Topic
All articles on compliance.
Regulations
NIS2 protects the digital, the CER directive protects the physical. They are two sides of the same European design for critical infrastructure, and NIS2 entities often fall under the CER too.
Regulations
The Cyber Resilience Act introduces security obligations for manufacturers of products with digital elements. For OT and IoT device makers, the compliance scope is broad and the deadlines are approaching.
Risk Management
Insurers increasingly demand specific technical controls for OT environments. What they assess, how it affects the premium and how to prepare for the insurance assessment.
Regulations
IEC 62443 is the reference standard for industrial control system cybersecurity. How to use it concretely: structure, gap assessment and a first five-step remediation plan.
Compliance
Many industrial organizations already hold ISO 27001 for IT. Extending it to OT environments demands a specific approach: different threat models, operational constraints and integration with IEC 62443.
Compliance
IEC 62443 is often seen as out of reach for SMEs. Yet zones and conduits are practical tools you can apply to real plants, starting from visibility and reaching formal segmentation step by step.
Compliance
NIS2 is not proven with policies: it is proven with technical evidence. What auditors look for in an OT audit, how to prepare evidence before they arrive, and the role of continuous monitoring as documentary proof.
Cybersecurity
NIS2 sets tight deadlines for notifying significant incidents: 24 hours for the early warning, 72 hours for the detailed notification. In OT, being ready to meet them takes preparation that starts long before the incident.
Compliance
NIS2 is not just for large companies. Manufacturing SMEs within scope have concrete obligations: OT asset inventory, vulnerability management, detection, incident notification. A practical checklist.
Compliance
NIST CSF 2.0 adds the Govern function to the original five. How to map OT capabilities onto the framework's six functions and use it as a self-assessment tool and roadmap to prioritize industrial security investments.
Cybersecurity
Management wants numbers. But which OT metrics communicate real risk instead of mere compliance? How to build a dashboard of KPIs and KRIs that speaks of potential downtime, not checklists.
Compliance
IEC 62443 does not mandate a product, but many of its requirements can only be met with serious OT monitoring: asset inventory, anomaly detection, logging and verified segmentation. Which requirements map to which monitoring capabilities.
Cybersecurity
A practical four-level framework to assess OT security maturity and build a concrete roadmap. Each level has clear prerequisites, measurable goals and a defined next step.
Compliance
Pharma faces strict quality regulations that now overlap with OT cybersecurity needs. How to integrate GMP, FDA 21 CFR Part 11 and IEC 62443 into one coherent program.
Regulations
The NIS2 directive has been transposed: what matters now is what to do in practice. From entity classification to OT asset visibility, an operational checklist.
Risk Management
CISOs no longer judge OT security on technical merit alone, but on the value it creates: uptime, production continuity and reduced risk.
