Skip to content
VETERAN-OWNED · NEBRASKA-BASED
Incident now?(531) 625-2113
SAINT signature logo
Free Assessment
Data-center server racks with yellow and blue fiber cabling and green status lights

Critical Infrastructure Assessments

Inspect the OT/IT seam and the facility — before you buy another box.

Critical infrastructure assessments at SAINT are consulting engagements for environments where a plant floor, utility, civic facility, or clinical campus cannot treat IT and physical security as separate hobbies. We walk the boundary: who can reach the control network, how vendors dial in, where cameras and doors actually cover, and what a disruption would cost. We align the report to NIST SP 800-82, IEC/ISA 62443 concepts, NIST CSF, and CISA sector guidance. We do not program PLCs. We are not a certified 62443 or NERC CIP auditor. Huntress or Guardz may show up later on the IT side if you want us to operate detection — they are not the backbone of this assessment.
NIST 800-82 + IEC/ISA 62443 + CISA as reference — not claimed certifications
OT/IT boundary, remote vendor access, and physical coverage in one report
We segment and advise; your OT vendor stays on the control system
Labor, electrical, and low-voltage excluded from catalog planning totals
Schedule CI AssessmentCheck Your Risk Score — Free, ~4 Minutes531-625-2111

Capabilities

What a CI assessment includes

  • 01

    OT/IT boundary review

    Where the plant, SCADA, or building-management network meets business IT. Flat VLANs, shared jump hosts, and “the vendor VPN that never got turned off” are the usual findings. We document; we do not rewrite ladder logic.
  • 02

    Remote vendor and remote-access paths

    Who can reach engineering workstations, how MFA is (or isn’t) applied, and whether a phished mailbox can become a path onto the floor. Email/BEC on the business side is in scope when it can touch operations — see /email-security for the program, not as a substitute for this assessment.
  • 03

    Physical + cyber together

    Gates, control rooms, yards, and after-hours exposure belong in the same threat picture as the network. For a clinic or office-only walkthrough, start at /physical-security-assessments. This page is for sites where disruption has public or production consequences.
  • 04

    Framework alignment (honest)

    NIST SP 800-82 for industrial control systems, IEC/ISA 62443 concepts for zoning and conduits, NIST CSF for the business overlay, CISA Cross-Sector CPGs and sector resources. DHS ISC / CPTED language for the physical chapter where it fits. Alignment and a gap list — not a certified-assessor stamp.
  • 05

    What this is not

    Not PLC programming. Not a NERC CIP audit we can sell. Not AWIA certification for a water system. Not a camera BOM on day one. Not Huntress-as-the-engagement. Quotes exclude labor, electrical, and third-party contracting unless separately documented.
  • 06

    Handoff options

    A prioritized spend plan. Optional design and project management for network segmentation, access, or cameras (Verkada, UniFi, Salient when they fit). Optional IT-side detection with Huntress or Guardz — pick one stack. Optional vCISO if leadership needs a retainer after the report.

Standards and guidance we write against

Reference frameworks for an MSP/physical+cyber shop. We will say when a finding needs a specialist auditor or your OT OEM.
Schedule CI AssessmentCheck Your Risk Score — Free, ~4 Minutes531-625-2111

Frequently asked

Do you support OT environments directly?+
We assess and help secure the boundary, the network, segmentation, remote access, and visibility. Your OT vendor remains responsible for the control system itself. We coordinate; we don’t pretend to be the OEM.
Are you a certified IEC 62443 or NERC CIP assessor?+
No. We align reports to those languages where they fit the site. Certified audits, CIP evidence packages for registered entities, and OEM assessments stay with the parties who actually hold those credentials.
How is this different from a physical security assessment?+
Physical assessments are facility walkthroughs (CPTED/ASIS-informed) that often lead to cameras and doors. CI assessments include that physical chapter when relevant and add OT/IT boundary, vendor remote access, and disruption risk. Start at /assessments if you’re unsure.
Is labor included in an online estimate?+
No. Site-wide: labor is not in catalog planning totals. Electrical / low-voltage / third-party contracting excluded unless quoted separately. Formal proposal after we see the site. /pricing.
Lincoln plants and Omaha-metro food/logistics — will you come on-site?+
Yes. Lincoln shops and south-Lincoln plants are a short drive from Hickman. Omaha-metro food, logistics, and yards (including Bellevue) are scheduled on-site. No storefront. /locations/lincoln-ne · /locations/omaha-ne.

Lincoln & Omaha — how this actually shows up locally

  • Lincoln, NE

    Lincoln plants, civic-adjacent sites, and south-Lincoln shops.

    Lancaster County manufacturing and small-municipal environments get an OT/IT boundary review from a Hickman-based team that can actually walk the floor. Not a substitute for large state-agency procurement.

    Lincoln, NE hub

  • Omaha, NE

    Omaha-metro food, logistics, and multi-site yards.

    I-80 / I-29 logistics, food processing, and a downtown office plus a Bellevue yard — one disruption picture, not two vendors. Scheduled on-site; no Omaha HQ claim.

    Omaha, NE hub

Related

Keep going.

Ready to see where you stand?

A short call, an honest assessment, and a written plan. No pressure to switch providers if you’re already in good hands.
Get Your Free Security & IT AssessmentCheck Your Risk Score — Free, ~4 Minutes531-625-2111

30 minutes. NIST-aligned report. No obligation.