Skip to content
MenuClose

Gap Analysis / Continuous OT Evidence & Assurance

Know what your water plant can prove. Find what it cannot.

Connect operational, engineering and cybersecurity evidence. Keep blind spots explicit. Ask for the proof needed next.

Assess a water / OT environment
Currently
Implemented evidence gates, requests and review, demonstrated on retained water / OT evidence.
Output
Retained assessment and JSON evidence ledger: coverage, finding-gate states and evidence requests.
Boundary
Unknown is not absent; insufficient evidence is not failure, and wider domain readiness is not established.
Redacted extract from a retained assessment

Unknown does not become a finding.

01 / Operating condition to assess

Pump running + zero flow

Candidate consistency check, not an established operating condition. Pump failure is not established.

02 / Available evidence

The retained candidate references captured observations. Raw observations are omitted here; none of the five requirements has supporting evidence linked in the retained record.

03 / Evidence sufficiency gate

5 / 5 requirements not established

Inspect each requirement. These states are retained, not live checks.

01Pump-state meaningUNKNOWN

Retained state UNKNOWN. Requirement not established; no supporting evidence linked.

Evidence category needed Evidence establishing what the pump-state signal means.

Why the candidate could not advance Without established signal meaning, pump operation cannot be assumed.

02Pump / flow relationshipUNKNOWN

Retained state UNKNOWN. Requirement not established; no supporting evidence linked.

Evidence category needed Evidence establishing the relationship between the pump and the flow measurement.

Why the candidate could not advance Co-occurring readings do not establish a physical relationship.

03Flow-data qualityUNKNOWN

Retained state UNKNOWN. Requirement not established; no supporting evidence linked.

Evidence category needed Evidence establishing acceptable quality of the flow measurement.

Why the candidate could not advance An unqualified flow reading cannot support the candidate.

04Aligned source timestampsUNKNOWN

Retained state UNKNOWN. Requirement not established; no supporting evidence linked.

Evidence category needed Source measurement times that establish alignment.

Why the candidate could not advance Capture time alone cannot establish that measurements describe the same moment.

05Approved operating envelopeUNKNOWN

Retained state UNKNOWN. Requirement not established; no supporting evidence linked.

Evidence category needed Evidence establishing the approved operating limits.

Why the candidate could not advance Without an approved envelope, the comparison has no established operating basis.

04 / Candidate disposition

Candidate blocked

Available evidence was insufficient to support evaluation.

05 / Evaluation state

NOT EVALUATED

No finding established.

06 / Next step

Evidence required

Establish the five missing requirements before advancing the candidate.

Needs more evidence · Validation-harness disposition. Not professional human confirmation.

Unknown does not mean absent. The available evidence does not establish it.

Provenance, scope and limitations

Derived from a retained assessment. Sensitive and raw evidence is omitted; the evidence-state relationships are preserved.

Evidence categories explain the retained requirements. They are not newly issued requests or claims that evidence was received.

  • The candidate title does not establish pump failure, pump operation or absent flow.
  • Candidate blocked means the available evidence was insufficient to support evaluation.
  • Needs more evidence was a validation-harness disposition, not professional human confirmation.
  • Unknown does not mean absent. The available evidence does not establish it.
  • This dated, redacted assessment is not a live measurement, production validation or independent verification.
  • This extract preserves assessment states, but does not disclose source records for independent inspection.
Inspect the public extract
Water plant / evidence environment Illustrative engineering scene
PHYSICAL PROCESS
IntakeTreatmentPump 04
CONTROL RECORD

PLC / SCADA → historian

Pump 04 · RUN = 1 · captured 09:42
CYBER CONTEXT

Inventory · network · remote access

EVIDENCE STATEFinding blocked
Illustrative three-dimensional water treatment environment with operational technology and IQAI evidence assurance An isometric public-safe water treatment environment shows intake, clarifier, filtration basins, process building, pump station, reservoir, control building, pipes and access roads. Digital-control and cybersecurity evidence overlays connect the physical environment to IQAI Evidence Assurance. The scene is illustrative and is not a verified digital twin of a real facility. ILLUSTRATIVE WATER-TREATMENT ENVIRONMENT Physical process · public-safe synthetic geometry INTAKE CLARIFIER FILTRATION PROCESS BUILDING PUMP STATION · P04 CLEARWELL CONTROL ROOM ASSETINVENTORY OTMONITORING ENGINEERINGRECORDS KNOWN UNKNOWN EVIDENCE REQUEST IQAI Evidence Assurance PROVENANCE · SUFFICIENCY · REVIEW
Physical water process Intake, treatment, pumping and distribution create the operating context that must ultimately be understood and protected.
Observed
A display shows Pump 04 / RUN = 1.
Inferred
The pump may be running.
Unknown
Physical pump identity and actual condition.
To close the gap
Verify the tag-to-asset mapping and physical state.
01 / PHYSICAL

The plant comes first.

