Industrial Inspection Robot Safety and Cybersecurity Review Checklist

An industrial inspection robot is a cyber-physical system, not a camera on legs or wheels. Its movement, payload, communications, remote access, data and downstream alarms can affect people and plant decisions. Safety and cybersecurity reviews should therefore share one system boundary, one change record and one recovery plan.

This checklist helps a site decide whether a bounded inspection route is ready for pilot. It does not select applicable law or standards, certify a product, approve work in hazardous areas or replace qualified machine-safety, process-safety and OT-security review.

Draw the system boundary before listing controls

Include the mobile platform, locomotion and braking, inspection payload, batteries and charger, docking or handling equipment, maps, fleet software, operator station, wireless network, remote-support path, identity provider, time source, storage, analytics, interfaces to historians or computerized maintenance management systems, and every human handoff.

Record supplier, version, owner, location, trust zone, data handled, communication direction, required availability and safe state for each component. Identify which system is authoritative for mission status, inspection evidence, alarms and maintenance action. Unknown assets and undocumented flows are unresolved risks, not neutral blanks.

Use lifecycle risk assessment for the physical system

ISO 12100 describes a lifecycle method for hazard identification, risk estimation and evaluation, risk reduction, documentation and verification. Apply it to transport, commissioning, normal inspection, foreseeable misuse, intervention, cleaning, charging, maintenance, recovery, software change and decommissioning.

Map hazards from movement, crushing, trapping, falls, stairs and edges, unstable terrain, hot surfaces, radiation, noise, chemicals, explosive atmospheres, confined spaces, water, dust, human traffic, payload energy and battery handling. Record the intended route and conditions, reasonably foreseeable deviations, protected persons, engineered controls, operating limits, warnings, training and residual risk.

Check the applicable machine-specific standard. The applicability of ISO 3691-4 depends on the machine and use; its public scope covers certain driverless industrial trucks and excludes several environments and hazards. A wheeled industrial truck, a quadruped and a remotely controlled crawler may require different standards and controls. Do not claim “ISO 3691-4 compliant” merely because the system moves autonomously.

Review the inspection payload as a safety function and data source

Confirm the payload is mechanically secure, environmentally suitable and supported for the intended sensing task. Define calibration, field of view, standoff distance, measurement range, blind spots, time synchronization and quality checks. A sensor reading is not automatically an alarm, diagnosis or work order.

Separate acquisition, interpretation, confirmation and action. Name who reviews uncertain data and who can change thresholds. If analytics assist detection, retain the raw or traceable source where feasible, version the model or rule, record confidence/quality flags, and test false-negative and false-positive responses against the site's risk decision.

Apply OT-aware cybersecurity controls

NIST SP 800-82 Rev. 3 advises securing operational technology in the context of performance, reliability and safety requirements. That means security changes should be tested for their effect on latency, availability, safe state, diagnostics and recovery—not deferred indefinitely or pushed automatically without an impact review.

Maintain named accounts; remove defaults; use strong authentication for privileged and remote access; apply least privilege; separate customer, integrator and OEM roles; close unused services; segment networks; allow only required flows; protect keys and certificates; log administrative and mission events; synchronize clocks; back up configurations; and define supported versions, patch windows, rollback and incident notification.

Remote support needs an operating procedure: customer approval, defined time window, named technician, least-privilege session, activity record, file-transfer rule, termination condition and emergency revocation. Persistent vendor access without clear ownership is a control gap even when the tool is convenient.

Organize evidence across the full cybersecurity lifecycle

NIST CSF 2.0 organizes cybersecurity outcomes under Govern, Identify, Protect, Detect, Respond and Recover. Use that sequence as a review spine. Govern risk tolerance and supplier duties; identify assets and flows; protect accounts, communications and platforms; detect anomalies; respond with a safety-aware playbook; and recover trusted configuration and operations.

Connect cyber incident severity to physical consequence. A lost credential, corrupt map, disabled payload or delayed alarm may be a quality issue on one route and a major safety or process risk on another. Define who has authority to stop movement, isolate the network, preserve evidence, retrieve the robot, invalidate inspection data and resume service.

Test degraded states, not only normal missions

Commissioning should include loss of wireless coverage, localization uncertainty, blocked route, low battery, charger unavailable, payload fault, storage full, clock drift, remote-support interruption, account lockout, invalid command, corrupt or missing data, safety-device fault and manual retrieval. Verify that messages reach a named person and that fallback does not create a new hazard.

Use a controlled test plan with prerequisites, expected safe state, observation method, pass/fail threshold, owner and rollback. Preserve logs and versions. A demonstration that completes one route in ideal conditions is not recovery evidence.

Control every change to the accepted configuration

Trigger review for route, speed, payload, map, wireless, firewall, certificate, account, software, analytics, threshold, historian/CMMS interface, charger, operating zone or recovery-procedure changes. Classify the effect on safety, cybersecurity, data validity and service acceptance.

Keep a known-good configuration, approval record and restore test. Emergency changes need retrospective review and expiry. Supplier updates should arrive with scope, dependencies, security relevance, known issues, rollback and validation instructions appropriate to the site.

Close the pilot gate with shared evidence

The package should include a system diagram, route and hazard register, applicable-standard decision, account/asset inventory, data-flow map, remote-access procedure, software and configuration baseline, payload-quality method, test results, incident and recovery plan, training record, residual risks and named acceptance authority.

Use Warpify's industrial inspection solution framework and gas-detection inspection guide to define the application boundary. Assess an industrial inspection route when the safety, payload, OT and service owners need one pilot scope.

Sources and scope

This guide synthesizes the public scopes of ISO 12100 and ISO 3691-4 with NIST SP 800-82 Rev. 3 and NIST CSF 2.0. This is a modelled scenario: the checklist is a review aid, not evidence of compliance or suitability for a specific site.