Brilliant at the Basics: OT Top 10
- Home
- Brilliant at the Basics
- OT Top 10
All 10 OT practices, with first steps and evidence.
The 10 OT Practices, in Plain Language
The DoW CIO's Brilliant at the Basics campaign names 10 OT practices covering the production floor: PLCs, HMIs, drives, robot controllers and the networks that connect them. For each one below: what DoW asks, what it means for a small or mid-size defense supplier, what to do first, the evidence to keep, related NIST SP 800-171 requirements, and how Peripolos helps.
Not sure where you stand? Rate all 20 practices in five minutes with the free Basics Scorecard, or see the IT Top 10.
On this page
- OT-1 · Identity and Access Control
- OT-2 · Validated Asset Inventory
- OT-3 · Strict Network Segmentation
- OT-4 · OT-Specific Incident Response and Recovery Plan
- OT-5 · Manage Known Vulnerabilities
- OT-6 · Remote Access Pathways
- OT-7 · Continuous Monitoring
- OT-8 · System Resiliency
- OT-9 · Supply Chain Security
- OT-10 · Review Processes
Identity and Access Control
What DoW asks: Verify every user on OT systems, require MFA where it matters, and grant only the access each job needs.
Shared HMI logins and one engineering password for everyone are common on shop floors. Start with named accounts on engineering workstations and for remote access.
Start this week
- Replace shared engineering logins with named accounts
- Require MFA for remote and engineering access
- Remove accounts of people who have left
Evidence to keep
- OT account list with owners and MFA status
- Record of the last access review
Related NIST SP 800-171 Rev 2: 3.1.1, 3.1.5, 3.5.3
How Peripolos helps: Identity (IT Foundation), Vendor Gate (Shop Floor)
Validated Asset Inventory
What DoW asks: Keep an as-operated inventory of OT equipment, checked by passive monitoring and by walking the floor.
Spreadsheets drift. List every PLC, HMI, drive, robot controller and network device with its firmware, then confirm it on the floor and on the network.
Start this week
- Fill in the free OT asset worksheet
- Walk the floor and check model and firmware labels
- Add a passive sensor to catch what the walk missed
Evidence to keep
- Inventory with firmware versions
- Dated walk-down sign-off
Related NIST SP 800-171 Rev 2: 3.4.1
How Peripolos helps: Peripolos Sensor (Shop Floor)
Strict Network Segmentation
What DoW asks: Separate business IT from production systems so an attacker can't move from one to the other.
Ransomware that starts in email shouldn't be able to reach a PLC. Put a firewall between office and floor, allow only named connections, and deny the rest.
Start this week
- Map what talks to what between office and floor
- Put a firewall or DMZ between the two
- Allow only required flows and deny everything else
Evidence to keep
- IT/OT zone and conduit diagram
- Firewall rules with owners
Related NIST SP 800-171 Rev 2: 3.13.1, 3.13.6
How Peripolos helps: Cell Guard (Shop Floor)
OT-Specific Incident Response and Recovery Plan
What DoW asks: Have and rehearse an OT response plan that puts safety and uptime first, with recovery in phases.
An IT playbook that says wipe and reimage can stop a line or hurt someone. Write down who decides to isolate a cell, how to run manually, and the order machines come back.
Start this week
- Name who can stop or isolate production
- Keep offline copies of PLC logic and CNC programs
- Run a one-hour tabletop on a ransomware scenario
Evidence to keep
- OT incident playbook
- Tabletop after-action report
Related NIST SP 800-171 Rev 2: 3.6.1, 3.6.2, 3.6.3
How Peripolos helps: Recovery Drill (Shop Floor)
Manage Known Vulnerabilities
What DoW asks: When equipment can't be patched right away, put compensating controls in place until the next maintenance window.
You can't reboot a PLC mid-run. Know which machines carry known exploited flaws, wall them off with firewall rules or allowlisting, and patch at the next planned shutdown.
