A method for analyzing a supervisory control and data acquisition (SCADA) system comprising devices, display clients and servers (104, 106, 108), the method comprising: generating a configuration for the SCADA system deployed in a first environment, the first environment being a testing environment, wherein the configuration includes values for configurable settings for the devices, types and number of devices, historical logging configurations and external network device configurations and/or applications and versions of the applications running on the display clients and servers (104, 106, 108), and wherein the first environment includes documentation describing the types and the number of devices in the SCADA system, operating system versions, update statuses, firewall rules, external device configurations, such as types of switches, routers, and firewalls connected to the network and/or configuration settings for some or all of the external devices; receiving a first result of a set of tests run on the SCADA system using the configuration in the first environment, the results comprising results of penetration tests on the security vulnerability of the SCADA system; determining whether the first result of the set of tests is successful; deploying the SCADA system using the configuration in a second environment based on a determination that the first result of the set of tests is successful; comparing the first environment with the second environment; determining differences between the first environment and the second environment; receiving a result of another set of tests run based on the differences between the first environment and the second environment; and adjusting the configuration in the second environment based on the result of the another set of tests to generate an adjusted configuration, wherein the steps of receiving a result of another set of tests run based on the differences between the first environment and the second environment; and adjusting the configuration in the second environment based on the result of the another set of tests to generate an adjusted configuration are conducted iteratively until the test results are successful. generating a configuration for the SCADA system deployed in a first environment, the first environment being a testing environment, wherein the configuration includes values for configurable settings for the devices, types and number of devices, historical logging configurations and external network device configurations and/or applications and versions of the applications running on the display clients and servers (104, 106, 108), and wherein the first environment includes documentation describing the types and the number of devices in the SCADA system, operating system versions, update statuses, firewall rules, external device configurations, such as types of switches, routers, and firewalls connected to the network and/or configuration settings for some or all of the external devices; wherein the configuration includes values for configurable settings for the devices, types and number of devices, historical logging configurations and external network device configurations and/or applications and versions of the applications running on the display clients and servers (104, 106, 108), and wherein the first environment includes documentation describing the types and the number of devices in the SCADA system, operating system versions, update statuses, firewall rules, external device configurations, such as types of switches, routers, and firewalls connected to the network and/or configuration settings for some or all of the external devices; receiving a first result of a set of tests run on the SCADA system using the configuration in the first environment, the results comprising results of penetration tests on the security vulnerability of the SCADA system; determining whether the first result of the set of tests is successful; deploying the SCADA system using the configuration in a second environment based on a determination that the first result of the set of tests is successful; comparing the first environment with the second environment; determining differences between the first environment and the second environment; receiving a result of another set of tests run based on the differences between the first environment and the second environment; and adjusting the configuration in the second environment based on the result of the another set of tests to generate an adjusted configuration, wherein the steps of receiving a result of another set of tests run based on the differences between the first environment and the second environment; and wherein the steps of receiving a result of another set of tests run based on the differences between the first environment and the second environment; and adjusting the configuration in the second environment based on the result of the another set of tests to generate an adjusted configuration are conducted iteratively until the test results are successful.