Standards & Frameworks Audited
- IEC 62443-2-1 (CSMS — cybersecurity management system)
- IEC 62443-3-3 (system security requirements, per Security Level)
- IEC 62443-4-1 / 4-2 (product security lifecycle, for OEMs and embedded components)
- ISO 27001 / ISO 27019 (energy-sector extension)
- NIS2 Article 21 technical and organisational measures
- EU Cyber Resilience Act (CRA) conformity readiness for in-scope products
- EN 50600 (data center OT and facility systems)
- NIST CSF 2.0 and NIST SP 800-82 (industrial control systems)
- FINMA cyber circular, BaFin BAIT/VAIT, ANSSI LPM, UAE NCA OTCS, Saudi NCA OTCC, CERT-In
- Sector overlays: IEC 61511 (process safety-cyber interface), API 1164 (pipeline), NERC CIP where applicable
Audit Execution
- Scoping workshop and evidence-request list, sized to the standard and the site
- Document review: policies, procedures, network diagrams, asset inventories, change records, incident logs
- Site walk-downs and control observation — not a tabletop-only exercise
- Technical verification against control claims (configuration review, log sampling, conduit validation)
- Data diode and unidirectional gateway specification where one-way flow is mandated (regulated, safety-critical)
- Interview programme across engineering, OT operations, IT security, safety, and vendor-management functions
- Evidence-linked scoring: every control rating supported by document ID, observation note, or technical artefact
Specialised Audit Tracks
- Third-party and supply-chain audit — vendor cyber posture, SBOM review, and contractual cyber clauses
- SOC / monitoring audit — detection coverage against MITRE ATT&CK for ICS, not just alert volume
- Backup, recovery, and cyber-resilience audit — tested RTO/RPO for OT, offline immutability, ransomware scenarios
- Pre-M&A audit — accelerated, SPA-grade, coordinated with DealShield™ engagement
- Post-incident audit — root-cause, control-failure, and regulator-notification-ready
Secure Remote & Third-Party Access
- Remote access architecture: jump-server, broker, and zero-trust patterns for OEMs and maintenance vendors
- Privileged session recording and just-in-time access design
- Third-party risk boundary — contractual and technical, not just contractual
- Third-party and supply-chain audit — vendor cyber posture, SBOM review, and contractual cyber clauses
- SOC / monitoring audit — detection coverage against MITRE ATT&CK for ICS, not just alert volume
- Backup, recovery, and cyber-resilience audit — tested RTO/RPO for OT, offline immutability, ransomware scenarios
- Pre-M&A audit — accelerated, SPA-grade, coordinated with DealShield™ engagement
- Post-incident audit — root-cause, control-failure, and regulator-notification-ready
- Audit Report — findings, evidence references, severity and likelihood, standard-clause traceability
- Executive Summary — board-grade, one-pager per risk theme
- Closure Plan — remediation backlog, owner-assigned, capex/opex separated, scheduled against planned shutdowns
- Regulator-Facing Evidence Pack — organised to the clause structure of the target standard, not to our template
- Follow-up Attestation — fixed-scope re-audit at six or twelve months to confirm closure