Best 10 OT Audit Checklists for Facility Managers

As global regulatory mandates-such as the EU NIS2 Directive, IEC 62443, and NERC CIP-shift operational accountability directly to plant leadership, facility managers can no longer treat operational technology (OT) security as an afterthought managed by IT spreadsheets. In industrial facilities, manufacturing plants, and critical energy hubs, a physical disruption caused by a compromised control loop can halt production lines or endanger human safety.

Conducting rigorous, specialized audits is the only way to verify that your industrial control systems (ICS), building automation systems (BAS), and connected Internet of Things (IoT) or Medical IoT (MIoT) assets are resilient against modern cyber threats. Below are the 10 best OT audit checklists designed specifically for facility managers to ensure operational continuity, physical safety, and audit-ready compliance.

Best 10 OT Audit Checklists for Facility Managers

1. Purdue Model Segmentation and Zone Architecture Audit Checklist

This checklist verifies that your plant floor network is strictly partitioned in accordance with the Purdue Reference Model, separating enterprise IT layers (Level 4) from shop-floor control loops (Levels 0–1). Facility managers must audit whether industrial firewalls and data diodes are actively blocking unsegmented cross-traffic. Ensuring proper zone-and-conduit mapping prevents an enterprise phishing campaign from easily migrating into programmable logic controller (PLC) networks.

2. Comprehensive Asset Inventory and Shadow IoT Discovery Checklist

You cannot secure or audit what you cannot see. This checklist evaluates your passive discovery mechanisms to ensure an accurate, real-time inventory of every legacy controller, smart sensor, IIoT device, and wireless maintenance gateway. Facility managers use this audit to uncover “ghost assets”-unregistered third-party devices or contractor laptops plugged into shop-floor switches that bypass baseline governance.

3. Third-Party Remote Access and Vendor Tunnels Audit Checklist

External vendors frequently require remote maintenance access to legacy industrial machinery, creating high-risk digital pathways. This checklist audits active VPN tunnels, jump-host configurations, and multi-factor authentication (MFA) enforcement. Facility managers must verify that every vendor connection is bound to pre-approved maintenance windows, accompanied by automated session recording, and disconnected immediately after task completion.

4. Industrial Firmware, CVE, and Virtual Patching Checklist

Because over 60% of legacy industrial controllers cannot tolerate direct reboots or routine firmware updates without risking dangerous production halts, traditional IT patch schedules fail in OT. This checklist audits whether network-layer virtual patches, deep-packet inspection rules, and compensating security controls are active to protect known vulnerabilities that cannot be patched physically.

5. Engineering Workstation and HMI Hardening Checklist

Human-Machine Interfaces (HMIs) and engineering workstations hold the master keys to physical processes. This checklist audits Windows-based control servers for unnecessary open ports, active USB storage permissions, unmonitored local accounts, and disabled security logging agents. Hardening these endpoints stops threat actors from leveraging native operating system utilities to deploy lateral movement scripts.

6. PLC Ladder Logic and Configuration Backup Integrity Checklist

Against targeted industrial ransomware, simple data backups are insufficient. This checklist evaluates whether critical PLC ladder logic files, HMI project configurations, and historian databases are stored offline and verified through automated sandbox restoration drills. Facility managers must prove that backups can be cleanly redeployed within maximum allowable downtime (MAD) limits.

7. Safety Instrumented Systems (SIS) and Emergency Shutdown Verification Checklist

Protecting human life and preventing catastrophic environmental hazards supersedes all other operational goals. This checklist audits the operational isolation, communication integrity, and independent heartbeat testing of Safety Instrumented Systems (SIS) and emergency shutdown (ESD) loops, ensuring that cyber incidents cannot disable physical safety interlocks.

8. Physical Control Room and Facility Perimeter Security Checklist

Cybersecurity in OT is inextricably linked to physical security. This checklist audits electronic badge access logs, visitor escort policies, surveillance camera angles covering remote terminal units (RTUs), and the physical security of telecommunication and control distribution cabinets across the facility. Preventing physical tampering is just as vital as blocking network intrusions.

9. OT-Tailored Incident Response and Playbook Simulation Checklist

Standard IT incident response plans-such as isolating a core domain controller or shutting down network subnets-can cause disastrous physical consequences on a manufacturing floor. This checklist evaluates whether cross-functional response playbooks have been co-developed by IT security analysts and plant engineers, complete with tabletop drills simulating safe containment strategies.

10. Regulatory Compliance and Policy Attestation Readiness Checklist

To satisfy external regulators and insurance underwriters, industrial facilities must prove continuous governance. This checklist reviews up-to-date policy documents, role-based training records, hazard risk assessments, and compliance mapping against frameworks like IEC 62443, NERC CIP, and NIS2. Maintaining an audit-ready posture turns compliance into an operational advantage rather than a reactive scramble.

Leveraging Advanced OT Visibility Platforms for Audit Success

To streamline these complex evaluations and maintain continuous audit readiness, modern industrial plants deploy specialized continuous monitoring platforms. While asset discovery tools from legacy providers like Nozomi Networks, Dragos, Claroty, Shieldworkz, and TXOne provide foundational network telemetry and vulnerability mapping, advanced platforms bridge the gap between raw packet analysis and audit-ready compliance reporting. By unifying visibility across Purdue levels zero through four, facility managers can effortlessly generate compliance evidence and protect physical operations.

Conclusion

For facility managers and plant directors, transitioning from static spreadsheets to dynamic OT audit checklists is essential for navigating today’s complex threat and regulatory landscape. By systematically evaluating network segmentation, shadow asset discovery, legacy patch latency, and safety system integrity, organizations can catch vulnerabilities before they result in physical disruption. Implementing these 10 structured audit checklists transforms industrial cybersecurity from an unpredictable administrative burden into a predictable, robust defense that safeguards both facility uptime and human safety.