Every tier is the same CASTLE™ / IEC 62443 methodology at greater depth. See exactly what each package includes, then book a scoping call to size the right entry point.
| Capability |
Tier 1
OT Recon
|
Tier 2
OT Foundations
|
Tier 3
OT Fortified
|
Tier 4
OT Stronghold
|
|---|---|---|---|---|
| Best for | First-look triage | Your first real baseline | Audit & insurance proof | Continuous assurance |
| Discovery & visibility | ||||
| OT asset discovery & inventory | Partial | Full | Full | Continuous |
| Network & dataflow mapping | Snapshot | Documented | Validated | Monitored |
| Connectivity & remote-access review | High-level | Reviewed | Tested | Watched |
| Architecture & exposure | ||||
| Architecture & secure design review | High-level | Standard | Deep | Ongoing |
| IEC 62443 zones & conduits modeling | Sketch | First-pass | Full model | Maintained |
| Exposure & attack-path analysis | — | Basic | Full | Continuous |
| Risk & compliance | ||||
| Validated vulnerability assessment (not scan-only) | Triage | Validated | Prioritized | Continuous |
| NIST control alignment & gap ID | — | Gap list | Full mapping | Maintained |
| IEC 62443-3-2 cyber risk assessment | — | — | Full | Recurring |
| Compensating controls for legacy systems | — | Recommended | Designed | Managed |
| Compliance evidence package (CMMC / SOC 2) | Add-on | Add-on | Add-on | Included |
| Validation & resilience | ||||
| Control-effectiveness validation (live) | — | — | Validated | Continuous |
| Exploit validation / OT-safe pen test | Add-on | Add-on | Add-on | Included |
| Tabletop exercise | Add-on | Add-on | Included | Included |
| Remediation sprint | Add-on | Add-on | Add-on | Included |
| Reporting & leadership | ||||
| Executive risk reporting | Snapshot | Standard | Board-ready | Quarterly |
| Technical findings & remediation roadmap | Brief | Roadmap | Detailed | Tracked |
| Remediation support | — | — | Optional | Included |
| Reassessment & recertification | — | — | — | Annual |
| You walk away with | Your top risks, ranked | Baseline + a roadmap | A defensible 62443 risk model | A managed OT program |
Any capability marked Add-on can be attached to a lower tier without upgrading.
Tangible artifacts you keep, not just a verbal debrief:
Start with OT Recon and step up as your risk requires. The Recon fee can credit toward an upgrade. We'll help you scope the right entry point on a short call.