OT Security Assessment
by @krishnakumarmahadevan-cmd
Assess OT/ICS security posture across 30 controls in 6 principles — Business Driven, Risk Based, Enterprise Wide, Methodical, OT Security Focused, and OT Sec...
clawhub install ot-security-assessment📖 About This Skill
name: ot-security-assessment description: Assess OT/ICS security posture across 30 controls in 6 principles — Business Driven, Risk Based, Enterprise Wide, Methodical, OT Security Focused, and OT Security Compliant. Use when evaluating industrial control system security, SCADA security, OT network hardening, ICS cyber risk, or critical infrastructure protection. version: 1.0.0 homepage: https://portal.toolweb.in metadata: openclaw: emoji: "🏭" requires: env: - TOOLWEB_API_KEY bins: - curl primaryEnv: TOOLWEB_API_KEY os: - linux - darwin - win32 category: security
OT Security Assessment 🏭🔒
Assess your OT/ICS security posture across 30 controls organized into 6 security principles: Business Driven, Risk Based, Enterprise Wide, Methodical, OT Security Focused, and OT Security Compliant. Returns an overall compliance percentage, principle-level scores, critical gaps, risk level, and prioritized remediation findings.
Built by a CISSP/CISM certified security professional at ToolWeb.in
When to Use
Prerequisites
TOOLWEB_API_KEY — Get your API key from portal.toolweb.incurl must be available on the systemCRITICAL: Always Call the API
API Endpoint
POST https://portal.toolweb.in/apis/security/ot-security-assessment
6 Security Principles (30 Controls)
| Principle | Key | Controls | IDs | |-----------|-----|----------|-----| | Business Driven | business_driven | 5 | bd.1 — bd.5 | | Risk Based | risk_based | 5 | rb.1 — rb.5 | | Enterprise Wide | enterprise_wide | 5 | ew.1 — ew.5 | | Methodical | methodical | 5 | m.1 — m.5 | | OT Security Focused | ot_security_focused | 5 | of.1 — of.5 | | OT Security Compliant | ot_security_compliant | 5 | oc.1 — oc.5 |
Workflow
1. Gather inputs from the user. For each principle, ask about the controls:
Business Driven (bd.1 — bd.5): - bd.1 — Security strategy aligned with business objectives? - bd.2 — Security budget tied to business risk appetite? - bd.3 — Security metrics reported to business leadership? - bd.4 — Business impact analysis for OT systems completed? - bd.5 — Security requirements in OT procurement processes?
Risk Based (rb.1 — rb.5): - rb.1 — Risk-based security controls vs uniform application? - rb.2 — OT-specific risk assessment methodology in place? - rb.3 — Risk register maintained for OT assets? - rb.4 — Risk tolerance defined for safety-critical systems? - rb.5 — Regular risk reassessment schedule?
Enterprise Wide (ew.1 — ew.5): - ew.1 — Unified IT/OT security governance? - ew.2 — Cross-functional incident response team? - ew.3 — Enterprise-wide asset inventory including OT? - ew.4 — Consistent security policies across IT and OT? - ew.5 — Shared threat intelligence between IT and OT?
Methodical (m.1 — m.5): - m.1 — Documented OT security procedures? - m.2 — Change management process for OT systems? - m.3 — Regular security assessments and audits? - m.4 — Security awareness training for OT personnel? - m.5 — Lessons learned process from security incidents?
OT Security Focused (of.1 — of.5): - of.1 — OT-specific network segmentation (Purdue Model)? - of.2 — Industrial DMZ between IT and OT? - of.3 — OT-aware intrusion detection system? - of.4 — Secure remote access for OT systems? - of.5 — OT-specific vulnerability management?
OT Security Compliant (oc.1 — oc.5): - oc.1 — Compliance with IEC 62443? - oc.2 — NIST CSF implementation for OT? - oc.3 — Industry-specific regulations met (NERC CIP, etc.)? - oc.4 — Regular compliance audits? - oc.5 — Compliance documentation maintained?
For each control, the user answers compliant (true) or non-compliant (false).
