OT Security Program Kit

View sample pages (PDF) ↗

What's inside

• 00 Master Implementation Roadmap: a 24-week plan in five phases mapped to the NIST CSF 2.0 functions, telling you which document to use when, plus a CSF 2.0 Cross-Mapping Matrix showing which documents address each of the 106 outcomes
• OT Security Policy (Tier 1): objectives, values, risk appetite and governance
• OT Security Standard (Tier 3): technical requirements by IEC 62443 FR 1–7, with a requirements checklist for tenders
• OT Risk Management Methodology: zones, conduits and target security levels
• OT Program Charter, Governance Framework and First 90 Days Plan
• OT Security Strategy and 24-Month Roadmap with a global regulation and standards map
• OT Security Assessment Toolkit: rules of engagement, interview questions, evidence checklist and maturity scoring
• OT Incident Response Playbooks with safety-first actions for common OT incidents
• Shop Floor Security Checklist for plant floors, control rooms and cabinets
• Incident Response Plan: severity levels, roles, response phases, notification timelines and playbooks
• Business Continuity and Disaster Recovery Plan with a BIA and recovery workbook (MTPD, tiers, RTO/RPO gaps, test log)
• Excel workbook: 25 example OT assets with attention flags, 25 risks, remote access, zones and conduits, control map, vulnerabilities and patches, backup and recovery, suppliers, self-calculating KPIs and incident contacts
• Every document now includes real-world incidents, Auditor Red Flag callouts, small-business vs enterprise notes, worked examples, and a Control Register in the workbook that links each control ID to its owner and evidence
• Links 73 of 106 NIST CSF 2.0 outcomes to specific sections, shown in the CSF 2.0 Cross-Mapping Matrix
• Not included: training slide decks. The documents set the training requirements; deliver them with your own provider or materials

Format

Word (.docx) and Excel (.xlsx). Editable, with highlighted placeholders and guidance notes you delete before publishing.

Frameworks referenced

• IEC 62443-2-1:2024
• ISA/IEC 62443-3-3
• NIST SP 800-82r3
• NIST CSF 2.0

Aligned with the frameworks named. Templates support your program; they don't certify compliance.

Who it's for

Small and medium organizations, security leads, consultants and MSPs who want a structured starting point instead of a blank page.

Questions

Is this a finished policy I can use as is?

No. It's a template: a guideline based on common industry practice. Review each requirement, remove what doesn't apply, set values you can meet, and have the final version reviewed by people who know your systems and obligations.

How do I receive the files?

After checkout you get an instant download link by email from our payment partner.

Can I share it with clients?

The licence covers use within your own organization. Consultants and MSPs who want to use templates with clients should contact us.

Refunds and updates

See our licence and refund policy.