Blog

Insights & regulations — Page 2

Practical guides on OT cybersecurity, compliance and regulations for the industrial sector.

IEC 62443 zones and conduits model applied to an industrial plant

Regulations

IEC 62443 in practice: from gap assessment to your first remediation plan

IEC 62443 is the reference standard for industrial control system cybersecurity. How to use it concretely: structure, gap assessment and a first five-step remediation plan.

4 min read

Industrial network diagram with colored security zones and conduits between them

Compliance

IEC 62443 zones and conduits: how to apply it to a real plant without a year of consulting

IEC 62443 is often seen as out of reach for SMEs. Yet zones and conduits are practical tools you can apply to real plants, starting from visibility and reaching formal segmentation step by step.

5 min read

Industrial data center with racks, BMS, and cooling systems

Cybersecurity

OT Security in Industrial Data Centers: BMS, DCIM, and Operational Continuity

Data centers are cyber-physical environments with OT systems often ignored by IT security programs. BMS, PDUs, cooling systems, and UPS units are critical assets with real vulnerabilities.

3 min read

Architectural diagram of an Industrial DMZ with a dual-homed firewall, historian replica and jump server between the IT network and the OT network

Cybersecurity

Industrial DMZ: How to Design the Boundary Zone Between IT and OT Networks

The industrial DMZ is the architectural layer that separates IT and OT and manages data flows between the two worlds. Designing it well is the difference between a secure connection and a direct path to the heart of the production network.

5 min read

Industrial protocols Modbus, DNP3, and OPC UA with vulnerability analysis

Cybersecurity

Vulnerabilities in Industrial Protocols: Modbus, DNP3, OPC UA, and the Hidden Risks

Modbus, DNP3, OPC UA, and PROFINET underpin industrial communications. Designed for reliability in closed networks, they carry intrinsic vulnerabilities that become critical in increasingly connected environments.

4 min read

ISO 27001 ISMS framework extended to industrial OT environments

Compliance

ISO 27001 in OT Environments: Extending the ISMS Beyond the IT Perimeter

Many industrial organizations already hold ISO 27001 for IT. Extending it to OT environments demands a specific approach: different threat models, operational constraints and integration with IEC 62443.

3 min read

Network diagram showing an attacker's path from the IT segment to the OT segment through jump servers and industrial networks

Cybersecurity

How Attackers Cross the IT-OT Boundary: Techniques and Detection Signals

The pivot from IT into the OT network is the critical phase of nearly every documented industrial attack. Understanding the techniques used to cross this boundary is the first step to detecting it early.

6 min read

Port terminal with automated cranes and connected control systems

Cybersecurity

Port and Maritime Cybersecurity: Terminals, Intermodal Logistics and Onboard Systems

Ports and ships are complex, under-protected OT ecosystems: automated cranes, onboard systems, terminals and intermodal logistics. A map of risks and obligations for a critical sector that is often overlooked.

3 min read

Matrix diagram of the MITRE ATT&CK for ICS framework with techniques highlighted over an industrial SCADA background

Cybersecurity

MITRE ATT&CK for ICS: How to Use It to Build Concrete Detection Rules

MITRE ATT&CK for ICS is not a document to skim once and file away. Turning its techniques into concrete detection rules means knowing what you can really see on your network and what stays out of reach without endpoint visibility.

5 min read

OT network diagram with a passive sensor on a TAP and an out-of-band monitoring architecture

Cybersecurity OT

NDR for OT Environments: Why Passive Monitoring Is the Only Safe Architecture

Placing an inline monitoring system between SCADA and PLC introduces latency that industrial systems cannot tolerate. The right answer is passive out-of-band monitoring, with isolation and network changes as the response tool.

5 min read

Audit document with technical evidence and OT system logs on screen

Compliance

How to Prove NIS2 Compliance in an Audit: The Technical Evidence That Really Counts

NIS2 is not proven with policies: it is proven with technical evidence. What auditors look for in an OT audit, how to prepare evidence before they arrive, and the role of continuous monitoring as documentary proof.

6 min read

NIS2 notification timeline diagram showing the 24-hour and 72-hour windows, evidence documents and CSIRT-IT contacts

Cybersecurity

OT incident notification under NIS2: obligations, timelines and what to have ready before it happens

NIS2 sets tight deadlines for notifying significant incidents: 24 hours for the early warning, 72 hours for the detailed notification. In OT, being ready to meet them takes preparation that starts long before the incident.

6 min read