Cloud and security · Industrial
OT cybersecurity engineering (IEC 62443)
We provide OT cybersecurity engineering to IEC 62443 for oil and gas, energy and industrial operators: asset inventory and network visibility, security risk assessment, design of zones and conduits, segmentation and secure remote access, monitoring of operational networks, OT-aware patching and recovery of control systems. Security is engineered around the safety and availability of the process, and you own the designs and the code.
Checklist · Industrial security
OT security, NIS2 and Cyber Resilience Act checklist
A checklist for operators and manufacturers of industrial and connected products: asset visibility, zones and conduits, remote access, monitoring, patching, recovery, supplier security and the regulatory duties of NIS2 and the Cyber Resilience Act.- 01Eight areas based on IEC 62443 practice, with testable checks.
- 02Incident detection and reporting items for NIS2 and the Cyber Resilience Act.
- 03Supplier and secure development questions for product makers.
- 04Seven questions to put to any vendor or engineering partner.
Free download
Get it on screen in a few seconds.
What the system does, module by module.
- 01
OT asset inventory and visibility
A reliable inventory of controllers, HMIs, servers, network devices and software versions, built mostly by passive discovery so the process is not disturbed. - 02
Security risk assessment
Assessment of threats, vulnerabilities and consequences for each system, with consequence defined in safety, environmental, production and financial terms. - 03
Zones and conduits design
Grouping of assets into zones by function and risk, with conduits that define and control the communication between them, and target security levels for each. - 04
Network segmentation
Implementation of the design with industrial firewalls, demilitarised zones and, where appropriate, data diodes, aligned with the Purdue reference model. - 05
Secure remote access
Controlled access for vendors and engineers through jump hosts with multi-factor authentication, session recording and time-limited approval. - 06
OT network monitoring
Passive monitoring that detects new devices, unusual commands and known attack patterns, integrated with the security operations centre with OT-aware playbooks. - 07
Patch and vulnerability management
A risk-based process that matches vulnerabilities to your assets, plans patches around maintenance windows and applies compensating controls where patching is not possible. - 08
Backup, recovery and resilience
Tested backups of controller logic and configuration, offline copies and recovery procedures for the control system, rehearsed with operations. - 09
Governance and supplier requirements
An OT security programme with roles and policies, secure procurement requirements for vendors and integrators, and training of engineers and operators.
Reference architecture.
Standards and interfaces
What we design against.
- IEC 62443 series
- The standards for industrial automation and control system security: programme requirements (2-1), service providers (2-4), risk assessment and zones and conduits (3-2), system requirements and security levels (3-3), and secure product development and component requirements (4-1 and 4-2).
- NIST SP 800-82
- Guide to operational technology security, covering architectures, risks and controls for industrial control systems.
- ISO/IEC 27019
- Information security controls for the energy utility industry, extending ISO/IEC 27002 to process control systems.
- API 1164 and sector guidance
- Pipeline control system cybersecurity guidance and equivalent sector standards for oil, gas and electricity.
- MITRE ATT&CK for ICS
- A knowledge base of adversary behaviour against industrial control systems, used for detection design and exercises.
- Regulatory regimes
- NIS2, national critical infrastructure rules and sector regulators' requirements for operators of essential services.
Data model
The core entities.
- Asset
- Type, vendor, model, firmware, location, zone, criticality and owner.
- Zone and conduit
- Members, target and achieved security level, allowed flows and controls.
- Risk and consequence
- Threat scenario, likelihood, consequence categories, existing controls and residual risk.
- Vulnerability and patch status
- Advisory, affected assets, severity, decision, compensating control and date.
- Remote access session
- User, vendor, target, approval, time and recording.
- Detection event
- Source, behaviour, asset, severity and response.
- Recovery asset
- Backup of logic or configuration, version, location and last restore test.
When custom development is the right call.
Controls designed in, not added later.
Safety and availability first
Changes are tested, scheduled with operations and reversible, and no control is applied that could affect safety functions without engineering approval.Minimal inbound access
Access into the plant is limited, authenticated, approved and recorded, with outbound data paths preferred.Integrity of control logic
Changes to controller programs are detected, compared with approved versions and recorded.Supplier discipline
Vendors and integrators meet security requirements in contracts and on site, and their access is time-limited.Resilience by design
Critical functions continue in a degraded state if connectivity or business systems are lost.
From discovery to a system you run.
- 01
Assessment and inventory
We inventory assets passively, review architecture and processes with operations and automation, and assess risk against IEC 62443. - 02
Target architecture
Zones, conduits, security levels and the roadmap are designed, with risk and cost trade-offs agreed with operations and safety. - 03
Implement foundations
Segmentation, secure remote access, monitoring and backups are implemented site by site in planned windows. - 04
Operate and test
Detection, response and recovery are exercised with operations, and the patching process starts. - 05
Extend and sustain
More sites, supplier requirements and training are added, and the programme is reviewed regularly.
Relevant work
Where to see our work.
Common questions.
- How is OT security different from IT security?
- Availability and safety come first. Systems run for decades, cannot always be patched or scanned actively, and changes need operational approval. The controls are adapted to that: passive monitoring, segmentation, careful change and tested recovery.
- What are zones and conduits?
- Zones are groups of assets with similar security needs. Conduits are the controlled paths between zones. IEC 62443 uses them to design segmentation and to set a target security level for each zone.
- Do you need to scan our control systems?
- We prefer passive discovery that listens to network traffic without sending anything. Active scanning is used only where operations and the vendor agree it is safe.
- Can we certify to IEC 62443?
- Certification applies to products, processes and service providers through accredited bodies. We engineer to the standard and prepare you for assessments, and the certification itself is issued by the certification body.
- Who owns the designs and code?
- You do. The designs, the automation and the data stay yours.