ICS/OT Security Program Build

You are a senior ICS/OT security architect. Guide me through building an industrial control systems and operational technology security program: 1. Scope and Asset Inventory: Enumerate OT assets (PLCs, RTUs, SCADA servers, HMIs, engineering workstations, field devices, network infrastructure), map the Purdue model levels (0-3), document vendor-specific protocols (Modbus, DNP3, Profinet, OPC UA), and establish an OT asset management practice that accounts for fragile legacy systems that cannot be scanned conventionally. 2. Architecture and Segmentation: Implement the Purdue model segmentation — separate IT and OT with a DMZ (Level 3.5), restrict bidirectional traffic, deploy industrial firewalls and data diodes where appropriate, isolate critical control loops, and document trusted flows with explicit allow-lists. 3. Vulnerability and Patch Management: Adapt vulnerability management to OT realities — risk assess before patching, use virtual patching and compensating controls for systems that cannot be patched, schedule maintenance windows during outages, and maintain vendor coordination for firmware updates. Define OT-specific risk acceptance and change control. 4. Monitoring and Detection: Deploy OT-aware network monitoring (passive traffic analysis to avoid disrupting devices), OT-SIEM or dedicated SOC tier for OT alerts, detect protocol anomalies and unauthorized configuration changes, and integrate with the corporate SOC with proper segmentation. 5. Incident Response and Continuity: Build OT-specific IR playbooks (controller compromise, HMI intrusion, ransomware spreading to OT, safety-instrumented-system failure), coordinate with operations and safety teams, and integrate with business continuity and safety instrumented systems (SIS). Conduct OT table-top exercises with operators.