SCADA_Cybersecurity_Checklist.xlsx

SCADA CYBERSECURITY AUDIT CHECKLIST

Standards: IEC 62443 | NIST SP 800-82 Rev.3 | NERC CIP v7

Facility / Site: ___________________________

Auditor: ___________________________

Audit Date: ___________________________

Control Area

Control Requirement

Standard Ref.

Requirement Level

Status

Evidence / Notes

Owner

Target Date

1. ASSET INVENTORY & IDENTIFICATION

1.1

Asset Inventory

Maintain a complete, up-to-date inventory of all SCADA hardware (HMIs, RTUs, PLCs, historians, servers, network devices) and software versions.

IEC 62443 SR 2.8 / NIST 800-82 §5.2 / NERC CIP-002

High

Select ▼

1.2

Asset Classification

Classify each asset by criticality (Safety, Critical, High, Low) and document the classification rationale.

IEC 62443 SL-T / NIST 800-82 §5.2

High

Select ▼

1.3

Network Topology Map

Maintain a current network diagram showing all OT/ICS devices, zones, conduits, and communication paths.

IEC 62443 SR 1.13 / NERC CIP-005

High

Select ▼

1.4

Software Baseline

Document authorized software, firmware versions, and patch levels for every OT asset.

IEC 62443 SR 2.2 / NIST 800-82 §6.2.1

Medium

Select ▼

1.5

Removable Media Control

Maintain a register of all authorized removable media (USB, portable drives) used in the OT environment.

IEC 62443 SR 2.3 / NERC CIP-010

Medium

Select ▼

2. NETWORK ARCHITECTURE & SEGMENTATION

2.1

Zone & Conduit Model

Define security zones and conduits per IEC 62443 with documented security-level targets (SL-T) for each zone.

IEC 62443 §4.2 / NIST 800-82 §6.1

High

Select ▼

2.2

IT/OT Separation

Enforce logical and/or physical separation between corporate IT networks and OT/SCADA networks using firewalls or DMZs.

IEC 62443 SR 1.13 / NIST 800-82 §6.1 / NERC CIP-005

High

Select ▼

2.3

Purdue Model Compliance

Segment the network into Levels 0–4 (Field, Control, Supervisory, Operations, Enterprise) with restricted cross-level communication.

IEC 62443 / NIST 800-82 Fig. 5-1

High

Select ▼

2.4

Firewall Rule Review

Review and audit all firewall rules at least every 90 days; deny all traffic not explicitly permitted.

IEC 62443 SR 5.1 / NERC CIP-007

High

Select ▼

2.5

Data Diodes / Unidirectional Gateways

Deploy unidirectional security gateways where data must only flow from OT to IT (historian, SCADA to business intelligence).

IEC 62443 SR 3.5 / NIST 800-82 §6.1

Medium

Select ▼

2.6

Wireless Security

Disable all unauthorized wireless access; where wireless is required, enforce WPA3-Enterprise and segment to a dedicated VLAN.

IEC 62443 SR 1.13 / NIST 800-82 §6.7

High

Select ▼

2.7

VLAN Segmentation

Separate control-layer devices (PLCs, RTUs) from supervisory-layer devices (SCADA servers, HMIs) using VLANs with ACLs.

IEC 62443 SR 5.2 / NERC CIP-005

Medium

Select ▼

2.8

Legacy Protocol Isolation

Isolate insecure legacy protocols (Modbus, DNP3, older OPC-DA) within their own network segment; block external routing.

IEC 62443 SR 3.3 / NIST 800-82 §6.2

High

Select ▼

3. ACCESS CONTROL & IDENTITY MANAGEMENT

3.1

Role-Based Access Control (RBAC)

Implement RBAC; assign minimum necessary permissions to each user role (operator, engineer, admin, auditor).

IEC 62443 SR 2.1 / NIST 800-82 §6.2.2

High

Select ▼

3.2

Unique User Accounts

Eliminate shared accounts; every user must authenticate with a unique, individual account on all OT systems.

IEC 62443 SR 1.1 / NERC CIP-007

High

Select ▼

3.3

Multi-Factor Authentication

Enforce MFA for all privileged accounts, remote sessions, and SCADA server logins.

IEC 62443 SR 1.1 / NIST 800-82 §6.2.2

High

Select ▼

3.4

Password Policy

Enforce password complexity (min 12 chars, upper/lower/number/symbol) with 90-day rotation for privileged accounts.

IEC 62443 SR 1.5 / NERC CIP-007-6 R5

High

Select ▼

3.5

Account Review

Review all active user accounts and permissions every 90 days; disable dormant accounts within 24 hours of termination.

IEC 62443 SR 2.4 / NERC CIP-007

Medium

Select ▼

3.6

Default Credential Removal

Change all manufacturer default usernames and passwords before commissioning any device.

