it-ot-convergence-risk-assessmentlisted

## When to Use - A convergence project proposes a data lake, cloud analytics platform, or remote monitoring service. - IoT sensors are proposed for the OT network. - An enterprise data initiative wants live OT data. - Reviewing a convergence architecture before capital commitment. ## Prerequisites - Proposed convergence architecture from the project: data flows, platforms, access paths. - Zone and conduit design from `ot-network-segmentation-design`. - DMZ design from `dmz-architecture-for-ot` or the current boundary state. - Consequence-of-compromise statement per affected zone. - Credentials: none. This skill produces documents. - Authorization: security manager and operations manager jointly own the go or no-go decision. - Upstream skills: `ot-network-segmentation-design`, `dmz-architecture-for-ot`. ### Safety This skill is passive. It produces design documents only. ## Workflow 1. Complete `references/questionnaire.md` with the project team. Every risk in the register must trace to a stated architecture element. 2. Decompose the proposed architecture into data paths. Requirement: risk is assessed per path, not per project. Anchor: 62443-3-2 risk assessment. Criteria: one row per path with source zone, destination platform, direction, protocol, latency requirement, and data classification. 3. Classify each path against the zone design. Requirement: convergence paths do not create new direct crossings. Anchor: SR 5.1. Decision: a path that bypasses the L3.5 boundary