Critical Infrastructure Assessments
Inspect the OT/IT seam and the facility — before you buy another box.
Critical infrastructure assessments at SAINT are consulting engagements for environments where a plant floor, utility, civic facility, or clinical campus cannot treat IT and physical security as separate hobbies. We walk the boundary: who can reach the control network, how vendors dial in, where cameras and doors actually cover, and what a disruption would cost. We align the report to NIST SP 800-82, IEC/ISA 62443 concepts, NIST CSF, and CISA sector guidance. We do not program PLCs. We are not a certified 62443 or NERC CIP auditor. Huntress or Guardz may show up later on the IT side if you want us to operate detection — they are not the backbone of this assessment.
NIST 800-82 + IEC/ISA 62443 + CISA as reference — not claimed certifications
OT/IT boundary, remote vendor access, and physical coverage in one report
We segment and advise; your OT vendor stays on the control system
Labor, electrical, and low-voltage excluded from catalog planning totals
Capabilities
What a CI assessment includes
Showing OT/IT boundary review: Modern glass-walled office corridor with track lighting and a breakroom kitchen
Standards and guidance we write against
Reference frameworks for an MSP/physical+cyber shop. We will say when a finding needs a specialist auditor or your OT OEM.
- 01NIST SP 800-82Guide to ICS/OT security — primary industrial referenceReference
- 02IEC / ISA 62443Zoning, conduits, and industrial security concepts — not a claimed 62443 certReference
- 03CISA critical infrastructureSector resources and Cross-Sector Cybersecurity Performance GoalsReference
- 04NIST Cybersecurity FrameworkBusiness / IT overlay for Identify through RecoverReference
- 05DHS ISC / CISA physical securityFacility and physical-security practice referenceReference
Frequently asked
Do you support OT environments directly?+
We assess and help secure the boundary, the network, segmentation, remote access, and visibility. Your OT vendor remains responsible for the control system itself. We coordinate; we don’t pretend to be the OEM.
Are you a certified IEC 62443 or NERC CIP assessor?+
No. We align reports to those languages where they fit the site. Certified audits, CIP evidence packages for registered entities, and OEM assessments stay with the parties who actually hold those credentials.
How is this different from a physical security assessment?+
Physical assessments are facility walkthroughs (CPTED/ASIS-informed) that often lead to cameras and doors. CI assessments include that physical chapter when relevant and add OT/IT boundary, vendor remote access, and disruption risk. Start at /assessments if you’re unsure.
Is labor included in an online estimate?+
No. Site-wide: labor is not in catalog planning totals. Electrical / low-voltage / third-party contracting excluded unless quoted separately. Formal proposal after we see the site. /pricing.
Lincoln plants and Omaha-metro food/logistics — will you come on-site?+
Yes. Lincoln shops and south-Lincoln plants are a short drive from Hickman. Omaha-metro food, logistics, and yards (including Bellevue) are scheduled on-site. No storefront. /locations/lincoln-ne · /locations/omaha-ne.
Lincoln & Omaha — how this actually shows up locally
Lincoln, NE
Lincoln, NE hubLincoln plants, civic-adjacent sites, and south-Lincoln shops.
Lancaster County manufacturing and small-municipal environments get an OT/IT boundary review from a Hickman-based team that can actually walk the floor. Not a substitute for large state-agency procurement.
Omaha, NE
Omaha, NE hubOmaha-metro food, logistics, and multi-site yards.
I-80 / I-29 logistics, food processing, and a downtown office plus a Bellevue yard — one disruption picture, not two vendors. Scheduled on-site; no Omaha HQ claim.
Related
Keep going.
Ready to see where you stand?
A short call, an honest assessment, and a written plan. No pressure to switch providers if you’re already in good hands.
15 minutes. NIST-aligned report. No obligation.