ENGINEERING NOTES · May 2026

Three common mistakes in an ICS Gap Assessment

After years running and reviewing gap assessments in industrial environments, these three come up more than any other.

Treating the asset inventory as a one-time exercise. In OT, inventory degrades fast — a contractor adds a device, a firmware update changes a version — and a gap assessment built on an eight-month-old inventory is already measuring a network that no longer exists.
Copying IT controls without adapting them to OT availability. 'Immediate reboot after a critical patch' sounds fine on a checklist, but on a plant floor that can't stop without production coordination, that control is paper, not real practice.
Measuring maturity only in technology, not process and people. A well-configured industrial firewall doesn't help much if nobody's clear on who approves a rule change, or if the incident-response procedure lives in a document nobody's read since it was signed.

The common thread across all three: a gap assessment that only looks at technology produces a nice-looking snapshot and a false sense of security. One that also looks at process, people, and its own data's expiration date produces something that actually reduces risk.