Cybersecurity Auditing

Chapter 15OT/ICS and Critical Infrastructure Audits

Operational technology and industrial control system (OT/ICS) environments represent the intersection of cybersecurity and physical safety—a domain where risk transcends data loss and enters the realm of human and environmental consequence. Understanding how auditors evaluate these systems is essential in order to maintain trust in critical infrastructure and ensure that digital assurance practices do not inadvertently disrupt the processes that keep societies functioning. Unlike traditional IT audits, where confidentiality dominates the conversation, OT auditing prioritizes safety, availability, and resilience. This chapter examines how these unique imperatives reshape control design, evidence collection, and risk evaluation across the industrial ecosystem.

From zoning and conduit architecture to allowlist enforcement, remote access governance, and change management discipline, this chapter explores how security assurance must adapt to legacy constraints and operational realities. It highlights the engineering logic behind network segmentation, the rigor required for compensating controls when patching is infeasible, and the delicate balance between continuous monitoring and process stability. These concepts form the basis of credible audit evidence—drawings, logs, and procedures that trace safety-critical decisions from design ...