OT Risk & IEC 62443
Defining the System Under Consideration
Why scope determines the quality of an OT risk assessment
A vague system boundary leads to vague risk conclusions. This field note explains how to define a useful assessment scope without losing critical dependencies.
The boundary is more than an asset list
The System Under Consideration is often described as a collection of servers, controllers, network devices and applications. That inventory is useful, but it does not explain what the system is there to achieve or which dependencies are essential to the operational outcome.
A better definition starts with the function: what process, service or operational capability is being protected?
Include the interfaces that change the risk
Enterprise services, remote access, supplier connections, cloud platforms, field communications and shared infrastructure may sit outside the immediate control network while still influencing its exposure.
The boundary should include or explicitly reference these interfaces where they create credible threat paths, operational dependencies or control responsibilities.
Avoid scope that is too broad or too narrow
A very broad scope can make every finding sound generic. A very narrow scope can exclude the very pathways that make the system vulnerable.
The practical objective is to define a boundary that is coherent enough to assess and complete enough to support the required decision.
Document assumptions early
Assumptions about ownership, network separation, supplier responsibilities, asset criticality or future architecture should be made visible. Otherwise, different stakeholders may interpret the assessment differently.
Explicit assumptions also make it easier to update the assessment when the environment changes.
Use scope to control the assessment
The System Under Consideration should guide the evidence requested, the stakeholders engaged, the scenarios developed and the recommendations produced.
When the boundary is clear, the rest of the assessment becomes more focused, traceable and useful.
This article provides general advisory commentary. It does not identify any client, employer or specific operational environment and should not be treated as legal, regulatory or system-specific advice.
Continue the conversation