You say, right at the end, “…to scan safely and raise the security bar.”

And my question to you is, does raising the security bar raise security spending?

And from that flow a bunch of questions/issues about how much the bar is raised (resulting from the knowledge of vulnerability) VS. how much spending is increased.

I think those questions can only be answered within the confines of “risk,” and vulnerability does not a risk make.

So I would disagree with your statement and say, no control systems do not need to be scanned; but that the risks to control systems need to be known.

And to that end I would submit that the white paper be modified. Such that during the selection process prior to scanning you include the variable, threat.
And by threat I mean attacker motivation, means/opportunity, system exposure, and ROI for attempting the attack on system A or system B.

I feel that this additional level of complexity will multiply the value that comes from scanning; in both the eyes of the personnel that must take the time to react to scanning results and in the eyes of the personnel that pay for the scanning.

So, I’ll rephrase the question, does scanning alone raise the security bar enough to warrant the rise in security spending?

Thank you for entertaining my comments,
David