OPERATIONAL TECHNOLOGY / SCOPED ASSESSMENTS
OT cybersecurity assessments for water and wastewater utilities, ports and maritime facilities, and defense manufacturers. Define the control-system boundary, examine access and risk, and give reviewers a documented record of the work.
Start with the systems you operate and the evidence you need. Each service below connects a facility-specific assessment with a defined document and evidence handoff.
AWIA / STATE CYBER REQUIREMENTS
SCADA and access review, cyber annex preparation, and a signed assessment record for utility teams.
MTSA / USCG CYBERSECURITY PLAN
MTSA facility assessment, USCG Cybersecurity Plan preparation, and evidence for operational review.
CMMC / NIST SP 800-171
Shop-floor asset scoping, CUI boundary review, and evidence preparation for CMMC and NIST SP 800-171.
Agree the systems, authority, operational constraints, and questions to resolve. Establish how sensitive records will be exchanged.
Review inventories, access paths, configuration records, and response procedures. Active testing requires separate written authorization and operating constraints.
Connect findings to the source material and applicable review criteria. Identify gaps, corrective actions, owners, and questions that remain open.
Prepare the agreed assessment record and signed evidence package, with verification instructions and handling requirements for the receiving team.
ML-DSA-87 / MATRIX SCROLL / SCROLL CONSOLE
Matrix Scroll signs records with ML-DSA-87. Scroll Console organizes imported evidence, supports comparison with retained sources, and prepares controlled handoffs. These are private SSX360 tools used within an agreed engagement.
Explore the evidence workflowThe agreed scope can cover industrial control systems (ICS), SCADA, operator workstations, remote access, network boundaries, and incident-response records. The facility and operational constraints determine the assessment methods.
A pilot can focus on one facility, system boundary, or evidence question. Scope, price, deliverables, and purchasing arrangements are agreed directly. Procurement thresholds and grant eligibility depend on the buyer and the applicable rules.
A signature supports checking the supplied record against a key. Reviewers still evaluate the findings, source quality, signer authority, and applicable requirements. Compliance and approval decisions remain with the responsible parties.
Share the facility type, general systems in scope, review objective, and target date. Keep network diagrams, credentials, CUI, and other sensitive records out of the first inquiry.