Start this week
- Run the free First Article Check on your OT worksheet
- Isolate any KEV match that can't be patched yet
- Schedule patches for the next maintenance window
Evidence to keep
- Compensating-control record with an expiry date
- Patch records
Related NIST SP 800-171 Rev 2: 3.11.2, 3.11.3, 3.14.1, 3.13.6
How Peripolos helps: Peripolos Sprint (Readiness), Hold Point (Shop Floor), Peripolos subscription (Assurance)
Remote Access Pathways
What DoW asks: Allow remote access only when needed, for the shortest time, with strong authentication and no always-on connections.
Machine builders often leave TeamViewer or a modem connected for support. Replace these with access you switch on per visit, protected by MFA and logged.
Start this week
- Find every remote tool and modem on the floor
- Disable always-on connections
- Route vendor access through one MFA-protected gateway
Evidence to keep
- Remote access inventory
- Session log for each vendor visit
Related NIST SP 800-171 Rev 2: 3.1.12, 3.1.13, 3.1.14, 3.1.15
How Peripolos helps: Vendor Gate (Shop Floor)
Continuous Monitoring
What DoW asks: Extend monitoring to the production floor and review the logs regularly.
Many shops watch email and laptops but not the floor network. A passive sensor shows new devices, unusual connections and changes to PLC programs.
Start this week
- Send OT firewall and server logs to your monitoring
- Add a passive sensor at the IT/OT boundary
- Set a weekly log review with a named owner
Evidence to keep
- Monitoring reports
- Alert review notes
Related NIST SP 800-171 Rev 2: 3.3.1, 3.14.6, 3.14.7
How Peripolos helps: Peripolos Sensor (Shop Floor), Watch (Assurance)
System Resiliency
What DoW asks: Design systems to fail safely, with redundancy, fault tolerance and local manual overrides.
If the network goes down, can the line keep running safely, or stop safely? Know which machines run standalone and keep spares for those that can't.
Start this week
- List machines that need the network to run
- Confirm local manual control works
- Keep spare controllers or images for critical cells
Evidence to keep
- Manual-mode or failover test notes
- Spares list
Related NIST SP 800-171 Rev 2: Mostly beyond NIST SP 800-171, which centers on confidentiality; NIST SP 800-82 is the reference
How Peripolos helps: Recovery Drill (Shop Floor), Recover (IT Foundation)
Supply Chain Security
What DoW asks: Hold suppliers to equivalent security standards, and replace hardware that can't be defended on a set schedule.
Integrators, machine builders and remote-support vendors all touch your floor. Put security terms in purchase orders and plan to replace controllers past support.
Start this week
- List vendors with access to your OT
- Add security requirements to new purchase orders
- Set replacement dates for unsupported controllers
Evidence to keep
- Supplier security terms
- Hardware end-of-support schedule
Related NIST SP 800-171 Rev 2: No supply chain family in Rev 2; Rev 3 adds 03.17.01 to 03.17.03
How Peripolos helps: Debt-Down (IT Foundation), Liaison (Assurance)
Review Processes
What DoW asks: Formally review significant changes so a security update doesn't create an unsafe condition.
A firmware update or firewall change on the floor deserves the same review as a process change. Test it, get sign-off, and keep a rollback plan.
Start this week
- Define what counts as a significant OT change
- Require testing, sign-off and a rollback plan
- Log every change with its approver
Evidence to keep
- Change records with approvals
- Rollback plans
Related NIST SP 800-171 Rev 2: 3.4.3, 3.4.4, 3.4.5
How Peripolos helps: Hold Point (Shop Floor)
Practice titles are the DoW CIO's own, from the Brilliant at the Basics page. Descriptions, first steps and NIST SP 800-171 mappings are VIS's analysis; DoW has not published an official mapping. Brilliant at the Basics is a campaign, not a certification. Readiness and internal-audit support, not certification or third-party attestation; DoW does not endorse VIS.
Want help with any of these?
Book a free consultation and we'll pick the three practices that matter most for your shop.