OT Cyber Baseline Action Plan (Post-Audit)

Purpose

This action plan template turns OT baseline audit findings into a concise, prioritized set of tasks plant teams can execute, verify, and track. It focuses on common exposure areas: network segmentation, asset hygiene, credentials, remote access, asset inventory, and basic monitoring.

Important safety note

Do not make live changes to control systems, networks, or devices without controlled change procedures, engineering approval, vendor coordination, and appropriate maintenance windows. This document is a remediation planning tool, not a step-by-step engineering script for immediate live changes.

How to use this template

1. Record each finding from the OT Cybersecurity Basics Audit as a separate action line.
2. Score risk using the Risk Scoring rubric below to produce a priority order.
3. Assign an owner, ETA, and verification method for each action.
4. Flag Quick Wins (low-effort, high-impact) for immediate scheduling.
5. Group related actions into short, medium, and long-term workstreams for scheduling and resource planning.

Risk scoring (recommended)

Use a simple likelihood × impact model to triage items quickly.

Action item template (copy this for each finding)

Recommended mitigations (common categories)

Use the following guidance as starting points. Tailor to your control-system vendor, architecture, and safety constraints.

Network segmentation

• Limit traffic between IT and OT using firewalls or managed gateways; enforce least privilege routes.
• Create separate VLANs for controllers, HMIs, engineering workstations, and business networks with strictly controlled cross-zone rules.
• Document and justify any existing flat or permissive rules; replace wildcard rules with explicit allow lists.

Asset hygiene and inventory

• Build or validate an authoritative asset inventory (device type, function, IP/MAC, physical location, firmware/version, owner).
• Remove or isolate unknown devices until validated.

Credentials and access control

• Ensure unique, non-shared operator and engineering accounts where possible; remove default passwords.
• Use role-based access and minimal privileges; audit privileged accounts regularly.

Remote access

• Replace ad-hoc remote connections (open RDP/VNC, port forwarded SSH) with approved remote access gateway/service that supports MFA, logging, and session recording.
• Restrict remote access to a small set of known IPs and accounts; enforce vendor access procedures and temporary access windows.

Patching & firmware management

• Record firmware/patch levels, prioritize critical updates for devices with known exploitable vulnerabilities, and test patches in a staging environment before production deployment.

Monitoring, logging & basic detection

• Enable and centralize logs where possible (firewall, gateway, OT gateway); create basic alerts for anomalous connections and unauthorized configuration changes.
• Implement periodic snapshot/config backups for critical controllers and devices.

Backup & resilience

• Ensure backups are available and tested; confirm recovery procedures and owner responsibilities.

Implementation schedule (recommended cadence)

• Immediate (0–14 days): Quick wins and high-risk short-term controls (temporary ACLs, remove unknown devices, enforce vendor remote access policy).
• Short term (2–12 weeks): Implement segmentation changes that don't require major downtime, set up central logging, fix credential hygiene.
• Medium term (3–12 months): Firmware rollouts, architecture changes, long-lived remote access solutions, monitoring platform upgrades.
• Long term (12+ months): Programmatic changes: asset lifecycle management, formal change control integration, OT security maturity projects.

Verification & evidence checklist

For each completed action, record at least one of the following as verification evidence:

• Configuration export showing the new firewall/ACL rule
• Screenshot of segmented topology and traffic flow test
• Log excerpts showing rejected unauthorized access attempts after mitigation
• Change ticket and test report showing patch applied and validated
• Updated asset inventory record and confirmation of device removal/isolation

Quick wins checklist (examples)

• Disable unused ports and services on HMIs and engineering workstations.
• Remove default accounts and change default passwords on devices still using them.
• Restrict remote vendor accounts to time-limited access and require documented approval.
• Isolate unknown or unmanaged devices to a quarantine VLAN until validated.

Escalation & stakeholder communication

Define who to contact for high-risk findings (security lead, plant manager, vendor engineer) and a clear escalation path for items that could cause immediate safety or major production impact.

Example filled action item (illustrative)

Next steps (team)

1. Import audit findings into this template, one line per finding.
2. Score and tag Quick Wins; schedule immediate remediation work in the next maintenance window.
3. Assign owners and set ETAs. Add blocking issues (approvals, vendor availability) to the notes field.
4. Collect verification evidence and close items only after acceptance criteria are met.

Appendix: Helpful artifacts to attach

• Network diagrams showing current and proposed segmentation
• Firewall rule exports and snapshots
• Device inventory CSV or spreadsheet extract
• Change tickets and maintenance window approvals
• Vendor service agreements and emergency contact details

Use this action plan as a living document: keep it updated during remediation sprints so leadership and engineering teams have a clear, auditable trail from findings to verified fixes.