Intake, treatment, pumping and distribution define the real-world consequence.

02 / CONTROL

The plant has a digital nervous system.

Sensors, PLCs, SCADA and historian records observe and control the process.

03 / CYBER

Security adds another evidence surface.

Asset inventory, monitoring, remote access and engineering records shape what can be assessed.

04 / EVIDENCE

IQAI asks what all of it actually proves.

Known, inferred and unknown stay separate. Missing proof becomes a request, not an assumption.

Why it is needed

Visibility is not the same as understanding.

Device seen≠Asset identified
Signal captured≠Signal understood
Control documented≠Control verified
Alert available≠Conclusion established

Before teams can mitigate risk, they need to know what the available evidence actually establishes.

What Gap Analysis does

Turn blind spots into evidence requests.

Evidence workflowSynthetic example
Captured evidence01 / 04

A value was captured.

Test what that observation actually establishes.

Fictional operational recordFinding blocked

A captured display is evidence that something was shown. It is not proof of physical meaning or equipment condition.

Water plant example

One observation. Several unanswered questions.

OBSERVED Pump 04 RUN = 1 09:42 capture
UNKNOWN Identity signal meaning source time network relationship
EVIDENCE NEEDED Tag dictionary asset mapping source timestamp network record
FINDING BLOCKED until evidence is sufficient
Then Verify mapping → assess exposure → confirm controls → prioritize mitigation

Illustrative example. A gap does not prove a vulnerability. It shows what must be verified before a risk or mitigation decision can be relied on.

Where IQAI sits

Above the evidence. Alongside the security stack.

01 / Physical plant

Start with the real operating environment.

The evidence only matters in relation to the physical process, assets and consequences the team is responsible for.

IQAI roleContext boundary
Cybersecurity value

Expose what must be verified before mitigation.

GAPAsset identity unresolved
REQUESTAsset + network mapping
VERIFYExposure + control context
ACTIONPrioritize mitigation
GAPControl evidence incomplete
REQUESTConfiguration + approval record
VERIFYCoverage + authority
ACTIONRemediate or accept

Illustrative cybersecurity paths. IQAI does not treat an evidence gap as a detected threat or vulnerability.

Why the layer is different

OT security observes. IQAI controls the evidence-to-conclusion path.

OT SECURITYdiscover · monitor · detect
IQAIprovenance · sufficiency · review
TOGETHEREvidence-informed action
Assessment
OT security platform
IQAI Evidence Assurance
Primary jobAssessObserve / detect / scoreControl evidence → conclusion
Telemetry visibilityLimitedCore strengthConsumes evidence
Threat detectionNoCore strengthNot the role
Evidence provenanceVariableProduct specificCore control
Known / inferred / unknownVariableProduct specificExplicit state
Missing evidenceFollow-upWorkflow dependentStructured request
Finding sufficiencyReviewerProduct dependentExplicit gate
Human dispositionReportWorkflow dependentPreserved state

Generalized category comparison. IQAI is designed to sit above and alongside mature OT security, not replace discovery, monitoring or threat detection.

Retained demonstration

The workflow has been exercised, not only diagrammed.

67gap propositions
21outstanding evidence requests
0candidates passed sufficiency
Captured demonstration frame Not defect, vulnerability, client or installation counts
Recurring model

Not a report. A living assurance loop.

01Capture
02Assess
03Request
04Verify
05Review
Evidence changesRun again
01One plant
02OT assets
03Facilities
04Portfolio assurance
Who uses it

One evidence layer. Different responsibilities.

OPERATIONSWhat is actually known about the plant?
CYBERSECURITYWhat blind spots affect risk assessment?
ENGINEERINGWhich mappings and records are missing?
ASSURANCEWhat evidence supports the conclusion?
Current maturity

Working, demonstrated and still to validate.

WORKING
  • Evidence links
  • Unknown register
  • Evidence requests
  • Review history
  • Finding gate
  • Ledger export
DEMONSTRATED Captured public water-monitoring evidence workflow Retained review and replay evidence
TO VALIDATE
  • Additional connectors
  • Additional domains
  • Production-scale deployment
  • Authenticated approval authority
Bring us one unresolved operational question.

Start with the gap.

Assess a water / OT environment → Discuss an OT-security integration → Review the evidence & market context →