Skip to content
MenuClose

Gap Analysis / Continuous OT Evidence & Assurance

Know what your water plant can prove. Find what it cannot.

Connect operational, engineering and cybersecurity evidence. Keep blind spots explicit. Ask for the proof needed next.

Assess a water / OT environment
Water plant / evidence surface Illustrative architecture
Water treatment plant, digital control and IQAI evidence assurance A simplified water process connects intake, treatment, pumping and distribution to sensors, PLCs, SCADA, network and cyber controls. These evidence sources feed IQAI Gap Analysis, which separates established facts from unknowns and evidence requests before human review. PHYSICAL PROCESS Intakeraw water Treatmentprocess Pumpingdelivery Distributionnetwork DIGITAL CONTROL Sensors PLC SCADA Historian CYBER / OPERATING CONTEXT Asset inventory OT monitoring Remote access Engineering IQAI Evidence Assurance known unknown request review
Physical water process Intake, treatment, pumping and distribution create the operating context that must ultimately be understood and protected.
01 / PHYSICAL

The plant comes first.

Intake, treatment, pumping and distribution define the real-world consequence.

02 / CONTROL

The plant has a digital nervous system.

Sensors, PLCs, SCADA and historian records observe and control the process.

03 / CYBER

Security adds another evidence surface.

Asset inventory, monitoring, remote access and engineering records shape what can be assessed.

04 / EVIDENCE

IQAI asks what all of it actually proves.

Known, inferred and unknown stay separate. Missing proof becomes a request, not an assumption.

Why it is needed

Visibility is not the same as understanding.

Device seen≠Asset identified
Signal captured≠Signal understood
Control documented≠Control verified
Alert available≠Conclusion established

Before teams can mitigate risk, they need to know what the available evidence actually establishes.

What Gap Analysis does

Turn blind spots into evidence requests.

Evidence workflowSynthetic example
Captured evidence01 / 04

A value was captured.

Test what that observation actually establishes.

Fictional operational recordFinding blocked

A captured display is evidence that something was shown. It is not proof of physical meaning or equipment condition.

Water plant example

One observation. Several unanswered questions.

OBSERVED Pump 04 RUN = 1 09:42 capture
UNKNOWN Identity signal meaning source time network relationship
EVIDENCE NEEDED Tag dictionary asset mapping source timestamp network record
FINDING BLOCKED until evidence is sufficient
Then Verify mapping → assess exposure → confirm controls → prioritize mitigation

Illustrative example. A gap does not prove a vulnerability. It shows what must be verified before a risk or mitigation decision can be relied on.

Where IQAI sits

Above the evidence. Alongside the security stack.

01 / Physical plant

Start with the real operating environment.

The evidence only matters in relation to the physical process, assets and consequences the team is responsible for.

IQAI roleContext boundary
Cybersecurity value

Expose what must be verified before mitigation.

GAPAsset identity unresolved
REQUESTAsset + network mapping
VERIFYExposure + control context
ACTIONPrioritize mitigation
GAPControl evidence incomplete
REQUESTConfiguration + approval record
VERIFYCoverage + authority
ACTIONRemediate or accept

Illustrative cybersecurity paths. IQAI does not treat an evidence gap as a detected threat or vulnerability.

Why the layer is different

OT security observes. IQAI controls the evidence-to-conclusion path.

OT SECURITYdiscover · monitor · detect
IQAIprovenance · sufficiency · review
TOGETHEREvidence-informed action
Assessment
OT security platform
IQAI Evidence Assurance
Primary jobAssessObserve / detect / scoreControl evidence → conclusion
Telemetry visibilityLimitedCore strengthConsumes evidence
Threat detectionNoCore strengthNot the role
Evidence provenanceVariableProduct specificCore control
Known / inferred / unknownVariableProduct specificExplicit state
Missing evidenceFollow-upWorkflow dependentStructured request
Finding sufficiencyReviewerProduct dependentExplicit gate
Human dispositionReportWorkflow dependentPreserved state

Generalized category comparison. IQAI is designed to sit above and alongside mature OT security, not replace discovery, monitoring or threat detection.

Retained demonstration

The workflow has been exercised, not only diagrammed.

67gap propositions
21outstanding evidence requests
0candidates passed sufficiency
Captured demonstration frame Not defect, vulnerability, client or installation counts
Recurring model

Not a report. A living assurance loop.

01Capture
02Assess
03Request
04Verify
05Review
Evidence changesRun again
01One plant
02OT assets
03Facilities
04Portfolio assurance
Who uses it

One evidence layer. Different responsibilities.

OPERATIONSWhat is actually known about the plant?
CYBERSECURITYWhat blind spots affect risk assessment?
ENGINEERINGWhich mappings and records are missing?
ASSURANCEWhat evidence supports the conclusion?
Current maturity

Working, demonstrated and still to validate.

WORKING
  • Evidence links
  • Unknown register
  • Evidence requests
  • Review history
  • Finding gate
  • Ledger export
DEMONSTRATED Captured public water-monitoring evidence workflow Retained review and replay evidence
TO VALIDATE
  • Additional connectors
  • Additional domains
  • Production-scale deployment
  • Authenticated approval authority
Bring us one unresolved operational question.

Start with the gap.

Assess a water / OT environment → Discuss an OT-security integration → Review the evidence & market context →