“We have a long list of findings and no clear order to fix them in.”
Assessments often produce more findings than a team can address at once. Risk-based prioritization considers asset criticality, potential operational impact, existing controls and realistic treatment options.
Engineering time and outage windows are scarce.
Leaders need to understand what is being accepted and why.
Some fixes are easy while running; others need a shutdown.
Documented rationale shows that decisions were considered.
A sequence that can be adapted to your environment and scope.
Connect each finding to the assets and zones it affects.
Consider criticality and potential consequences.
Account for safeguards already in place.
Apply agreed likelihood and impact criteria.
Order actions by risk, effort and outage dependency.
An assessment produces sixty findings. Linking them to assets shows that a handful affect the zone controlling the most critical process and lack any compensating safeguard. Those move to the top; several others are grouped into one segmentation change scheduled for the next planned stop.
CVSS describes a vulnerability in general. It does not know how critical your asset is, whether it is reachable or what safeguards surround it. OT prioritization needs that context.
From the blog
Regulation7 min
National NIS2 laws are now being enforced. Here is what energy, water, transport and manufacturing operators should be able to show for their OT environments.
Read the article
Regulation6 min
Manufacturers must now report actively exploited vulnerabilities and severe incidents. Asset owners should expect more advisories, and suppliers need a working process.
Read the article
Architecture8 min
Segmentation diagrams often look perfect and behave very differently. A practical method for zones and conduits that match how your site really works.
Read the articleDescribe where you are today and we'll suggest a practical way forward.