Skip to content
OTReadyFree calculator

OT cybersecurity assurance platform

Architecture-aware OT cybersecurity assurance.

OTReady connects OT architecture, IEC 62443 and NIS2 assessments, governed Findings, Evidence, remediation and issued reporting in one traceable platform, so an assessment result always points back to the part of the plant it is actually about.

Calculate your assurance cost — freeRequest a demoExplore the platform

No account required to start.

  • Architecture-aware
  • Assessment-first
  • Vendor-neutral
  • Connected Assurance optional

Build the business case with your own numbers

Start with the free OT Assurance Cost Snapshot, then continue into the full OTReady business case and OT cyber-risk ROSI model.

All three calculators are free. No account or login required.

Start immediately with the Cost Snapshot. Leave your work details once to unlock both advanced tools.

  1. 01

    Assurance Cost Snapshot

    • Free starting point
    • Anonymous
    • Current assurance effort/cost
  2. 02

    OTReady Business Case

    • Hard cash case
    • Released specialist capacity
    • Break-even / multi-year economics
  3. 03

    OT Cyber Risk & ROSI

    • ALE before/after
    • Avoided expected loss
    • ROSI
Start with the free cost snapshotCompare all three calculators

Verticals

Your sector. Your terminology. Your architecture.

OTReady is not a per-sector product with six separate editions. It is one model that carries your sector's context, domains and vocabulary, with demonstrated use cases where we have built them, and honest labels where we have not.

Start blank, and the platform still works the same way.

  1. Start blank
  2. Define your Sector Context
  3. Define your OT Domains
  4. Build or import your Architecture
  5. Run the same assessments, assurance, remediation and reports

The OTReady approach

From OT architecture to assurance.

Most OT security tooling starts at the questionnaire. OTReady starts one step earlier, at the architecture the questions are about, so every risk, requirement, Finding and remediation task stays attached to a real Site, Zone, Conduit or Channel.

  1. 01

    Context

    Sector context, OT domains and the entity's own terminology.

  2. 02

    Architecture

    Sites, Zones, Subzones, Conduits and Communication Channels.

  3. 03

    Risk

    Initial screening and IEC 62443-3-2 risk scenarios.

  4. 04

    Targets

    Target Security Levels proposed, then explicitly confirmed.

  5. 05

    Assessments

    IEC 62443-3-3, NIS2 Quick Scan and NIS2 Full Readiness.

  6. 06

    Findings & Evidence

    Governed Findings, each with its evidence and provenance.

  7. 07

    Remediation

    Treatment, tasks, review and governed closure.

  8. 08

    Reports

    Human-readable reports, issued as immutable versions.

Connected AssuranceConfigurableOptional enrichment from NDR/IDS, SIEM, CMDB or your own API. An observation is evidence that a source reported something, never approved architecture, and never a Finding on its own.

Architecture

Architecture is the context assessments should refer to.

An assessment result that cannot name the zone it applies to is difficult to defend and impossible to maintain. OTReady models the plant first, as canonical objects with stable identity, and every later judgement targets one of them.

  1. Site
  2. Zone / Subzone
  3. Conduit
  4. Communication Channel
  • Sites, Zones and Subzones with their own canonical identity
  • Purdue level as an architecture classification, never as a Security Level
  • Conduits between scopes, and the Communication Channels inside them
  • Assets, interfaces and locators
Explore Architecture

A Conduit is not a Communication Channel.

Conduit

The security relationship between two scopes.

Communication Channel

The actual communication carried inside that Conduit: protocol, direction, medium and whether encryption was recorded.

The OTReady architecture explorer showing zones and subzones for a manufacturing site, with the conduits recorded between them drawn as selectable connections.
Zone & Conduit lens: the same canonical objects, viewed by relationship.

Assessments

The assessments an OT asset owner actually has to run.

Four assessment modules, each scoped to the architecture you have already modelled. Partial assessment is a deliberate strength: start with one and it unlocks what it legitimately can.

  • IEC 62443-3-2

    Available

    Risk assessment for the zones and conduits in scope.

