VULCAN · the estate diagnostic
Before the platform, the count. On a critical infrastructure estate.
Risk here is a joint function of assets, networks, known weaknesses and service impact, held by teams that rarely share a picture. The count establishes the inventory and its authority before criticality is derived from it.
The unit of account.
The eight gates contain no sector content. What changes between estates is the unit of account and the obligation attached to it, and the diagnostic establishes that first.
This estate
Critical infrastructure
Unit of account
The asset and its criticality tier
Carries
The compliance obligation
A design commitment about where obligation lands, not a deployment claim. No measured evidence from another estate transfers here.
The eight gates, run here.
The gates are the same on every estate. What they touch here is named below; what they return is listed at the end.
Dataset census
Asset inventories, network topology, vulnerability and advisory feeds, operating procedures and service impact models, enumerated with owners.
Authority registry
Each source scored for authority over configuration, connectivity, weakness and consequence, so derived criticality can be inspected.
Boundary matrix
What may leave the operational technology environment is tiered and listed explicitly.
- 01
Dataset census
Every dataset enumerated with columns, row volume, owner and last refresh
- 02
Authority registry
Each dataset scored for authority; score, basis and reviewer recorded and reproducible
- 03
Duplicate resolution
Recut datasets identified, the survivor named, lossy recuts flagged
- 04
Identifier profile
Candidate keys profiled; collisions and drift documented, never corrected in silence
- 05
Crosswalk
An explicit bridge between the analytics key and the system-of-record identifier; exceptions quarantined, not merged
- 06
Boundary matrix
Every dataset assigned a tier; those barred from broad pipelines listed explicitly
- 07
Ingestion manifest
A deterministic include, defer or reject call per dataset, diffable between runs
- 08
Expectations suite
Automated expectations that fail the build, not a report read afterwards
The seam.
Business systems do not talk to equipment systems, and the question that matters on this estate needs both. The diagnostic maps both sides before anything is connected.
IT
Business systems
- Asset inventory
- Vulnerability data
- Procedures
OT
Equipment systems
- OT/ICS networks
- Control systems
The question that needs both
Which remediation actually reduces service consequence, and in what order?
What the count returns here.
- 01A definitive inventory of the estate's datasets, with owners and refresh cadence
- 02The asset and its criticality tier established as the unit of account, with the compliance obligation attached
- 03A boundary matrix naming what may enter broad pipelines and what stays inside the OT environment
- 04An ingestion manifest your engineering and security teams can both diff
The gates do not change because the estate serves the public. The unit of account does.
The full method
The method, and the one measured engagement.
The VULCAN page carries the full argument: the eight gates, the platform path, the scorecard, and the single engagement where the diagnostic has been run and measured at full scale.
Read the full methodThe operating world
Critical Infrastructure
The sector page covers the operating reality, the application set and the evidence in context for this industry.
Explore Critical Infrastructure