OT monitoring, change control, response and recovery
Build credible operational visibility
An asset inventory should identify the actual devices, versions, functions, owners and communication relationships needed for security decisions. Keep it current as equipment and service arrangements change. Passive observation can reduce some disruption risks associated with probing sensitive devices, but coverage and configuration still matter. Silence in a traffic capture does not prove that no offline, dormant or unobserved asset exists. Correlate network evidence with approved drawings, maintenance records and competent physical or operational knowledge.
Manage vulnerabilities with process context
A vulnerability score is one input to a decision, not a complete assessment of physical consequences, exposure, dependencies and feasible mitigation. Patching may need vendor validation, representative testing, a suitable window and a verified recovery plan. Compensating segmentation, access restrictions and monitoring can reduce exposure where a patch cannot yet be deployed. They do not automatically remove the underlying defect. Do not run an unfamiliar active scanner or exploit against production because it was harmless in an office network.
Control access and change
Use appropriate identities, least privilege, authorization and records for engineering changes and remote maintenance. Time limits, monitoring and bounded access can reduce vendor-session exposure, but MFA alone does not authorize every command. Protect controller logic, configurations, recipes and required system images as relevant operational assets. Distinguish an approved change from a technically successful login. Physical access, removable media and supply-chain arrangements also deserve controlled evidence rather than relying solely on a perimeter firewall.
Respond and restore safely
An incident response must coordinate cyber evidence, ongoing process conditions and possible physical consequences. Immediate indiscriminate shutdown or isolation is not a universal safe answer. Use the actual emergency and incident arrangements with competent operational input. Preserve appropriate evidence without delaying necessary protection of people. Recovery needs known suitable backups, configuration and logic integrity, dependencies, authorized testing and confirmation of safe operation. A file copy completing successfully does not prove the plant can recover. Discussion exercises and controlled representative testing can expose gaps, but this bank does not scan, interrupt or restore any real industrial system and does not certify current regulatory compliance.