IEC 62443 SR 1.5 / NIST 800-82 §6.2

High

Select ▼

3.7

Privileged Account Management

Limit the number of administrator-level accounts; log all privileged actions with timestamps.

IEC 62443 SR 2.1 / NERC CIP-007

High

Select ▼

4. REMOTE ACCESS SECURITY

4.1

Encrypted VPN

All remote access to the OT network must use an approved, encrypted VPN (IPsec or TLS 1.2+). No direct RDP or SSH to field devices.

IEC 62443 SR 1.13 / NIST 800-82 §6.2.3 / NERC CIP-005

High

Select ▼

4.2

Jump Server / Bastion Host

Route all remote sessions through a dedicated jump server with session logging, recording, and automatic timeout.

IEC 62443 SR 2.6 / NERC CIP-005

High

Select ▼

4.3

Vendor / Third-Party Access

Issue time-limited, just-in-time access credentials for vendors; revoke immediately upon job completion; monitor all sessions.

IEC 62443 SR 1.2 / NERC CIP-005

High

Select ▼

4.4

Session Timeout

Configure idle session timeouts ≤15 minutes on all remote access sessions and HMI workstations.

IEC 62443 SR 1.6 / NIST 800-82 §6.2.2

Medium

Select ▼

4.5

Remote Access Logging

Log all remote connections: user, source IP, timestamp, session duration, commands executed. Retain logs ≥90 days.

IEC 62443 SR 2.8 / NERC CIP-007

High

Select ▼

4.6

Modem & Legacy Dial-Up Removal

Audit and remove unauthorized modems or legacy dial-up connections to RTUs or PLCs.

IEC 62443 SR 1.13 / NERC CIP-005

High

Select ▼

5. PATCH & VULNERABILITY MANAGEMENT

5.1

Vulnerability Scanning

Conduct OT-safe vulnerability scans at least quarterly using a passive or OT-specific scanner (e.g., Claroty, Dragos, Nozomi).

IEC 62443 SR 7.7 / NIST 800-82 §6.3 / NERC CIP-010

High

Select ▼

5.2

Patch Assessment

Evaluate vendor security patches within 35 days of release; document applicability, risk, and schedule for each asset.

IEC 62443 SR 3.9 / NERC CIP-007-6 R2

High

Select ▼

5.3

Patch Deployment

Apply critical patches within 35 days; high-severity patches within 90 days; document exceptions with compensating controls.

IEC 62443 SR 3.9 / NERC CIP-007

High

Select ▼

5.4

Patch Testing

Test patches in a non-production/staging environment before deploying to live SCADA systems.

IEC 62443 / NIST 800-82 §6.3

High

Select ▼

5.5

Change Management

Submit all changes to OT systems through a formal change management process with rollback plan.

IEC 62443 SR 7.7 / NERC CIP-010

Medium

Select ▼

5.6

End-of-Life Tracking

Identify all EoL/EoS software and hardware; document compensating controls (e.g., additional monitoring, air-gapping) until replacement.

IEC 62443 SR 7.7 / NIST 800-82

Medium

Select ▼

6. THREAT DETECTION & MONITORING

6.1

OT Security Monitoring

Deploy continuous, passive network monitoring for OT traffic; alert on anomalous communication patterns.

IEC 62443 SR 6.1 / NIST 800-82 §6.4 / NERC CIP-007

High

Select ▼

6.2

Security Event Logging

Enable logging on all SCADA servers, HMIs, engineering workstations, and network devices; synchronize clocks with NTP.

IEC 62443 SR 6.1 / NERC CIP-007-6 R4

High

Select ▼

6.3

Log Retention

Retain security logs for a minimum of 90 days online; archive for 1 year (3 years for NERC CIP environments).

IEC 62443 SR 6.2 / NERC CIP-007

Medium

Select ▼

6.4

SIEM Integration

Forward OT security events to a SIEM with OT-specific correlation rules; define escalation thresholds.

IEC 62443 SR 6.2 / NIST 800-82 §6.4

Medium

Select ▼

6.5

IDS/IPS Deployment

Deploy intrusion detection (passive IDS preferred for OT) to monitor traffic between zones and conduits.

IEC 62443 SR 6.2 / NERC CIP-005

High

Select ▼

6.6

Malware Protection

Deploy OT-compatible endpoint protection on all Windows-based HMIs and SCADA servers; run definition updates on a tested schedule.

IEC 62443 SR 3.2 / NERC CIP-007-6 R3

High

Select ▼

6.7

Baseline Behaviour

Establish a communication baseline for all SCADA assets; alert on deviations (new connections, unusual polling intervals, protocol anomalies).

