Control Systems Security Checklist

Use this checklist to reduce exposure, control remote access, and improve your ability to recover from a cybersecurity incident.

1. Protect Controller Access

• □  Change all default passwords before commissioning the system.
• □  Use unique passwords for each facility, system, and user.
• □  Limit programming access to authorized personnel only.
• □  Apply user-level permissions based on job responsibilities.
• □  Protect controller programs from unauthorized viewing or modification.
• □  Remove or disable unused user accounts.
• □  Review access permissions whenever an employee or contractor changes roles.

2. Avoid Direct Internet Exposure

• □  Do not connect PLCs or HMIs directly to the public internet.
• □  Remove unnecessary port-forwarding rules from facility routers.
• □  Verify that controller programming ports are not publicly accessible.
• □  Use a managed, encrypted remote-access platform rather than an exposed web server or open inbound connection.
• □  Periodically scan the facility’s public IP addresses for unintentionally exposed devices.

3. Use Secure Remote Access

• □  Route remote visualization, troubleshooting, and programming through an approved secure-access platform.
• □  Use encrypted connections for all remote sessions.
• □  Allow only authorized users and approved devices to connect.
• □  Provide each remote user with an individual account rather than shared credentials.
• □  Require multifactor authentication when supported.
• □  Review and remove temporary contractor or service accounts after work is completed.
• □  Log remote sessions and periodically review access activity.

4. Segment the Automation Network

• □  Separate the operational technology network from the office and business network.
• □  Use industrial firewalls between network zones.
• □  Restrict communication to only the ports, protocols, and devices required for operation.
• □  Place remote-access gateways and cloud-connected devices in an appropriate security zone.
• □  Prevent general-purpose office computers from directly accessing controllers.
• □  Use separate networks or VLANs for control, visualization, maintenance, and guest access.

5. Reduce the Attack Surface

• □  Disable unused Ethernet services, protocols, and communications ports.
• □  Remove obsolete devices and unsupported software.
• □  Avoid installing unnecessary third-party remote-access tools on control-system computers.
• □  Maintain an inventory of every PLC, HMI, computer, network device, and firmware version.
• □  Review the inventory at least annually and whenever the system changes.
• □  Favor integrated automation architectures that reduce the number of separate devices and connections that must be maintained.

6. Maintain Software and Firmware

• □  Subscribe to security notifications from automation and network-equipment suppliers.
• □  Review vendor security advisories regularly.
• □  Keep controller firmware, programming software, operating systems, firewalls, and routers at supported versions.
• □  Test updates before deploying them to an operating facility.
• □  Document approved firmware and software versions for each system.
• □  Replace equipment that can no longer receive security updates.

7. Back Up Critical Systems

• □  Maintain current backups of all controller programs and configurations.
• □  Back up HMI applications, recipes, data-logging configurations, and network settings.
• □  Store at least one backup offline or in a protected location.
• □  Label backups with the controller model, firmware version, date, and facility location.
• □  Verify that backups can be restored successfully.
• □  Update backups after every approved system change.

8. Control System Changes

• □  Require authorization before controller programs or network settings are changed.
• □  Record who made each change, what was changed, and why.
• □  Compare running controller programs with approved master copies when suspicious activity is detected.
• □  Investigate unexpected logic, setpoint, timer, alarm, or communications changes.
• □  Restrict the use of removable media and scan approved devices before use.

9. Monitor for Warning Signs

• □  Watch for unexpected controller resets, mode changes, or firmware updates.
• □  Investigate unexplained process changes or abnormal equipment operation.
• □  Monitor repeated login failures and unusual remote-access activity.
• □  Review firewall and network logs for unexpected connections.
• □  Train operators to report unfamiliar screens, alarms, messages, or behavior immediately.

10. Prepare an Incident-Response Plan

• □  Identify who has authority to disconnect remote access or isolate the automation network.
• □  Maintain current contact information for operations, engineering, IT, management, and equipment suppliers.
• □  Document how to place the process in a safe manual or local-control state.
• □  Define how compromised equipment will be isolated without creating a safety or environmental hazard.
• □  Practice restoring controller programs and system configurations.
• □  Report significant incidents to the appropriate authorities and cybersecurity agencies.

Ready to secure your control systems?

Process Solutions Corp. can help you specify Horner OCS controllers and OCS360 secure remote access for your facility.