OT cybersecurity for plant management: a 25-question self-assessment and a 12-month roadmap
IEC 62443, NIS2 and the SPRI grant explained for whoever is accountable for production
OT & Industrial
OT cybersecurity for plant management: a 25-question self-assessment and a 12-month roadmap
A guide for whoever is accountable for keeping the line running: plant management, maintenance and process engineering. It includes a 25-question self-assessment in five blocks (inventory, network and segmentation, access, detection and response, recovery and suppliers), a 12-month roadmap ordered by risk of downtime, a short explanation of what IEC 62443 and NIS2 ask for, and the facts on the SPRI Industrial Cybersecurity 2026 grant, subject to the rules of the call. October 2026 edition, version 1.0.
Contents / Contenido
- 1. Who it is for and what you getPreview
- 2. Why OT is different from ITPreview
- 3. What IEC 62443 is and what it asks of youPreview
- 4. What NIS2 asks of an industrial companyRequires download
- 5. Self-assessment: 25 questionsRequires download
- 6. 12-month roadmapRequires download
- 7. The open SPRI grant: Industrial Cybersecurity 2026Requires download
- 8. How Hodeitek helpsRequires download
- 9. SourcesRequires download
Preview: first pages
A guide for whoever is accountable for keeping the line running: plant management, maintenance and process engineering. It includes a 25-question self-assessment in five blocks (inventory, network and segmentation, access, detection and response, recovery and suppliers), a 12-month roadmap ordered by risk of downtime, a short explanation of what IEC 62443 and NIS2 ask for, and the facts on the SPRI Industrial Cybersecurity 2026 grant, subject to the rules of the call. October 2026 edition, version 1.0.
The preview of this whitepaper includes the executive summary, regulatory context and methodological approach that frames the rest of the document. Download to access full templates, matrices and checklists.
- 1. Who it is for and what you get
- 2. Why OT is different from IT
- 3. What IEC 62443 is and what it asks of you
Gorka Gonzalo
Founder & CEO
Founded Hodeitek in 2023 and runs the company, after more than 8 years in pentesting, Red Team, OT/ICS auditing, and SOC leadership. A cybersecurity and AI expert, he sets the technical and product direction of HodeiShield and personally leads the most critical engagements — from defense strategy to applying AI in threat detection. He is the client's direct point of contact: whoever scopes the work also answers for the result.
Related resources
NIS2 Supply Chain Guide: From Art. 21 to the Provider Register
Article 21.2.d of NIS2 requires essential and important entities to manage the security of their direct suppliers and service providers as part of their risk management policy. This guide explains what the article actually requires, how it relates to the ENS and DORA, and proposes a phased implementation plan with checklists and a reusable supplier assessment questionnaire template.
How to Choose a TPRM Platform: Criteria for 2026
NIS2, DORA and the ENS all agree that provider risk cannot be outsourced away by subcontracting the service, which turns third-party risk management (TPRM) into a mandatory compliance function. This document explains what each framework requires on third parties, the five criteria blocks that separate a functional TPRM platform from the rest, and provides a reusable evaluation matrix for RFP/RFI processes.