Checklist

OT–IT Integration Checklist: Data Flow, Security & Ownership (Interactive)

Interactive checklist to guide safe, reliable OT–IT integrations. Walk through endpoints, cadence, security controls, data contracts, monitoring, fallback modes, and training while recording owners, evidence, and readiness.

Interactive Tool

OT–IT Integration Checklist: Data Flow, Security & Ownership

This checklist helps OT and IT teams agree on the essentials before, during, and after connecting operational equipment to business systems. Use it to record owners, required cadence, security controls, transformation rules, monitoring, fallback plans, and training evidence. Save progress and return as the integration matures.

Have you identified each data source (PLC, RTU, sensor, historian, API) with endpoint addresses and a single accountable owner?
List owner names, roles, or asset identifiers for each endpoint (or provide a link to the asset registry).
Choose the cadence that meets operational and business needs. Note any differing cadences per data class in Notes.
Describe which signals need which cadence and why.
Are OT and IT networks properly segmented and are gateways/firewalls/brokers configured to enforce permitted flows?
Document VLANs, firewall rules, protocol gateways, DMZs, jump hosts, and gateway vendor/type (e.g., OPC UA gateway, MQTT broker).
Have you confirmed mutual authentication, least-privilege identities, and credential lifecycle management for devices and services?
Select the methods in use or planned.
Has the team agreed on canonical schemas, units, coordinate systems, and rounding rules?
Reference the agreed schema name and version or link to the contract (e.g., JSON schema, OPC UA model or API spec).
Who is responsible for transformations (name, role, or team)?
Is end-to-end monitoring in place for data flows, latency, integrity, and integration health, with documented alerting and escalation paths?
Select the systems or tools that will monitor integration health.
List the on-call roles/people and escalation steps for integration alerts.
Has the team agreed how systems behave if the integration fails (local control, safe-state, degraded mode, buffered store-and-forward)?
Describe the fallback behavior and any retained local logic or data buffering approaches.
Have both sides completed cross-domain training covering responsibilities, incident response, and handoffs?
List dates, training artifacts, or links to training records and runbooks.
Is there an agreed data ownership model, retention policy, and access control matrix?
Provide a link or identifier for the recorded agreement or policy.
Rate overall readiness of this integration on a 1–5 scale (1 = high risk / not ready, 5 = ready for production).
1.0 10.0
Select the current integration risk level.
Record open issues, owners, deadlines, and next actions to move toward production readiness.
You can explore this tool now. Sign in or create an account to save your responses and return to them later.
Sign In to Save Create an Account
Make this tool part of your work

Save a personal copy, bring it to your team, or tailor the questions and workflow to fit what you are hungry to improve.

Member customization and team collaboration are coming soon.
Discuss Ask the Librarian

Discussion

Comments and conversation will live here.