OT & ICS Scope Architecture
Specialized scoping for operational technology environments handling CUI — where most cyber consultants stop short.
What this engagement is
Manufacturing floors, R&D testbeds, and critical infrastructure components that touch CUI bring NIST SP 800-82 Rev. 3 into scope alongside 800-171. Most CMMC consultants don't have the OT background to scope these environments correctly. The result is over-scoping (which makes engagements unaffordable) or under-scoping (which fails at assessment).
Praedyn engagements draw on direct OT and ICS incident-recovery experience — AVEVA System Platform environments, plant-floor SCADA recovery, STIG-hardened Windows servers in process-control roles, and the specific failure modes that come from applying IT security baselines to OT systems without translation.
This engagement defines what's in scope, what gets isolated, what gets segmented, and what architecture changes are needed before assessment. It's frequently run in parallel with a Readiness Assessment for clients whose CUI footprint includes OT.
What you get
Deliverables included in the engagement
- OT / ICS asset inventory with classification (Purdue level, criticality, CUI handling)
- Network segmentation diagram with zone boundaries
- NIST SP 800-82 Rev. 3 control mapping against in-scope assets
- Recommended architecture changes for assessment readiness
- ISA/IEC 62443-aligned zone and conduit documentation
- Scope boundary documentation defensible to C3PAO
How we work
The phases of this engagement
Plant-floor walk
Physical and logical inventory of the OT environment. Identify what touches CUI, what doesn't, and what bridges the IT/OT boundary.
Asset & dataflow mapping
Map data flows, vendor remote access paths, historian connections, and any other CUI movement through OT.
Architecture recommendations
Define the segmentation, isolation, and compensating controls needed to make the OT environment assessment-ready.
Scope boundary documentation
Produce the scoping artifacts that will satisfy a C3PAO and survive technical scrutiny.
Right fit signals
When this engagement is the right call
- You have manufacturing, R&D testbeds, or critical infrastructure components that handle CUI
- Your environment includes PLCs, HMIs, SCADA, historians, or process-control workstations in scope
- Prior assessments or self-evaluations have over-scoped OT (and the budget shows it)
- You're building a new OT environment that will handle CUI and want it designed correctly from the start
Engagement specs
Typical duration
4 – 8 weeks
Engagement model
Fixed-fee, often parallel to Readiness Assessment
Standards referenced
NIST SP 800-82 Rev. 3, ISA/IEC 62443, UFC 4-010-06
— Ready to scope this