IEC 62443 SR 6.2 / NIST 800-82 §6.4

Medium

Select ▼

7. INCIDENT RESPONSE & RECOVERY

7.1

ICS Incident Response Plan

Document and maintain an OT-specific Incident Response Plan (IRP) covering detection, containment, eradication, recovery, and lessons-learned.

IEC 62443 SR 6.1 / NIST 800-82 §6.5 / NERC CIP-008

High

Select ▼

7.2

IR Plan Testing

Test the OT IRP at least annually via tabletop exercise or live drill; update the plan after each exercise.

IEC 62443 / NERC CIP-008-6 R2

High

Select ▼

7.3

Cyber Incident Reporting

Define and document internal and regulatory incident reporting timelines (NERC CIP: 1 hour for Cybersecurity Incidents).

NERC CIP-008 / NIST 800-82 §6.5

High

Select ▼

7.4

Forensic Evidence Preservation

Define procedures for preserving logs and forensic evidence without disrupting SCADA operations during an incident.

IEC 62443 SR 6.1 / NERC CIP-008

Medium

Select ▼

7.5

Backup & Recovery

Back up all SCADA configurations, historian data, and server images. Test restores quarterly. Store backups offline or air-gapped.

IEC 62443 SR 7.3 / NERC CIP-009 / NIST 800-82

High

Select ▼

7.6

Recovery Time Objective

Define and test Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for all critical SCADA functions.

IEC 62443 SR 7.3 / NERC CIP-009

High

Select ▼

8. PHYSICAL SECURITY

8.1

Physical Access Control

Restrict physical access to control rooms, server rooms, and field equipment enclosures to authorized personnel only.

IEC 62443 SR 2.7 / NERC CIP-006

High

Select ▼

8.2

Access Logs

Log and audit all physical access to critical cyber assets using electronic access control systems (card reader, PIN, biometric).

IEC 62443 SR 2.8 / NERC CIP-006-6

High

Select ▼

8.3

CCTV Monitoring

Deploy CCTV surveillance at all entry points to OT areas; retain footage for a minimum of 90 days.

IEC 62443 SR 2.7 / NERC CIP-006

Medium

Select ▼

8.4

USB & Port Lockdown

Disable or physically block all unused USB ports, CD/DVD drives, and serial ports on field devices and workstations.

IEC 62443 SR 2.3 / NIST 800-82 §6.2

High

Select ▼

8.5

Environmental Controls

Monitor and alarm on environmental conditions (temperature, humidity, power, smoke) in control rooms and comms cabinets.

NIST 800-82 §6.8

Medium

Select ▼

9. SUPPLY CHAIN & VENDOR MANAGEMENT

9.1

Vendor Security Assessment

Conduct a cybersecurity assessment of all OT vendors and system integrators before contract award; review annually.

IEC 62443 Part 2-4 / NIST 800-82

High

Select ▼

9.2

Software Integrity Verification

Verify the integrity (hash / digital signature) of all OT software, firmware, and patches before installation.

IEC 62443 SR 3.4 / NIST 800-82 §6.2

High

Select ▼

9.3

Third-Party Contract Requirements

Include cybersecurity obligations (right-to-audit, incident notification, patch timelines) in all OT vendor contracts.

IEC 62443 Part 2-4

Medium

Select ▼

9.4

Component Provenance

Document the country of origin for all critical hardware components; assess supply-chain risk for hardware installed in critical systems.

NIST 800-82 / EO 14028

Medium

Select ▼

10. SECURITY GOVERNANCE & TRAINING

10.1

OT Security Policy

Maintain a documented, board-approved OT / ICS cybersecurity policy reviewed and updated at least annually.

IEC 62443 Part 2-1 / NIST 800-82 §4

High

Select ▼

10.2

Security Roles & Responsibilities

Assign a named OT Security Owner / CISO with documented responsibilities for SCADA cybersecurity.

IEC 62443 Part 2-1 / NERC CIP-003

High

Select ▼

10.3

Annual Security Training

Deliver role-specific cybersecurity awareness training to all OT personnel annually; document completion.

IEC 62443 SR 2.9 / NERC CIP-004

High

Select ▼

10.4

Security Risk Assessment

Conduct a formal OT cybersecurity risk assessment (using IEC 62443 or NIST RMF) at least every two years or after major changes.

IEC 62443 Part 3-2 / NIST 800-82 §5

High

Select ▼

10.5

Penetration Testing

Conduct OT-specific penetration tests every two years (or after major architecture changes) using a qualified ICS pen-tester.

IEC 62443 / NERC CIP-010

Medium

Select ▼

10.6

Management Review

Conduct quarterly management reviews of the OT security posture, outstanding findings, and KPIs.

IEC 62443 Part 2-1

Medium

Select ▼

100