OT Network Assessments
Site Walkthrough and Network Mapping
CloudCentric is a managed IT provider in Mount Pleasant, South Carolina, serving businesses across Charleston and the Lowcountry. You can reach us at (844) 422-7000.
An OT network assessment walks the plant or facility and records every network-connected controller, HMI, drive, camera, switch, and modem. CISA's 2026-07-30 water-sector alert says cellular modems may be undocumented and missed by routine attack-surface scans, so they are found by walking the site.
The deliverable is a network drawing showing what is connected, where, and how each zone reaches the others. It identifies unmanaged switches in control panels and MCC rooms, which give no visibility and no alerts.
The assessment does not change any PLC program.
Identifying Exposures and Remote Access
The assessment identifies every path to the internet, including cellular modems installed by vendors or integrators. It lists every remote-access route used by vendors, integrators, and staff.
It records default passwords still in use on controllers, HMIs, and network equipment. It also records which devices share a flat network with office PCs, the starting point for separating plant and office networks.
CISA advisory AA26-097A lists ports 44818, 2222, 102, and 502 on controllers, and 22 on modems, as those seen in attacks; the assessment checks whether any are reachable from outside.
Findings are ranked so the internet and modem exposures CISA names are handled first.
Regulatory Guidance and Planning Facts
CISA and partner agencies published 'Foundations for OT Cybersecurity: Asset Inventory Guidance' on 2025-08-13, asking owners to build and maintain an OT asset inventory. Additionally, CISA's Internet Exposure Reduction guidance asks owners to find and remove internet-reachable OT, and to protect what must stay reachable with jump hosts, MFA, and monitoring.
The EPA lists an OT and IT asset inventory among the immediate steps it expects of water systems.
The Coast Guard rule, s.101.650(b), requires MTSA facilities to keep an inventory of network-connected systems and documentation of the network map and OT device configuration. The Coast Guard rule's annual Cybersecurity Assessment must analyse all networks for vulnerabilities to critical IT and OT systems.
CloudCentric does not certify compliance with the Coast Guard rule or any standard; the assessment supplies the network facts a compliance plan uses.
Maintaining a Current Topology
Where switches are replaced with UniFi, the console shows a live topology map and client list, which keeps the drawing current after the assessment. UniFi Network 11 adds a topology history that shows how the network looked at an earlier time.
Limit: no UniFi product is certified to IEC 62443; a design can follow the standard's zones-and-conduits approach, but nothing is described as 62443 certified.