A single unsecured programmable logic controller (PLC) can disrupt a municipal water system. CISA recently alerted the Water and Wastewater Systems sector about increased targeting of PLCs. Threat actors have already modified passwords to lock out operators and changed IP addresses to disconnect PLCs, causing boil water notices and forcing manual operations.
This checklist helps you audit and secure your OT environment's external exposure before an incident forces manual operations on your team.
What This Checklist Covers
This security audit is for organizations operating PLCs and other OT assets in critical infrastructure. You'll identify internet-exposed devices, undocumented remote access points, and configuration gaps that create operational risk. The checklist addresses both known and shadow IT/OT connections, including cellular modems and vendor-installed remote access that may not appear in your asset inventory.
Prerequisites
Before starting this audit:
- Asset inventory access: Ensure you have current documentation of all PLCs, SCADA systems, and remote terminal units in your environment.
- Network scanning authority: Confirm you have authorization to scan external-facing IP ranges and cellular connections.
- Vendor contact list: Compile integrator and vendor contacts who may have installed remote access capabilities.
- Backup validation: Verify you have known-clean PLC images and configuration backups dated within the last 30 days.
What "good" looks like: You can produce a complete list of OT assets within 15 minutes, including devices installed by third parties, and you have documented approval for all external connections.
Security Audit Checklist
1. Identify All Internet-Exposed PLCs
Scan your external IP ranges for devices listening on common PLC ports (TCP 44818 for Ethernet/IP, TCP 502 for Modbus, TCP 102 for S7). Document every exposed device by IP address, make, model, and purpose.
What "good" looks like: Zero PLCs respond to external scans. Every PLC sits behind a VPN gateway or jump host with multi-factor authentication.
2. Inventory Cellular Modems and Out-of-Band Connections
Contact every system integrator and vendor who has worked on your OT environment in the past three years. Request documentation of any cellular modems, satellite links, or dedicated circuits they installed for remote access or monitoring.
What "good" looks like: You have a spreadsheet listing every cellular modem by IMEI number, carrier, installed location, and business justification, and each one requires VPN authentication before reaching any PLC.
3. Verify Password Protection on All PLCs
Test each PLC for password protection. Attempt connection with default credentials for the manufacturer (consult vendor documentation for defaults). Document which devices accept default passwords or have no password requirement.
What "good" looks like: Every PLC rejects connection attempts without a unique, complex password that differs from factory defaults and is stored in your privileged access management system.
4. Implement IP Allowlisting on Remote Access
For every PLC that requires remote access, configure IP allowlisting to permit connections only from known engineering workstations, maintenance laptops, or authorized SCADA servers. Block all other source IPs.
What "good" looks like: Your allowlist contains fewer than 10 IP addresses per PLC, each one tied to a specific device with documented ownership and a review date within the next 90 days.
5. Disconnect Direct Internet Access to PLCs
Remove any direct internet connectivity to PLCs. Reconfigure remote access to route through a VPN concentrator or secure gateway device. This applies to both TCP/IP connections and cellular modems.
What "good" looks like: External port scans return no responses from PLC IP addresses. All remote access requires VPN authentication with multi-factor authentication before reaching the PLC network segment.
6. Create Clean PLC Configuration Backups
Before making changes, export a clean configuration image from each PLC. Test the restoration process on a non-production device to confirm you can recover from a password lockout or configuration tampering.
What "good" looks like: You can restore a PLC to known-good configuration within 30 minutes without vendor assistance, and your backup files are stored offline in a secure location separate from the production network.
7. Document All External Connections in Your Attack Surface Inventory
Add every cellular modem, VPN endpoint, and remote access path to your formal attack surface inventory. Include the business justification, owner, review date, and decommission plan for each connection.
What "good" looks like: Your CISO can produce a complete external attack surface map in under five minutes, and every connection has a documented review within the last 90 days and a scheduled annual recertification.
8. Review Vendor Remote Access Agreements
Audit all vendor support contracts for remote access clauses. Identify vendors who maintain persistent connections to your OT environment. Require vendors to use your VPN infrastructure instead of direct device access.
What "good" looks like: No vendor has unmonitored direct access to PLCs. Every vendor connection generates a log entry, requires approval, and terminates after a defined maintenance window.
Common Mistakes
Assuming your integrator documented everything: System integrators often install cellular modems for troubleshooting convenience without updating your asset inventory. These devices bypass your network security controls entirely.
Treating all PLCs the same: A PLC controlling a non-critical pump station requires different security controls than one managing chemical dosing systems. Risk-rank your assets before applying uniform controls.
Skipping the backup test: Exporting a PLC configuration file isn't enough. If you can't restore it under pressure during an incident, the backup is worthless.
Relying on network segmentation alone: Air gaps and VLANs fail when a cellular modem creates a back door. You need to physically verify that no wireless connectivity exists.
Forgetting about serial-to-IP converters: These devices often run embedded web servers on default credentials and create an internet-accessible path to serial-connected PLCs.
Next Steps
After completing this checklist:
Prioritize remediation by operational impact. Disconnect internet-exposed PLCs controlling critical processes (water treatment, chemical dosing) before addressing monitoring-only devices.
Implement continuous monitoring for new external connections. Configure your vulnerability scanner to alert on any new internet-exposed OT devices.
Update your incident response plan to include PLC compromise scenarios. Your Computer Security Incident Response Team needs procedures for password lockouts and configuration tampering that differ from standard IT incident response.
Schedule quarterly reviews of your external attack surface. Vendors and integrators will install new remote access without notifying you. Assume it's happening and verify regularly.
Engage with CISA's regional office if you discover exposed PLCs and need remediation guidance. For Rockwell Automation MicroLogix 1400 controllers specifically, consult the vendor's password recovery notice before attempting restoration.
Threat actors targeting water systems aren't sophisticated; they're scanning for exposed PLCs and exploiting basic configuration gaps. Your advantage is that these attacks are entirely preventable with systematic asset management and access controls. Complete this checklist before your team issues a boil water notice.
