What evidence of attack detection in OT do auditors ask for?

Usually proof that detection exists, covers the right places and leads to action: which OTOT: operational technology. The computers that run machines, production lines, building systems and utilities. segments are monitored and how, which kinds of events are detected, who reviews alerts and how quickly, examples of alerts that were handled and what was decided, and how long the records are kept. In Germany, the Federal Office for Information Security (BSI) has published guidance on attack-detection systems for critical-infrastructure operators that auditors often use as a reference; other countries set their own expectations, so check with your national authority. A list of tools is not enough on its own: auditors look for a working process. A network map with first and last seen, alerts with timestamps and your notes on each decision make that process visible. NetSenX keeps alerts for your plan's alert history and, from the Pro plan, adds OT alerts for unauthorised writes, cross-level traffic, off-hours activity and S7comm commands. It does not certify you or replace the auditor's judgement.

← All 50 questions on OT and IoTAll topics