Phase 1 — The Foundation
OT Topology Assessment for Cement & Mining Operations
A site survey that documents what is on your OT network, how it connects, and where it falls short of the target architecture. Engineers walk the plant, observe passively, and change nothing. Scoped per plant, delivered to a named owner on your team.
Why static documentation fails
You cannot secure a topology you have not documented
Most operators know their OT environment has documentation gaps. The asset inventory is incomplete, the network diagrams are out of date, and nobody is sure which devices are actually reachable from the corporate network. These are the predictable consequences of an OT environment that grew plant by plant without a single topology authority.
- 01Asset inventories are incomplete or out of date
- Controllers, HMIs, historians, and PLCs exist on your network that don't appear in any current documentation. Every acquisition, expansion, or OEM integration adds devices that were never formally inventoried — and the gap compounds with every plant added to the fleet.
- 02Network segmentation is assumed, not verified
- The architecture diagram says the zones are separated. The reality on the wire may not match. Without documented segmentation evidence — VLANs, firewall rules, zone boundaries — you are relying on assumptions that no auditor or insurance carrier will accept.
- 03Scan-only assessments miss half the plant
- Discovery tools only see devices that answer on IP. Serial links, fieldbus segments, unmanaged switches, and isolated machines never show up in a scan, and active scanning can upset the controllers it does reach. An assessment done from a laptop in the control room documents the easy half.
How the assessment works
The assessment observes and changes nothing
Every plant is assessed with the same written procedure, traced to NIST SP 800-82 and ISA/IEC 62443, so findings from one plant compare directly with the next. The procedure states in advance what we will touch, what we will not, and who authorizes each step.
- 01Passive first, no configuration touched
- Discovery starts with passive observation and read-only configuration exports, with your staff operating any session that needs credentials. Active scanning is a written exception, scheduled for a planned outage. We do not open automation software and we never touch control logic.
- 02A physical walkdown of every area
- Engineers walk each electrical room, cabinet, and lab with a plant escort and photograph what is installed. This is how serial links, fieldbus segments, and standalone machines get into the inventory, including the quality laboratory and its instrument computers.
- 03Written authorization before any access
- Reaching a system is not permission to act on it. Scope, exclusions, accounts, and work windows are agreed in writing with your OT owner before we mobilize. We use named accounts only, never hold your credentials, and the plant can stop the work at any time.
What you receive
Procurement-grade documentation, not a slide deck
Every finding is the measured difference between what we observed and a defined target architecture. It is never an opinion, and it is never written against a person or a department.
- 01Baseline asset inventory and photo record
- Every device found on the OT network and on the plant floor: controllers, HMIs, historians, servers, network equipment, and remote-access paths. Each entry carries manufacturer, model, firmware, zone placement, lifecycle status, and a photograph of where it sits.
- 02Network topology drawings
- Current-state drawings of the network as it is actually built, by production area: zones, IT/OT boundary, DMZ placement, and physical media. A target-architecture drawing shows where it should be. Delivered as editable drawings, not locked PDFs.
- 03Assessment report with rated findings
- Each finding names the affected asset, the principle it does not meet, and a severity rating, with segmentation evidence mapped to Purdue Model levels and ISA/IEC 62443 zones. Suitable for audit or cyber-insurance renewal.
- 04Remediation roadmap
- Every finding links to a recommendation with a priority, grouped into phases with timeframes: what to fix first, what can wait for the next outage, and what to budget for. Problems that repeat across plants are listed once, to be fixed once.
FAQ
Questions operators ask before booking an assessment
Common questions from procurement teams and plant operations leadership evaluating the Topology Assessment. Reach out to our team.
A penetration test tells you what was exploitable on the day it ran. A Topology Assessment documents what is on your network, how it connects, and how it is segmented. The assessment is the foundation — every subsequent security decision, including whether to run a pen test, is informed by the topology.
Scoped per plant, returned within standard SOW timing. Duration depends on the size and complexity of the OT environment — a single cement plant is different from a multi-site aggregates operation. Timeline is defined in the SOW before work begins.
Escorted physical access to network rooms and cabinets, a monitoring port for passive observation where one is available, and read-only configuration exports, ideally run by your own staff. Every account and path we use is listed in an access matrix that your OT owner signs before we arrive. Anything not on the matrix is not used.
It is designed not to. No configuration is modified during an assessment, nothing is injected into the network, and control logic and safety systems are out of scope. Work windows are agreed in writing, and plant management can stop the work at any moment.
The Topology Assessment is designed as the entry point to a three-phase engagement. Phase 2 is Topology Authority — the maintained document of record. Phase 3 is OT Service Owner — full operational extension. Each phase builds on the documentation produced in the prior phase.
Deliverables are returned to a named owner on the operator's team — not posted to a portal, not emailed to a distribution list. The same accountability standard that applies to Potenza's engineering applies to document delivery.
Related reading
From the blog
OT Security Assessment vs Penetration Test: Which One Does Your Plant Need First?
An OT assessment documents the control network as built. A pen test shows what was exploitable on one day. Most plants need the assessment first.
IEC 62443 Security Levels Are Not a Number
Most OT programs set a target security level and stop there. The standard asks for three levels, and the gap between two of them is where the real work is.
The Purdue Model in Practice: What OT Network Segmentation Actually Looks Like on a Plant Floor
Everyone references the Purdue Model. Few organizations implement it the way the standard intends. Here's what each level actually contains in a working industrial environment — and where most segmentation projects go wrong.
Go deeper
This service, by industry
Cement
OT Topology Assessment for Cement Plants
Switch lifecycle census across kiln, mill, and packing networks, performed while the kiln runs.
Mining
OT Topology Assessment for Mining Operations
Per-site inventory that documents the backhaul as carefully as the plant.
Aggregates & Ready-Mix
OT Topology Assessment for Aggregates & Ready-Mix
A one-day-per-site template: batch controller, scale, dispatch, and who reaches them.
Our Services
Explore our OT services
- 01
Topology Authority
Continuous topology authority for your OT environment — not a point-in-time pen test, not an annual vulnerability scan. The operator's source of truth for what is on the network and how it connects.
- 02
OT Service Owner
Operational extension of the customer's OT team. ITIL-aligned governance, ongoing service ownership across multi-plant fleets. The OT Service Owner cannot be the OT Vendor — structural independence is the operating principle.
- 03
Managed OT Support
One operating model for the OT network in every plant you run: monitoring from our own read-only appliance, vendor-coordinated patching, an on-call engineer, and a written report every week. Aligned to NIST SP 800-82r3 and ISA/IEC 62443, and proven across a multi-plant cement fleet.
- 04
OT Network Monitoring
Continuous visibility across your OT network from a monitoring appliance inside the plant. PortGuard OT, built by Potenza, reads your switches and firewalls without ever writing to them, keeps working with no internet connection, and alerts our engineers first.
Get Started
Start with the topology
Every Potenza engagement begins with the same step — documenting what is on your OT network and how it connects. Tell us which plant you want to start with.
That is how our twelve-plant cement program started: one plant, one assessment, in late 2022.
What you'll get
- Per-plant scoped assessment with named delivery contact
- Asset inventory, photo record, topology drawings, and a remediation roadmap
- Severity-rated findings mapped to the Purdue Model and ISA/IEC 62443
- Passive-first method: no configuration changed, no production impact
- Foundation for Topology Authority and OT Service Owner phases
Prefer email? helpdesk@potenzaservices.com