BOOT-OT Reading Guide
How to use this reading guide
This is the concept-review layer for a 100% online course. Read each module before its lesson, complete the retrieval prompts without looking, then use the linked authoritative sources to verify project-specific editions, requirements, and manufacturer procedures.
Online evidence is not OJL: browser simulations, document cases, and isolated remote equipment build reasoning and documentation skill; supervised field performance is recorded separately.
OT mission, consequences, governance, scope and lab ethics
Why it matters: OT security serves safe reliable operation; technical curiosity, tool capability, or an alert does not create authority.
Vocabulary and working scope
Building mission; comfort/process/safety/energy; availability/integrity/confidentiality; roles; owner; authority; rules of engagement; scope; consequence; communication; stop; evidence handling.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A suspected controller compromise is reported during extreme weather, but ownership and shutdown consequences are unclear.
Calculation: Calculate qualitative/quantitative risk from supplied criteria, scope coverage, decision windows, and consequence-weighted priorities.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Asset, software, data and dependency inventory
Why it matters: An IP scan alone cannot establish a safe OT inventory; passive evidence, project records, platform data, owner confirmation, and functional dependencies must reconcile.
Vocabulary and working scope
Device/host/network/service/software/firmware/license; identity; owner; location; role; criticality; exposure; communication peers; data; backup; support; lifecycle; hidden dependencies.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A supervisor replacement fails because certificate, license, DNS, history, and third-party integration dependencies were absent from inventory.
Calculation: Calculate inventory coverage/confidence, unsupported assets, ownership gaps, dependency coverage, and backup readiness.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Current/future architecture, zones, conduits and blast radius
Why it matters: Segmentation is a risk and consequence design, not merely more VLANs; required operations and recovery paths must remain explicit.
Vocabulary and working scope
Enterprise/DMZ/OT/control zones; VLAN/subnet; routing/firewall; wireless/remote; management plane; trust; required conduits; physical process; redundancy; single points; migration.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A flat BAS network includes workstations, JACEs, controllers, vendor access, and historian traffic with no documented trust boundary.
Calculation: Calculate subnet plans, asset/flow counts by zone, single-point and blast-radius measures, migration stages, and rollback points.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Identity, RBAC, service accounts, certificates and secure remote access
Why it matters: Remote connectivity is not standing permission; shared accounts and indefinite broad access defeat attribution and containment.
Vocabulary and working scope
Named users; roles; least privilege; service accounts; MFA where supported; certificate identity/lifecycle; joiner/mover/leaver; vaulting; Neeve session; target/action/time; approval; logging; revocation.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A vendor needs two-hour read-only access to one training JACE, but the current method uses a shared admin account and open VPN.
Calculation: Calculate entitlement coverage, privileged/shared accounts, session duration/expiry, revocation time, certificate renewal window, and audit completeness.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Supported hardening and operational validation
Why it matters: A checklist is not acceptance; hardening must be supported, authorized, operationally tested, documented, and recoverable.
Vocabulary and working scope
Controllers; supervisors; switches; firewalls; workstations; services/ports; defaults; users; certificates; secure protocols; patch/version; application allowlisting awareness; time/logging; compensating controls; vendor support.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A disabled legacy service closes exposure but breaks graphics and alarm delivery after restart.
Calculation: Calculate baseline/compliant/exception coverage, required-function pass rate, residual exposure, change/rollback time, and monitoring window.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Required-flow rules, routing, NAT, broadcasts and application proof
Why it matters: Port reachability is not application success, and a broad allow is not an acceptable substitute for understanding BACnet and vendor flows.
Vocabulary and working scope
Source/destination; protocol/port; direction; purpose; owner; schedule; expiry; route; NAT; broadcast; BACnet BBMD/FDR/SC; stateful behavior; deny logging; application acceptance.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
Ping passes across a firewall but routed BACnet discovery and certificate validation fail; a temporary any-any rule remains.
Calculation: Calculate subnet/routing decisions, rule coverage/redundancy/shadowing from supplied data, allow/deny tests, latency, and temporary-rule closure.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Monitoring, baselines, time, logs and useful alerts
Why it matters: More logs and alerts do not guarantee detection; time quality, context, ownership, retention, tuning, and response path determine usefulness.
Vocabulary and working scope
Network/device/platform/controller logs; flows; alarms; authentication; configuration change; clock/NTP; retention; baseline; threshold; alert owner; triage context; evidence preservation; privacy.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
Repeated authentication failures coincide with a maintenance window, but one controller time source is 18 minutes wrong.
Calculation: Calculate clock skew, baseline ranges, event/alert rates, false-positive ratio, retention/storage, and detection/escalation time.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Incident command, evidence, containment and operational recovery
Why it matters: Fast containment is valuable only when authority, physical consequences, dependencies, evidence, reversibility, and recovery are considered.
Vocabulary and working scope
Detection; validation; incident roles; severity; physical impact; communications; evidence; containment options; reversibility; eradication/rebuild; recovery criteria; monitoring; lessons; legal/privacy coordination.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A compromised workstation communicates with a JACE serving critical space; disconnecting the JACE would remove operator visibility and schedules.
Calculation: Calculate severity from supplied rubric, affected assets/dependencies, containment blast radius, decision/recovery timeline, and evidence coverage.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Backup scope, protected copies, checksums, RPO/RTO and restore proof
Why it matters: A backup file is not recovery evidence; integrity, completeness, access, dependencies, supported restore procedure, and functional tests must pass.
Vocabulary and working scope
Platform/station/controller/switch/firewall/config/database/certificates/licenses/histories/docs; dependency order; offline/immutable awareness; encryption/access; checksum; RPO; RTO; clean environment; restore; functional proof.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
The station backup starts, but certificates, switch configuration, controller database, and alarm recipients are missing.
Calculation: Calculate backup age versus RPO, restore time versus RTO, dependency and function coverage, checksum results, and residual gaps.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Staged migration, exception governance and continuous improvement; Architecture/change capstone, restore exercise and defense
Why it matters: A target architecture without sequencing, ownership, acceptance, rollback, and exception expiry is not an executable security plan. Security acceptance is operational: required flows, physical sequences, operator tasks, incident decisions, and recoverability must all be proven.
Vocabulary and working scope
Current/future gap; priority; compensating controls; maintenance windows; pilot; stop thresholds; dependencies; vendor/owner; exception rationale/expiry; metrics; exercise; lessons; roadmap. Scope; inventory; flows; zones; identity; hardening; monitoring; incident; backup/restore; physical sequence; operator task; migration; rollback; as-left; evidence; residual risk.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
The owner approves segmentation but cannot replace three unsupported controllers this year. Changed-capstone condition: The proposed architecture passes network tests but fails a plant restart sequence and remote-session revocation during an incident.
Calculation: Calculate risk-reduction priority, stage coverage, budget/schedule assumptions, exception age/expiry, pilot success, and rollback points. Calculate requirement/test coverage, allow/deny/function pass rates, RPO/RTO, incident/recovery timing, issue closure, residual risk, and ownership completeness.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Required and deeper reading
- NIST SP 800-82 Rev. 3
OT governance, architecture, access, monitoring, incident response, backup, recovery, and compensating-control guidance. - ASHRAE Standard 135 official scope and current-edition route
Confirm the current standard, addenda, interpretations, adopted/project requirements, and product implementation before making a compliance claim. - ASHRAE Guideline 13-2024
BAS specification, installation, integration, testing, documentation, cybersecurity, and lifecycle context. - BACnet International BACnet/SC resource
Secure-connect architecture, certificate/trust concepts, migration, and interoperability routes.