How to Conduct an OT Cybersecurity Risk Assessment in a Manufacturing Plant

A practical approach to identifying cybersecurity risks that could affect production systems, equipment availability, and operational resilience.

October 2026 · Manufacturing OT Security

Why OT cybersecurity risk assessments matter

Manufacturing cybersecurity is not just about protecting information. A security incident involving operational technology (OT) can also affect production equipment, industrial processes, product quality, worker safety, and the ability to maintain operations.

A ransomware incident affecting an office computer is disruptive. An incident that interrupts an engineering workstation, industrial controller, or critical production network can introduce additional operational consequences.

That distinction matters when conducting an OT cybersecurity risk assessment. Traditional IT risk models do not always capture the operational dependencies and physical consequences found in manufacturing environments.

The goal is not simply to identify vulnerabilities. It is to understand which weaknesses could affect manufacturing operations and determine where improvements would reduce meaningful risk.

1. Identify critical production systems

Start by identifying the OT systems that support important manufacturing processes. Depending on the facility, these may include programmable logic controllers (PLCs), human-machine interfaces (HMIs), robotics, industrial servers, supervisory systems, and engineering workstations.

Not every device carries the same risk. Consider what happens if a system becomes unavailable, behaves unexpectedly, or cannot be restored within an acceptable period.

An asset inventory is a useful starting point, but its value increases when systems are also associated with their operational function and business criticality.

2. Understand network and system dependencies

Manufacturing systems rarely operate in complete isolation. Production equipment may depend on services provided by other OT systems, shared infrastructure, or enterprise IT networks.

Common dependencies include authentication, name resolution, time synchronization, manufacturing execution systems, file services, licensing, databases, and centrally managed applications.

Consider a production workstation that depends on a remote application server. The workstation itself may be functioning correctly, but a network interruption could prevent it from accessing the application needed for production.

Risk assessments should therefore examine both individual systems and the services on which they depend.

3. Evaluate OT cybersecurity controls

Once critical assets and dependencies are understood, review the safeguards intended to reduce cybersecurity risk.

An initial assessment should consider several areas.

Controls should be evaluated in the context of the manufacturing environment. A technically appropriate IT security control may require additional testing, planning, or operational safeguards before being introduced into OT.

4. Evaluate operational consequences

Risk is influenced by more than whether a cybersecurity weakness exists. The likelihood of a harmful event and its potential consequences also matter.

In manufacturing, those consequences may include production interruptions, equipment damage, safety hazards, defective products, and prolonged recovery efforts.

For example, two workstations may share a similar technical weakness. However, one supports a noncritical reporting application while the other is required to maintain a production process.

Those systems should not automatically receive identical remediation priorities.

Consider these factors

• Operational criticality of the affected process
• Potential impact on safety or equipment
• Exposure and credible threat scenarios
• Existing protective or compensating controls
• Acceptable downtime and recovery capability

5. Prioritize improvements based on risk

A useful assessment should lead to decisions, not simply produce a long list of findings.

Start by identifying conditions with potentially serious operational consequences. Then consider the practical feasibility, dependencies, and urgency of proposed improvements.

Some improvements may be implemented quickly, such as reviewing unnecessary remote access permissions. Others, including redesigning industrial network architecture, may require significant engineering coordination and planned maintenance windows.

A practical improvement roadmap should identify responsible teams, proposed actions, and reasonable implementation milestones. Critical risks should not be deferred solely because they require more effort.

6. Understand the limitations of an initial assessment

A questionnaire-based assessment can help manufacturers identify potential weaknesses, organize internal discussions, and decide where additional investigation is warranted.

It cannot independently verify the condition of production equipment, confirm network segmentation, identify every vulnerability, or prove that protective controls work as intended.

Where the consequences are significant, a deeper technical assessment may require document reviews, architecture analysis, evidence validation, and carefully planned testing appropriate for the OT environment.

Any active testing of production systems should be coordinated with the responsible engineering and operations teams.

How NIST SP 800-82 supports OT risk assessment

NIST Special Publication 800-82 Revision 3, Guide to Operational Technology (OT) Security, provides guidance for improving OT security while accounting for performance, reliability, and safety requirements.

The publication discusses OT-specific threats, vulnerabilities, risk management, security architectures, and safeguards. Its risk assessment guidance is especially relevant when evaluating how cybersecurity incidents could affect industrial operations.

As of October 2026, Revision 3 is the final publication. NIST released an initial public draft of Revision 4 in September 2026, including additional alignment with the NIST Cybersecurity Framework 2.0.

Reference: NIST SP 800-82 Revision 3.

Draft reference: NIST SP 800-82 Revision 4 (Initial Public Draft).