the review criteria.
An evidence record showing what was reviewed and where inputs were incomplete.
Findings linked to the included systems and requirements.
Priorities with operational context and known constraints.
Recommended actions, unresolved questions and a readout for responsible owners.
Acceptance should confirm that the agreed review was delivered and that conclusions are supported to the stated extent. It does not require pretending every gap is resolved. See the assessment acceptance criteria in the buyer guide.
This fictional example shows the reasoning, not a customer result. A customer asks a manufacturer for evidence of access governance around a named production system.
Boundary: the selected system and agreed supplier-access arrangement.
Available evidence: a provider record and a list of accounts.
Unknown: the evidence does not identify who approves access or how it is reviewed.
Clarify the applicable requirement and internal decision owner. Identify the evidence needed to address the gap and the person responsible for supplying it.
The review record distinguishes an observed documentation gap from an unverified claim about how the live system behaves.
At closeout, discuss which actions your team can manage internally and which need continuing coordination. Findings may inform a service backlog, responsibility map and proposed review cadence. Continuing service requires its own agreement; the assessment retains standalone value.
Ongoing OT Services for continuing priorities, coordination and evidence review.
Managed OT Vulnerability Management for recurring applicability, prioritization and treatment decisions.
OT Finding-to-Closure Support for an agreed group of existing findings.
Critical Process Recovery Readiness for one process's digital recovery arrangements.
First compare its boundary, criteria, evidence and limitations with the current decision and known changes. Existing findings may support direct ongoing-service or closure work. Additional review should address a defined uncertainty.
No. The engagement reports evidence, gaps and limitations within its agreed scope. It does not issue certification or implement every recommendation.
A sponsor sets the decision priority. System owners and providers contribute relevant records and technical knowledge. Authorized site teams retain control of live changes. Andres Torres leads the executive relationship; technical responsibilities follow the agreed scope.
Review Andres Torres's role and the primary references: NIST SP 800-82 Rev. 3 and IEC 62443-3-3.
Share a nonconfidential summary of the requirement, system or process, available evidence and decision timing. We will discuss the boundary, participants and useful outputs.
OT cybersecurity for manufacturing, industrial facilities and mining.
1755 E Plumb Lane, Suite 150
Reno, Nevada 89502
775-737-0329
Ongoing OT Services · Managed OT Vulnerability Management · OT Security Assessment · OT Finding-to-Closure Support · Critical Process Recovery Readiness
About Zeroday · Andres Torres · Buyer Guide · Insights
© 2026 Zeroday Cybersecurity