  • Target Security Levels (SL-T)

    Available

    A proposal is not a decision. A target becomes authoritative only when someone confirms it.

  • IEC 62443-3-3

    Available

    System requirements, assessed project-wide or against one scope.

  • NIS2

    Available

    A short Quick Scan, or the full evidence-gated readiness assessment.

PlannedNERC CIPNIST CSFCustom Assurance Profile

OTReady produces readiness and audit-ready evidence. It is not a certification body, and no score, mapping or issued report constitutes legal compliance.

See the assessmentsComing soon
The OTReady IEC 62443-3-3 assessment workspace, listing requirements grouped by foundational requirement with their recorded status.
IEC 62443-3-3: requirements filtered by the confirmed Target Security Level.
The OTReady assurance cockpit listing dimensions such as OT architecture, initial cyber risk and NIS2, each with a status band and a written explanation.
Each dimension names its reason, and links straight to the affected objects.

Assurance

One derived reading of what this project has been asked, and what it could answer.

The cockpit is assembled fresh on every view and is never stored. It reports the worst single dimension rather than an average, and it deliberately produces no score: one number would let a well-modelled architecture compensate for a risk posture nobody has assessed.

  • Normal
  • Attention
  • Degraded
  • Critical
  • Unknown

Unknown is never a quiet Normal, and a technical read failure is never dressed up as Unknown. A broken read is reported loudly as a defect, because a grey panel over an outage is the most convincing wrong answer a dashboard can give.

See how assurance works

Remediation

Turn Findings into governed remediation work.

A Finding that nobody owns is a Finding that survives to the next audit. OTReady carries a Finding through an explicit treatment decision into tracked work, and closes it only when the work has actually been reviewed.

  1. Finding
  2. Treatment
  3. Task
  4. Assigned
  5. Awaiting review
  6. Approved
  7. Finding closure
See remediation

OTReady has no native ticketing integration today. Work is tracked on its own board; a generic API path exists for connecting other systems.

The OTReady remediation board showing tasks in columns by status, filtered to a single framework.
One board, filtered by framework; a task belongs to exactly one.

Import & Integrations

Your architecture already exists. Bring it in without retyping it.

Most asset owners already hold their architecture in a spreadsheet, a CMDB export or an engineering list. OTReady imports it through a review queue, because a file is an observation about a plant, and only a person can turn that into agreed architecture.

  1. 01

    Upload

    CSV or Excel, read without silent truncation.

  2. 02

    Map

    Your columns, mapped to canonical fields.

  3. 03

    Preview

    See what would be created before anything is.

  4. 04

    Candidates

    Every row becomes a reviewable candidate, including the invalid ones.

  5. 05

    Review

    Accept, correct, reject, or resolve a match.

  6. 06

    Accept

    Acceptance is the only step that writes canonical architecture.

The OTReady import and review screen, showing imported architecture candidates awaiting a human accept or reject decision.
Nothing reaches the architecture until a person accepts it.

Connected Assurance: optional enrichment

  • NDR / IDS
  • SIEM
  • CMDB
  • API / Other
PlannedIEC 61850 SCD import wizard · MVP2Native Nozomi connectorNative Claroty connectorNative Dragos connectorNative ServiceNow connector

No native vendor connector exists today. The planned items above are named as intentions, not as partnerships or endorsements.

See import & integrationsComing soon
An issued OTReady project report rendered as a document, with its version and issue details.
Issued reports keep their version, digest and issuer.

Reports & governance

A report someone keeps should still say the same thing next year.

OTReady issues reports as immutable versions. Correcting something produces version 2; version 1 remains exactly what it was, because a document that quietly rewrites itself is worse than no document.

  • Full Project Report
  • NIS2 Audit Pack
  • IEC 62443-3-2 Report

Issued means frozen. An issued version records its number, its digest, who issued it and when.

GovernancePeople & AccessGrants and restrictionsAudit History
See reports & governance

Understand. Assess. Assure.

Bring structure to OT cybersecurity assurance.

See OTReady against your own architecture: your sites, your zones, your conduits, and the assessments you are actually being asked for.

Request a demoStart assessmentContact us