Cloud Range introduced a free, 28-question OT Cyber Readiness Assessment designed to help organizations identify gaps in their preparedness for cyberattacks affecting operational technology (OT) environments. Announced Nov. 10, the assessment evaluates seven areas of OT incident response readiness, including asset visibility, threat awareness, IT/OT coordination, incident detection and investigation, response decision-making, recovery and resilience, and validation through realistic cyberattack simulations. The resource helps IT, security, OT, and engineering teams assess their understanding of operational dependencies, responsibilities, and procedures for responding to incidents that could disrupt industrial processes, equipment, and essential services.
The assessment gives IT, security, OT, and engineering teams a practical starting point to evaluate how well they understand their environments, coordinate responsibilities, and prepare to detect, investigate, respond to, and recover from cyber incidents affecting industrial operations.
“Organizations can have incident response plans, security tools, and experienced teams in place without knowing how effectively those capabilities will work together when an attack affects operations,” Debbie Gordon, CEO of Cloud Range, said in a media statement. “The first step is understanding where teams are prepared, where they may be relying on assumptions, and where further validation is needed. The stakes are different in OT because decisions made during a cyber incident can have direct operational consequences.”
The Cloud Range OT Cyber Readiness Assessment examines seven areas that influence an organization’s ability to prepare for and respond to cyberattacks affecting OT environments. The first, knowing your environment, involves understanding critical OT assets, systems, dependencies, and connections between IT and OT environments. The second, knowing your threats and stakes, requires recognizing relevant cyber threats and their potential impact on operations, equipment, and safety.
Bridging IT and OT focuses on establishing shared responsibilities, communication, and decision-making across IT, security, OT, and engineering teams. Detection and investigation cover identifying suspicious activity, investigating threats, and determining their potential operational consequences. Responding without making it worse centers on coordinated incident response decisions that account for production continuity, equipment, and safety.
Recovery and maintaining resilience involve understanding recovery priorities, system dependencies, and procedures for restoring critical operations. Finally, proving readiness before it matters calls for validating response capabilities through realistic cyberattack simulations and measurable performance. Each area includes three questions, with responses of Ready, Developing, or Unsure.
For each statement, respondents choose the answer that reflects what their organization can do today, not what is documented or assumed.
A response of Ready indicates that the organization has established capabilities and confidence in its ability to execute. A response of Developing indicates that some capabilities exist, but gaps or inconsistencies remain. A response of Unsure indicates that the organization has not validated the capability or does not have enough information to answer confidently. The assessment produces no final score. Its goal is to identify the questions that deserve a closer look.
Rather than assigning a numerical score, the assessment helps organizations identify gaps, uncertainties, and areas requiring further attention. IT, security, OT, and engineering teams can complete it independently and compare their responses to uncover differences in understanding, unclear responsibilities, or differing assumptions about preparedness.
The launch comes as research cited by Cloud Range highlights continuing challenges in industrial cybersecurity preparedness. The Dragos 2026 OT Cybersecurity Year in Review reports that approximately 3,300 industrial organizations were affected by ransomware in 2025, while Palo Alto Networks’ 2026 State of Critical Infrastructure Cybersecurity Report found that 59% of surveyed critical infrastructure organizations experienced a significant security breach in the past year and 74% had not fully integrated IT and OT security operations. The report also identifies operational consequences of cybersecurity incidents, including safety concerns, unplanned downtime, production disruptions, and financial losses.
Together, these findings underscore a central challenge for organizations operating OT and industrial control systems (ICS): preventing attacks is important, but so is understanding whether teams can recognize, investigate, and respond quickly and effectively when incidents occur.
An attack does not have to originate within an OT network to affect industrial operations. Compromises involving enterprise IT systems, third-party access, supply chains, or interconnected infrastructure can create consequences for production environments and critical services.
Cloud Range said the assessment allows teams to compare their responses across three readiness levels, Ready, Developing or Unsure, to identify differences in understanding and unclear responsibilities. The company emphasized that preparedness also requires validating response capabilities through realistic attack simulations, as actions such as isolating systems or shutting down devices can have direct consequences for industrial operations and safety.
The Cloud Range OT Cyber Range supports flat and Purdue-model industrial network architectures, allowing teams to investigate how connectivity, segmentation, and system dependencies influence attack progression and response. Hardware-in-the-loop capabilities can also connect physical OT laboratory equipment to the cyber range for cyber-physical security validation.
Through OT cyberattack simulations and adversary emulation, teams can investigate ransomware, supply-chain compromise, credential theft, lateral movement, and threats affecting industrial systems. Performance metrics highlight how teams improve threat detection, investigating activity, coordinating decisions, and improving incident response over time.
Across Cloud Range customer engagements, measured improvements have included reductions of up to 66% in mean time to detect and improvements of up to 30% in overall incident response time. These results reflect broader cyber readiness programs and are not specific to OT environments.
