OT cybersecurity gap assessment: IEC 62443 and regulation

Short answer

A gap assessment compares the real state of cybersecurity in substations and plants with what the applicable regulation requires (a national or grid-operator guide, NERC CIP in North America, the ONS routines in Brazil) and with a reference technical standard such as IEC 62443. The scope is set with the critical-asset criteria, what exists is surveyed in the field, it is compared requirement by requirement with the compliance checklist, and the result is a gap map ranked by risk and a plan ordered by the regulatory deadlines. It does not certify compliance: it shows where to invest first.

What it is for

Grid operators and regulators in many countries now require owners of critical substations, power plants and control centers to meet a cybersecurity guide, usually with phased deadlines. The first step for many companies is to know how much is missing. That is the gap assessment: compare what exists in substations, plants and control centers with what the applicable guide requires, and turn the difference into a plan.

It is not an audit or a certification. Regulations typically provide for periodic audits and leave compliance with the asset owner. A gap assessment is an internal diagnosis that says where to invest first.

What it is compared against

Reference	What it provides
The applicable regulatory guide (for example NERC CIP in North America, the ONS cybersecurity routines in Brazil, or the grid operator’s guide in your country)	The requirements: critical assets, governance and personnel, perimeter, cyber asset security, recovery, incidents, physical security, supply chain and risk management
The guide’s critical-asset criteria	The criteria that define the scope
The guide’s periodic compliance checklist	The evidence expected for each requirement, the review period and whether it applies to smaller plants
IEC 62443-2-1:2024	The requirements of the security program of the owner of systems in operation, organized in program elements, with a maturity model to assess them
IEC 62443-3-3:2013	The technical requirements of the system by foundational requirement and security level

The regulatory guide says what must be demonstrated. IEC 62443 helps decide how to do it well and to measure maturity, not just presence. Its 2024 edition of part 2-1 also recognizes that many installed systems run unsupported software, and allows compensating measures written into the owner’s policies and procedures.

How it is done

OT cybersecurity gap assessment

Scope. Critical assets and their critical cyber assets
Documents. Current policies, procedures, diagrams and contracts
Field survey. Devices, firmware, connections, accounts, remote access
Comparison. Requirement by requirement against the checklist and the reference standard
Prioritization. Risk of each gap and the regulatory deadline that governs it
Gap map and plan. Actions, owners and dates

Scope. It starts from the critical-asset criteria of the applicable guide: generating units above a given size, substations from a given voltage level with their bays, special protection schemes and automatic load shedding, control centers and backup centers, among others. Smaller plants usually have minimum requirements of their own. Inside each critical asset, the critical cyber assets are identified: the essential devices that use a routable or communication protocol.

Documents. The cybersecurity policy, existing procedures, network diagrams and contracts with suppliers and contractors are reviewed, because many gaps are on paper: the control exists, but it is not written down and there is no evidence.

Field survey. This is the part that surprises the most. Almost always there is a modem nobody documented, a switch with the factory password, a relay with every service active, or a vendor VPN that was left open. The model, firmware, services, accounts and connections of each device are recorded, together with the real path of each remote access.

Comparison. Each requirement is rated with a clear status, for example: exists with evidence, exists without evidence, partial, does not exist, or not applicable. For technical controls, the comparison with IEC 62443-3-3 says whether what exists is enough for the security level the zone needs, which comes from the IEC 62443-3-2 risk assessment.

Prioritization. Not all gaps weigh the same. Direct remote access to a relay without multi-factor authentication weighs more than an unsigned procedure. Each gap is ranked by risk and by the regulatory deadline that governs it.

The most common technical gaps

In substations and plants, the technical gaps that repeat most have known fixes:

Direct remote access, with no intermediate system or multi-factor authentication. The architecture that fixes it is in secure remote access to relays and substations.
Flat networks, where the office, cameras and relays share a segment. They are fixed with zones, conduits and an industrial router and firewall.
Factory or shared passwords in relays and switches; the detail is in access levels and passwords in relays.
No event monitoring, solved with centralized logs and intrusion detection.

Regulatory deadlines

Cybersecurity regulations usually phase in their requirements: first a designated cybersecurity officer, then the main procedures and evidence (access, perimeter, temporary connections, vulnerabilities, patches, recovery, incidents, physical security, supply chain and risks), then monitoring and event identification controls, and last the certification of suppliers and contractors. Each country sets its own dates, and new owners usually get a period counted from their registration.

Some of those dates may already have passed, so the resulting plan often mixes overdue actions with preparation for the later milestones. Incident reporting follows its own procedure and format, which is also set by the regulator or grid operator. We adapt the plan to the deadlines and formats of the regulation that applies to you.

What is delivered

Gap map: each applicable requirement with its status, the evidence found and what is missing.
Technical inventory of the critical cyber assets surveyed.
Treatment plan: actions, owners and dates, ordered by risk and by deadline, which is also what regulatory guides ask for in their risk management chapter.
Compensating controls proposed where a control is not technically feasible on an existing device.

Frequent mistakes

Assessing only documents, without going to the field.
Confusing having a control with being able to demonstrate it: without evidence, for the regulator it does not exist.
Leaving out smaller plants or backup control centers.
A plan without owners or dates, which cannot be followed.
Promising compliance instead of showing risk and progress.

We help with the technical part

At Tiza Group we survey the relays, controllers, gateways, switches and remote access of substations and plants. We also configure the controls that come out of the assessment: accounts, roles, ports, services, logs, backup and remote access. This is part of our substation and plant cybersecurity service. For relays and controllers we also work remotely, worldwide, through remote relay configuration. We do not issue certifications or perform formal audits. Write to us and we will review the scope of your case. How to put the plan together, with roles, escalation and annual tests, is covered in OT Incident Response Plan for a Substation.

References

IEC 62443-2-1:2024, Security program requirements for IACS asset owners.
IEC 62443-3-3:2013, System security requirements and security levels.
NERC CIP standards (North America) and the cybersecurity routines of the national grid operator of each country, as applicable.

Frequently asked questions

Does a gap assessment certify that we comply with the regulation?

No. Compliance is the responsibility of the asset owner and is shown with evidence and with the audit the regulation itself provides for. A gap assessment is a diagnosis: it says what is missing, at what risk and in what order to address it.

Where do you start?

With the scope: which assets meet the critical-asset criteria and which are their critical cyber assets. Without that, the assessment measures the wrong things. Then comes the field inventory, which almost always reveals equipment and connections that were not documented.

What is the difference between the regulatory checklist and IEC 62443?

The regulation is the legal obligation and its checklist says what evidence is expected for each requirement. The IEC 62443 series is a technical standard: IEC 62443-2-1 organizes the asset owner's security program and IEC 62443-3-3 the technical requirements of the system. Using both lets you comply and, at the same time, design the controls well.