Is the company familiar with the concept and principles of OT Cybersecurity?

Are the differences between IT and OT environments understood in your company?

Is OT Cybersecurity embedded into your company’s culture, vision and values?

Does the company know the potential consequences of OT security breaches, including impacts on safety, production, and the environment?

Has your company experienced any OT Cybersecurity incidents in the past 12 months?

Does your company believe that the security of OT systems is a critical component in of the overall security of the company?

Is OT Cybersecurity taken into consideration when deciding/planning changes to the OT environment of the company?

Has your company evaluated the potential social and economic impacts of an OT incident?

Does your company allocate budget/invest in policies and measures for OT Cybersecurity?

Has your company faced any challenges in implementing OT cybersecurity policies/measures?

Does your company have a documented cybersecurity risk management process that is tailored to the specific needs of your industry and the types of cybersecurity threats that you are most likely to face?

Does your company regularly conduct risk assessments to identify and prioritize cybersecurity risks to your industrial operations?

Does your company have a plan in place to mitigate cybersecurity risks?

Does your company have a plan in place to respond to cybersecurity incidents that may impact your industrial operations?

Does your company regularly test its cybersecurity incident response plan to ensure that it is effective?

Does your company have an understanding of Industrial Protocols?

Does your company use the OSI Model for Industrial Communications?

Does your company use network segmentation to protect its industrial networks?

Does your company regularly monitors its industrial networks for suspicious activity?

Does your company regularly test its cybersecurity controls for industrial networks?

Does your company use anti-virus and firewall software?

Does your company use DNS-Filtering?

Does your company use any open-source tools to enhance its cybersecurity posture?

Does your company any use paid tools to enhance its cybersecurity posture?

Does your company have configured firewall rules and policies to restrict or permit traffic?

Does your company have someone knowledgeable and skilled assigned in network security?

Does your company provide training on how to handle security incidents?

Has your company implemented basic security measures like strong passwords, access controls, and network segmentation in your work environment?

Has your company implemented encryption practices for sensitive data within your organization, such as encrypting emails or data at rest?

Has your company conducted network traffic analysis to detect anomalies or suspicious activities on your network?

Does your company practice defending against domain attacks?

Does your company conduct network penetration tests?

Does your company practice identifying and exploiting vulnerabilities?

Does your company identify common web application vulnerabilities and their potential impact?

Does your company collect information to assess security risks and vulnerabilities?

Are company employees trained on what constitutes a cybersecurity breach?

Does the company stay informed on current cybersecurity threats and tools used by malicious actors?

Does your company employ threat modeling as part of its cybersecurity strategy?

Does your company have strategies in place to prevent data leaks and breaches?

Does your company have a documented process for identifying and assessing supply chain risks?

Does your company have a documented business continuity plan?

Does your company regularly conduct business impact analyses to identify and prioritize critical business processes?

Does your company have a documented disaster recovery plan?

Does your company evaluate the business continuity capabilities of its suppliers?

Does your company regularly test its business continuity and disaster recovery plans?