What’s the Process of an IT/OT Risk Assessment like for a facility team?

Where to begin?

When you’re working in a facility that has equipment reaching end of life or components that are on the verge of obsolescence, it would be nice to simply wave a wand, and everything be instantly updated.  Unfortunately, because multiple installations and upgrades have been done over a period of decades, this process tends to be a bit more involved.  To better understand what’s wrong and what it will take to provide a fix, it really is imperative that the customer is as involved in this process as our engineers.

Because of the sheer number of issues and temporary band-aids placed on them, our customers often don’t know where to start.  Compounded fixes over time make it difficult to identify the main issue or issues.  That’s where we come in and can help add some rigor to this process.  If we can have an open line of communication with the decision makers and maintenance team, we can help them better understand what we’re assessing and what it will take to correct it.  The goal is to take a large amount of material and truncate it into digestible pieces that will allow all parties to evaluate potential solutions. 

A little bit, but not everything…….

In many cases maintenance technicians or employees may just think we’re there to redo the building.  They see an engineer walking the floor and may assume they’re only there to complete a particular task.  When in actuality we’re there to perform an in-depth assessment and present options to give them control over what optimizations are implemented.  They’re not always aware of the extent of what could be, but sometimes excited at the prospect of new equipment and connectivity; uplifting devices to Ethernet and a SCADA system that’s centralized.  It’s not that they’re opposed to change or not willing to cooperate, it’s more a matter of not knowing what they should expect as they’re simply being looped in at the end.

Getting everyone on the same page!

If read in from the beginning and actively engaged throughout the process, the engineer and employee could work in tandem to go around to all of the control panels, document all of their automation equipment, PLC, VFDs, switches. Old drawings, control scheme network, anything that can give us a picture.  Our engineers would come back with that information to the office, assess it, break it down for the client: it is end of life, obsolete, etc. all to identify if there are any risk factors at play, and if an update is required. We can also tell people what to prioritize – highlighting crucial equipment. One facility had a single, building-wide network. We can redesign their network topology to suite them better.  Having walked the facility with our engineers, the employees and maintenance technicians now have situational context and can make a better-informed decision as it pertains to their facilities’ optimization.

We understand that this entire experience can seem daunting.  To really put things in perspective, provide some context as to how working closely with our engineers can make this process more digestible and really ensure you get what you need, we wanted to provide a specific case where E Tech Group helped assess a facility’s vulnerabilities and executed their optimization vision below:

See it in action in the real-world application below:

While working in a heavily dated facility, it was discovered that all of their control panels were on one network, there were multiple manufacturers and versions of these devices, and they truly didn’t know what they had.  Because it was such a tangled web, it took an entire day for the maintenance team to identify that it was one network switch that caused the whole facility to shut down.  Even though this was an ethernet device, there was no centralized SCADA implemented to alarm in a control room and alert the maintenance team to the source of their downed lines.

Map it out…….

The site was in such a state of disarray, it was difficult to pinpoint which devices were where and what each panel was specifically controlling.  Because this assessment really could have been used twenty years ago, and a number of devices had been added as a stopgap, there was nothing else to do but start from the beginning and walk the facility, mapping what they currently have. 

Time for an upgrade…….

While assessing their site, it was determined that they were running on an outdated software platform that would make it difficult to perform the upgrade they so desperately needed and get their facility on a SCADA system where everything could be centrally monitored.  Because they were so eager to be involved in each step and open to collaboration, it was much easier to identify their wants and needs while working with the maintenance techs. 

Continue planning for the future…….

To make sure this momentum is carried through the entire process, communication and collaboration was maintained from the plant level through corporate to ensure all wants and needs were communicated and executed so that this facility received the optimization it truly needed and could perform its day-to-day operations worry free.

To learn more about IT/OT Risk Assessments follow the link below.