2. Build the controls object from user responses:
{
"business_driven": [
{"controlId": "bd.1", "compliant": true},
{"controlId": "bd.2", "compliant": false},
{"controlId": "bd.3", "compliant": false},
{"controlId": "bd.4", "compliant": true},
{"controlId": "bd.5", "compliant": false}
],
"risk_based": [
{"controlId": "rb.1", "compliant": true},
{"controlId": "rb.2", "compliant": false}
]
}
3. Call the API:
curl -s -X POST "https://portal.toolweb.in/apis/security/ot-security-assessment" \
-H "Content-Type: application/json" \
-H "X-API-Key: $TOOLWEB_API_KEY" \
-d '{
"tier": "standard",
"controls": {
"business_driven": [
{"controlId": "bd.1", "compliant": true},
{"controlId": "bd.2", "compliant": false},
{"controlId": "bd.3", "compliant": false},
{"controlId": "bd.4", "compliant": true},
{"controlId": "bd.5", "compliant": false}
],
"risk_based": [
{"controlId": "rb.1", "compliant": true},
{"controlId": "rb.2", "compliant": false},
{"controlId": "rb.3", "compliant": false},
{"controlId": "rb.4", "compliant": true},
{"controlId": "rb.5", "compliant": false}
],
"enterprise_wide": [
{"controlId": "ew.1", "compliant": false},
{"controlId": "ew.2", "compliant": false},
{"controlId": "ew.3", "compliant": true},
{"controlId": "ew.4", "compliant": false},
{"controlId": "ew.5", "compliant": false}
],
"methodical": [
{"controlId": "m.1", "compliant": true},
{"controlId": "m.2", "compliant": false},
{"controlId": "m.3", "compliant": false},
{"controlId": "m.4", "compliant": false},
{"controlId": "m.5", "compliant": false}
],
"ot_security_focused": [
{"controlId": "of.1", "compliant": true},
{"controlId": "of.2", "compliant": false},
{"controlId": "of.3", "compliant": false},
{"controlId": "of.4", "compliant": true},
{"controlId": "of.5", "compliant": false}
],
"ot_security_compliant": [
{"controlId": "oc.1", "compliant": false},
{"controlId": "oc.2", "compliant": false},
{"controlId": "oc.3", "compliant": false},
{"controlId": "oc.4", "compliant": false},
{"controlId": "oc.5", "compliant": false}
]
},
"sessionId": ""
}'
Tip: You don't need to include all 6 principles — the API will score missing principles as 0%. Include what the user provides.
4. Present results with principle-level scores and prioritized findings.
Output Format
🏭 OT Security Assessment
━━━━━━━━━━━━━━━━━━━━━━━━━━━📊 Overall Compliance: [XX]%
Risk Level: [High/Medium/Low]
Total Controls: 30 | Compliant: [X] | Critical Gaps: [X]
📋 Principle Scores:
💼 Business Driven: [X]% (X/5)
⚠️ Risk Based: [X]% (X/5)
🏢 Enterprise Wide: [X]% (X/5)
📐 Methodical: [X]% (X/5)
🏭 OT Security Focused: [X]% (X/5)
✅ OT Security Compliant: [X]% (X/5)
🔴 Critical Findings:
[List highest-priority gaps with severity and recommendations]
📋 Priority Remediation:
1. [Most urgent fix] — Severity: Critical
2. [Next priority] — Severity: High
3. [Next priority] — Severity: Medium
📎 Full assessment powered by ToolWeb.in
Error Handling
TOOLWEB_API_KEY is not set: Tell the user to get an API key from https://portal.toolweb.inExample Interaction
User: "Assess the OT security of our manufacturing plant's control systems"
Agent flow: 1. Ask: "I'll assess your OT security across 6 principles with 30 controls. Let's go principle by principle: Business Driven: Is your security strategy aligned with business objectives? Do you have OT-specific business impact analysis?" 2. User responds for each principle 3. Map answers to control IDs and call API 4. Present overall score, principle breakdown, and critical findings
Pricing
About
Created by ToolWeb.in — a security-focused MicroSaaS platform with 200+ security APIs, built by a CISSP & CISM certified professional. Trusted by security teams in USA, UK, and Europe and we have platforms for "Pay-per-run", "API Gateway", "MCP Server", "OpenClaw", "RapidAPI" for execution and YouTube channel for demos.
Related Skills
Tips
⚡ When to Use
⚙️ Configuration
TOOLWEB_API_KEY — Get your API key from portal.toolweb.incurl must be available on the system