Quantifying OT/ICS Cyber Resilience: An Expert-Weighted Maturity Model and Empirical Field Validation

Industrial organizations increasingly rely on maturity assessments to evaluate Operational Technology and Industrial Control Systems (OT/ICS) cyber resilience, yet such models are seldom validated against field data. This study examines the measurement layer of an expert-weighted OT/ICS maturity model incorporating 71 controls across nine domains, including a workforce and security culture domain. Aggregated expert-derived criticality weights were applied to an anonymized assessment dataset of 25 structured maturity assessment records containing control-level maturity ratings for all 71 controls. The weight distribution was narrow and top-heavy (mean 4.47 of 5, standard deviation 0.30), with 93% of controls rated at or above 4.0 of 5.0. Scoring each record under expert-derived weights and under uniform weights produced a mean difference of 0.11 points on a 0–100 scale; no record differed by more than 0.63 points, and no reported maturity level changed. The lowest-scoring domain, which determines remediation priority, differed in 2 of 25 records. Domain-level decomposition proved more informative, with domain means ranging from 48.3 to 58.4 and broad distribution within domains. In this dataset, domain structure rather than control-level weighting explains the practical value of the assessment approach. The assessment framework is aligned with the ISA/IEC 62443 series, incorporates expert elicitation for control criticality weighting, and is evaluated using empirical field assessment records from industrial environments.