Is this the right starting point?
Good fit
Organizations that need coordinated progress across multiple OT cybersecurity workstreams.
What you receive
An agreed program structure connecting priorities, owners, delivery, and evidence of progress.
Operating boundary
Workstreams, milestones, and responsibilities are defined in the program scope.
A maturity score is only worth reporting if a level means the same thing this quarter as last. Select a domain to see the five descriptors and the evidence required to claim each one.
Scope
Six areas of work, run on a repeating cycle.
Each one exists to make the next measurement comparable to the last. A program that changes its method between cycles cannot demonstrate improvement, only activity.
Maturity baseline against a repeatable method
Current capability scored across governance, architecture, access, detection, response and recovery, using a defined scoring method with written evidence rules. The method is fixed at the start of the program and does not change between cycles. That constraint is what makes a later score mean something rather than reflect a different assessor's judgment.
Governance design and decision rights
Who decides, who is consulted, who owns each capability, and what escalates. Defined for the boundary cases that actually stall programs: an IT change that touches a process network, a vendor access request outside the agreed route, a finding that competes with a production commitment. Decision rights are written down, not inferred from an organization chart.
A funded, owned improvement plan
The remediation and capability backlog sequenced with dependencies made explicit: what has to be in place before the next item can start, what each item will disrupt, which maintenance window it needs, and which vendor agreement it touches. Every item carries a named owner and a funding position. Items with neither are recorded as unfunded rather than tracked as though they were live.
Operational risk register, maintained and reported
Risk expressed in operational terms an engineering manager recognizes and a board can act on: which function is exposed, what the credible consequence is, what compensates for it today, and what would close it. Maintained as a living record between cycles, not rebuilt from scratch each time someone asks for it.
Exercises and re-validation on the calendar
Tabletop exercises, response walkthroughs and re-validation of previously remediated findings scheduled into the annual cycle rather than triggered by an incident or an audit letter. Re-validation matters most: controls drift as systems are patched, replaced and reconfigured, and a finding closed two years ago is not evidence of a control working today.
Quarterly re-measurement and board-level reporting
The baseline re-scored each quarter with the same method, and reported at two levels: a technical view your engineering and security teams can work from, and a leadership view showing direction of travel, what moved, what did not, and what decision is now required. Movement is attributed to specific work, so reporting survives a challenge.
A number produced a different way is not progress. It is a different number.
How the measurement holds up
A score is only useful if it was produced the same way twice.
These are the conditions that make quarterly comparison defensible. They are agreed in the program definition before the first baseline is taken.
- Method fixed at the outset — scoring criteria and evidence rules do not change mid-program
- Evidence-based scoring — a capability is credited on observed evidence, not on intent or procurement
- The same collection method every cycle — OT-native tools on the production network, configured the same way each quarter so scores stay comparable
- Scores validated with your team — before any figure reaches a leadership pack
- Ownership stays with you — we run the cadence and the measurement; accountability remains with the asset owner
Fit
When this is the right engagement, and when it is not.
Use R.I.S.E. 360™ when
- You have a funded program running and no reliable way to show whether it is working.
- Leadership asks for progress and receives a list of completed activities rather than a change in position.
- Improvement work is happening across several sites with no common measure of where each one stands.
- Decision rights between IT, OT, engineering and security are unclear, and work stalls at the boundary.
- A regulator, insurer or board requires demonstrable and repeatable oversight rather than a point-in-time report.
- Findings from a previous assessment were closed, and nobody has confirmed they are still closed.
Start with another service when
- There is no program yet. Start with GoSecure™ to set the priorities the program will run.
- The real constraint is delivery capacity. Our engineers deliver the remediation work through AKTSecure™, alongside the program.
- Nobody internally can yet own the cadence. OT CISO Advisory can support the accountable executive while an owner is appointed and prepared.
- An incident is in progress. Email info@innovakt.com with “OT incident” in the subject rather than using the form. We confirm quickly how we can support, working under your operational authority, and the program follows once the plant is stable.
Framework alignment
Structured to report in the language your leadership already uses.
Program structure and governance language follow NIST CSF 2.0, including its Govern function. It is the most widely recognized vocabulary for describing capability, ownership and direction of travel to a board, and it maps cleanly onto quarterly reporting.
The technical baseline is scored against ISA/IEC 62443, because zones, conduits, security levels and capability requirements are the terms your engineering teams and your industrial vendors already share. This is what keeps the measurement anchored to the plant rather than to a management model.
Compliance sits underneath both as a floor, expressed against whichever regime actually governs you. No customer is measured against every framework we work with. The regulatory obligation is established during scoping and reported as a baseline to clear, not as the objective of the program. Compliance demonstrates alignment. It does not demonstrate operational readiness.
Outcomes
What is different in the organization afterwards.
Progression that can be compared
A position this quarter that can be set beside the last one, because the method behind both was identical. Direction of travel becomes a fact rather than an impression.
Decisions that stop stalling
Named decision rights at the IT, OT and engineering boundary, so work that used to wait for a forum to form has a route and an owner already defined.
Reporting that survives challenge
Movement attributed to specific work with evidence attached, which holds up in front of a board, an insurer, an auditor or a regulator without a supporting explanation.
Controls confirmed, not assumed
Previously closed findings re-validated on a schedule, so drift is found during a planned cycle rather than during an incident or an audit.
Deliverables
What you receive, in writing.
Exact contents and cycle length are agreed in scoping. These four are present in every program.
Maturity baseline and scoring method
The opening position across every measured domain, together with the written scoring criteria and evidence rules that will be reapplied unchanged at each re-measurement.
