5.01Critical infrastructure

OT & ICS Security Assessment

Zone-and-conduit risk assessment of industrial control systems against IEC 62443, with remote-access and IT/OT segmentation review, mapped to the National Cybersecurity Law, MK 397 and the electricity Network Code on Cybersecurity.

Book a consultation+371 2256 5353

Most OT incidents in Europe in 2024–2026 did not need an exploit. Attackers used internet-exposed HMIs, VNC and VPN gateways without MFA, vendor remote access and flat networks between IT and OT. The assessment starts there: what is reachable, from where, by whom, and what a person with that access could change in the process.

We define the system under consideration, partition it into zones and conduits (IEC 62443-3-2), set a target security level per zone and measure what the controls actually achieve against IEC 62443-3-3. Discovery is passive – traffic capture and configuration review, never active scanning of controllers in production. The result is an asset inventory, a zone diagram and a gap register written in the language your engineers and your auditor both use.

Findings are mapped to the obligations that apply to you: NIS2 as transposed in the National Cybersecurity Law and the MK 397 minimum requirements, the CER Directive for designated critical entities and, for electricity operators, the Network Code on Cybersecurity (EU) 2024/1366. Two OffSeq specialists hold the NATO CCDCOE Critical Information Infrastructure Protection qualification and served on the Latvian–Singaporean team that placed first at Locked Shields 2026.

IEC 62443
zone-and-conduit method (3-2, 3-3, 2-1:2024)
NATO CCDCOE
two specialists qualified in Critical Information Infrastructure Protection
81%
of OT assessments find weak IT/OT segmentation
Source: Dragos OT Cybersecurity Year in Review 2026, opens in a new tab

Where we work in the Purdue model

Discovery is passive at every level of the industrial zone. The levels show where we look; the IEC 62443 zones and conduits drawn over them are what you defend.

  • Actively tested
  • Passive capture and configuration review
  • Spares, replica lab or bench only
  • Out of scope

Enterprise zone · IT

  1. 5

    Enterprise network

    Corporate IT, identity, email, cloud and internet access

    Actively tested

    Exposure check: which HMIs, VNC and VPN gateways the internet can reach.

  2. 4

    Site business systems

    ERP, scheduling, logistics and site IT

    Actively tested

    Reachability from the office network into OT, and the routes vendors use.

Industrial DMZ

  1. 3.5

    Industrial DMZ

    Jump hosts, remote-access gateways, patch servers, historian replicas

    Passive capture and configuration review

    Firewall rulesets, jump hosts and remote-access gateways reviewed as conduits.

Industrial zone · OT

  1. 3

    Site operations

    Historians, MES, OT domain controllers, engineering workstations

    Passive capture and configuration review

    Historians, OT domain and engineering workstations from traffic and configuration.

  2. 2

    Supervisory control

    SCADA servers, HMIs, alarm and operator stations

    Passive capture and configuration review

    SCADA and HMIs inventoried from captured traffic, never scanned.

  3. 1

    Basic control

    PLCs, RTUs and IEDs; safety systems sit in a zone of their own

    Passive capture and configuration review

    Controllers inventoried with vendor, model and firmware from passive capture.

  4. 0

    Physical process

    Sensors, actuators, drives and valves

    Out of scope

    Never touched; process consequences set each zone’s target security level.

How it works

  1. 01

    Scoping & safety plan

    Agree the system under consideration, site rules, change windows, escalation contacts and what is never touched.

  2. 02

    Passive discovery

    Capture traffic at switches and firewalls, review configurations and drawings, build the asset inventory.

  3. 03

    Zones & conduits

    Partition the system, set target security levels and document every conduit and its controls.

  4. 04

    Gap analysis

    Compare the achieved controls with the target level and with the regulation that applies to you.

  5. 05

    Reporting

    Zone diagram, gap register, remediation roadmap and an evidence pack for NIS2 or the Network Code.

Packages

Exposure Review
Fixed-price external exposure and remote-access review for one site or a municipal utility.
Site AssessmentPopular
Full zone-and-conduit assessment of one plant, substation group or treatment works.
Programme
Multi-site assessment with an IEC 62443-2-1 programme gap analysis and Network Code candidate readiness.

Supported by our own threat-intelligence platform

The exposure and vulnerability data we use during the assessment stays with you afterwards.

Frequently asked questions

No. Discovery is passive: we capture traffic at switches and firewalls and review configurations and drawings. Nothing is scanned or probed on controllers, HMIs or safety systems in production. Anything that needs active testing is agreed separately and done on spares or in our replica lab.

Helpful tools

What clients in your sector say

From organisations in the same sector.

Manufacturing
“Their structured methodology, clear communication, and actionable insights directly contributed to increased system reliability, scalability, and resilience.”

Oskars Podziņš

Head of Information Security · Printful

Manufacturing
“They found holes me and my IT team were astonished to hear about. They worked from the heart and in high quality.”

Andzejs Stenclavs

Kinetics

Manufacturing
“OffSeq ran a black-box audit that showed us exactly where we stood – no sugarcoating, just an honest picture from a real attacker’s perspective.”

Ivo Petrovskis

Network & Security Administrator · Livonia Print

All services

Scope a test

[email protected]+371 2256 5353

Direct access to a senior specialist · Reply within 24 hours · NDA available on request

Scope a testGet in touch