Custom OT Security Assessment
Describe your environment in six quick steps: industry, requirements, sites, systems, zone condition and site characteristics. OTVista builds a questionnaire for that profile and maps your answers to the frameworks you selected.
- Sheet
- Free tool
- Profile steps
- 6
- Question bank
- 50
- Frameworks
- 12
- Data sent to OTVista
- None
Before you start
- Answer for one organisation or programme scope. Sites can be grouped.
- Choose "Don't know" rather than guessing. Unknowns are reported separately.
- Runs in your browser. Nothing you enter is sent to OTVista or stored.
- Results are indicative and not an assessment, audit or certification.
How it works
Profile your environment
Industry, region and requirements, number of sites, approximate number of systems, zone condition and site characteristics.
Get a tailored questionnaire
Questions are selected and weighted from a bank of 50 across 10 control areas.
See framework-mapped results
Area scores, coverage per selected framework, unknowns, top priorities and a suggested starting engagement.
- 1Industry
- 2Requirements
- 3Sites
- 4Systems
- 5Zones
- 6Characteristics
About the Custom Assessment
How is this different from the Quick Check?
The Quick Check asks everyone the same 24 statements. The Custom Assessment first builds a profile of your environment, then selects and weights questions for it. For example, it asks about SIS zoning only if you have safety systems, adds NERC CIP or NIS2 references only if you select them, and adds multi-site questions only for multi-site organisations.
Is this a compliance assessment?
No. It is an indicative initial self-assessment. The framework references are topic-level pointers to help you navigate requirements; they do not reproduce the standards and the results do not show compliance. A professional assessment verifies controls with evidence.
Which frameworks are supported?
IEC 62443, NIST CSF 2.0, NIST SP 800-82r3, NIS2, the Cyber Resilience Act (for product makers), UK NIS and the NCSC CAF, NERC CIP, TSA Security Directives, AWIA for US water systems, Saudi NCA OTCC and ECC, and the UAE Information Assurance Regulation. Suggestions are based on your region and industry, and you can change them.
What happens to my answers?
Nothing leaves your browser. Results disappear when you close or reload the page. You can print or save the results as a PDF, and if you want to discuss them, you choose what to share in the contact form.
How long does it take?
Most profiles produce between 25 and 40 questions, which takes about 10 to 20 minutes.
Turn this profile into a verified assessment
An OTVista assessment confirms controls with evidence and produces a prioritised roadmap, with results tracked in the OTVista Platform.