Governance model and cadence
Decision rights, ownership map, forum structure, escalation routes and meeting cadence, defined for the boundary cases where accountability is usually ambiguous.
Sequenced improvement plan
The backlog ordered by operational consequence, with dependencies, owners, funding position, operational impact and required maintenance windows attached to each item.
Quarterly progression report
Re-measured scores, movement attributed to specific work, the maintained risk register, exercise and re-validation results, and the decisions now required from leadership.
Engagement process
Five steps, then the cycle repeats.
Cycle length is normally quarterly. Site count, estate complexity and reporting obligations determine effort, and scoping establishes it before any commitment is made.
Method and baseline agreement
Scoring domains, criteria, evidence rules and reporting audiences defined and signed off. This is the step that determines whether every later measurement is comparable, so it is settled in writing before any scoring takes place.
Opening measurement
The baseline scored through documentation review, configuration evidence, interviews with engineering, operations and security, and observation within agreed windows. Collection uses OT-native tools built for production networks, under your permit and supervision arrangements.
Governance design and stand-up
Decision rights, ownership and cadence agreed with the people who will hold them, then run live for the first cycle with us in the room. A governance model that has never been exercised is a document, not a capability.
Cycle execution
The improvement plan worked through your change control, maintenance windows and vendor agreements, with exercises and re-validation run on the dates already in the calendar rather than fitted in around them.
Re-measurement and reporting
The same method reapplied, results validated with your technical team, then presented at both technical and leadership level. The next cycle's plan is set in the same session, with owners confirmed.
Questions we are actually asked
What gets asked before an organization commits to a quarterly cadence.
Is this just another maturity score?
It is a maturity score, and on its own that would be worth very little. A number nobody is expected to move is a reporting exercise, and most organizations already have one filed somewhere.
Three things make it different in practice. The method and evidence rules are fixed at the outset and reapplied unchanged, so this quarter can be set against last quarter. A capability is credited on observed evidence rather than on intent or procurement. And movement is attributed to specific work, so a claimed improvement can be traced to the change that produced it and challenged if it cannot.
Who is actually doing the work between cycles, you or us?
Either, and usually both. We run the measurement, the governance forums and the reporting, and our engineers can deliver the remediation and capability work alongside your teams and integrators, through your change control and your maintenance windows. The split is set in the program definition, around the capacity you have and the capacity you want to build.
What stays with you is ownership: a named internal owner takes the decisions and accepts the results between our visits. Until that person is appointed, OT CISO Advisory supports the executive who holds the risk.
Can we compare our score against others in our sector?
Yes, against a named framework rather than a peer average, and the reason is worth knowing. Scoring methods differ, evidence thresholds differ, estate scope differs, and an organization that scores itself generously is not comparable to one scored on observed evidence. A cross-company figure presented as a benchmark usually compares assessors rather than organizations.
The comparison that holds is your position against your own previous position, produced by the same method. Where a regulator, insurer or parent company requires an external reference point, we will report against the framework they name rather than against an invented peer average.
What happens if the score goes down?
It sometimes does, and the reason is usually one of three. A capability credited on intent at baseline is re-scored on evidence once that evidence is looked for. The estate grew through an acquisition, a new unit or a migration, and the denominator changed. Or a previously closed finding was re-validated and found to have drifted.
A method that cannot record a decline cannot credibly record an improvement either. We will not adjust the method to protect a trend line, and we will tell leadership which of the three causes applies, because the required response is different in each case.
Our board only wants one number.
You can have one, on the condition that it can be taken apart. The leadership view is deliberately short: direction of travel, what moved, what did not, and the decision now required. Underneath it sits the domain detail and the evidence, available the moment a director asks what the number is made of.
What we will not produce is a single figure with nothing behind it. That number survives exactly one informed question, and it usually gets asked by an auditor rather than by a friendly board member.
Can we run this ourselves after the first year?
That is the intent, and the method is written to make it possible. Scoring criteria, evidence rules, forum structure and the reporting format are documented and handed over, and the governance is run live with your people holding it rather than observing it.
One honest caveat. Part of what makes the measurement acceptable to an insurer, an auditor or a parent company is that it was produced independently of the team being measured. Moving it in-house is the right outcome for cost and for ownership, and it changes who will accept the result. Some organizations keep an external re-measurement annually for that reason alone.
Next step
Take one baseline before committing to a cycle.
A single measurement against an agreed method establishes the starting position, the effort involved and the value of the reporting, before any recurring commitment is made. Innovation in Aktion begins with a number you can defend.
- Method agreed in writing — before the first score is recorded
- OT-native data collection — solutions built for production networks, alongside evidence review
- Vendor-neutral measurement — nothing we score earns us a margin
- Ownership stays internal — we run the cadence, your organization owns the program
Questions buyers ask
The three things we are asked before we start.
What is R.I.S.E. 360™?
R.I.S.E. 360™ is InnovAKT's cyber resilience program for industrial organizations: the discipline of continuing to operate through a cyber event and recovering deliberately afterwards. It covers response, incident readiness, recovery of control systems, and the exercises that prove the plan works before it is needed.
How is resilience different from prevention?
Prevention tries to stop the event. Resilience assumes one will eventually happen and asks what the plant does then: whether the process can be run degraded, whether the control system can be rebuilt, how long that takes, who decides to stop production, and how the organization communicates while it is happening. Industrial organizations are usually further ahead on the first than on the second.
Does R.I.S.E. 360™ include tabletop exercises?
Yes, and they run with operations in the room, not only IT and security. An industrial cyber exercise that does not involve the shift supervisor, the plant manager and the engineering lead tests the wrong decisions. InnovAKT also tests recovery in practice — whether a controller can actually be restored from the backup the organization believes it has.