SCADA 360 Self Assessment

SCADA360 Survey
Name*

First NameLast Name
Title*
Company*
Company Email*
example@example.com
Hardware
My organization has PLCs, OITs, and other automation hardware with an end of sale date more than 1 year away. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization has switches, firewalls, and other networking hardware with an end of sale date more than 1 year away. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization has current server hardware with an end-of-sale date more than 1 year away. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization has current UPS hardware with an end of sale date more than 1 year away. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
UPS batteries are less than 5 years old, are on the correct maintenance schedule, and have the proper amount of charge and capacity. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization has work stations, thin clients, and related hardware/software with an end of sale date more than 1 year away. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization has active manufacturer support contracts for all critical infrastructure including PLCs, servers, switches, and instrumentation. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization has minimum 1 spare for each critical asset including PLCs, servers, switches, VFDs, breakers, and instrumentation. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
Software
My organization's server cluster is kept up-to-date with the latest stable firmware updates and builds. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization has a reliable system to monitor device statuses, collect logs, and manage software patches. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization has up-to-date, stable OITs. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization uses the most current supported version of our operating system. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization uses PLCs with the latest stable firmware and software build. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization uses an up-to-date SCADA software (SCADA, Historian, HMI, etc.) that is on the latest stable update and build. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
System Performance
My organization regularly audits all system alarms. Alarms are meaningful, trustworthy, and appropriately categorized. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization's network infrastructure is robust. It has enough speed and bandwidth for stable communication within and between sites including those with redundant PLC and I/O networking. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization's Historian collects all required tags at the proper resolution, has sufficient storage capacity for the retention period, and reliably captures data consistently over time. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization's Historian is properly integrated with reporting solutions that provide reliable, clear, and understandable reports to support data-driven decisions. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization's process can be fully controlled through the SCADA system. Little excessive manual operation of equipment is required for startup, shutdown, or routine tasks like backwashes. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization's SCADA system is reliable and relatively free of bugs, providing responsive control of our processes with high-performance graphics. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization's SCADA system maintains site-to-site consistency and logical navigation, adhering to established standards to ensure a uniform user experience. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
Documentation & Change Management
SCADA changes are tracked and documented with procedures for authorizing, executing, and deploying changes. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization maintains a SCADA master plan that is reviewed and updated at least every 5 years. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization maintains both physical and digital backups of all electrical drawings, operational specifications, training manuals, and related documentation, ensuring they are historized and easily accessible. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
I&C standards, P&IDs, and process control strategies are well documented and maintained. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
PLC cabinets and electrical panels are well-kept, clean, and up to code. Wires are labelled, and there is a copy of the latest as-built electrical drawings in the cabinet. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization's network infrastructure is well documented. (Networks, subnets, radios, switches, devices, etc.). (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization has developed and documented SCADA functional specifications including detailed definitions of functional requirements, process phases, control modules, and operator interfaces. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
SCADA standards have been established and documented to promote ease of use for operators and to accelerate development workflows, including coding conventions, interface design guidelines, and documentation practices. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
Disaster Recovery
My organization takes backups of key SCADA system configurations at least once a month and stores the backups securely off-site. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization takes backups of virtual machines at least once a month and stores the backups securely off-site. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization has a secure, off-site emergency operations center capable of continuous operations and prepared with copies of system operation and disaster response documentation. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization maintains historical and running configurations for all SCADA assets in an organized source control repository. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
Key staff members are trained or re-trained at least once per year on disaster response using formalized documentation. (Data loss, data breaches, retiring data/hardware, etc.). (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
OT Security
My organization has a properly configured SCADA domain with an organized Active Directory, effective security groups, and GPO's that are secure and functional. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization has a secure firewall, a DMZ that limits traffic to one "hop", and a segregated network with monitored switches. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
All points of entry to our network are secure (including remote sites), workstations require proper credentials to access, and staff take regular security trainings. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization uses multi-factor authentication and requires secure remote access methods, including VPNs with time- and access-based rules. Access to remote systems is limited strictly on an as-needed basis. (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
My organization has had a SCADA cybersecurity audit within the last two years and is aware of the latest guidance from industry and government cybersecurity experts (CISA/DHS, ISA, etc.). (Skip if unsure)

0

1

2

3

4

5

0 is Strongly Disagree, 5 is Strongly Agree
System Details
I have this many staff capable of programming PLCs or building SCADA screens.
I have this many sites.
I estimate that my overall automation system has this many inputs and output (I/O) signals.
I have approximately this many automation controllers (PLCs).
I use these brands or manufacturers of PLC hardware.
I have this many independent SCADA systems.
I use these SCADA software products.
I have approximately this many SCADA screens.
I have approximately this many SCADA tags.
I have approximately this many Historian tags.
I have approximately this many virtual machines.
Our operations are based here:

Street Address

Street Address Line 2

CityState / Province

Postal / Zip Code
I consent to receive email communications from Enterprise Automation, including my assessment results and other relevant information. I understand I can unsubscribe at any time.
Should be Empty:

SCADA360 Survey

Hardware

Software

System Performance

Documentation & Change Management

Disaster Recovery

OT Security

System Details