Skip to content
Secure Systems Integrators

OT security · IEC 62443 · SOCI Act

Your control system is now part of your attack surface.

PLCs were never designed to sit on a network, and now nearly all of them do. We secure operational technology without breaking production. Our engineers write PLC code and know what a firmware update does to a running line.
Request an OT security assessmentSOCI Act support

Approach

OT security built around a running plant.

An active scan can crash an old PLC. A forced reboot can scrap a batch. A patch can void a validation. OT security has to be designed around availability and safety first, and that's how we work.

  • Passive discovery first, with active checks only in agreed windows
  • Changes staged around shutdowns and production
  • Safety functions kept independent of security controls
  • Everything documented for your team, not locked in our heads
Zones and conduitsA layered industrial network from enterprise IT down to the process. Each layer is a security zone. Traffic only crosses between zones through defined, firewalled conduits. Enterprise IT never talks directly to control. Data flows up through the DMZ, and remote access is brokered through a jump host.L4–5Enterprise ITERPEmailInternetno directL3.5Industrial DMZHistorian replicaJump hostPatch serverbrokeredL3Site operationsHistorianEng. workstationAV / backupsconduitL2SupervisorySCADAHMIAlarm serverconduitL1ControlPLCSafety PLCDrivesconduitL0ProcessSensorsActuatorsSafety I/ODATA OUT · OUTBOUND ONLY
Each layer is a zone. Traffic crosses only through defined conduits, and IT never talks straight to control.

Services

From first inventory to a defended, recoverable plant.

OT asset inventory

Every PLC, HMI, drive, switch and engineering laptop, with firmware versions and how they talk to each other. Gathered passively wherever possible, because you can't defend what you haven't listed.

Risk assessment to IEC 62443

The system is split into zones and conduits, each zone gets a target security level, and the gaps are ranked by what they would actually do to production and safety.

Network segmentation

Segmentation designs that put an industrial DMZ between IT and OT, firewall conduits between zones, and give safety networks their own zone, built and commissioned without a line outage.

Secure remote access

Always-on vendor VPNs and stray remote-desktop tools replaced with brokered access that is time-limited, protected by MFA and recorded.

Hardening and recovery

Hardening for PLCs, HMIs and engineering workstations, a patch strategy that respects validation, and tested backups of every program and configuration.

Secure product design

For OEMs: signed firmware, secure boot, authenticated protocols and update paths, aligned with IEC 62443-4-1 and 4-2. We do this on our own products.

SOCI Act

Critical infrastructure? Your OT is in scope.

Under the Security of Critical Infrastructure Act 2018, responsible entities for many critical infrastructure assets must keep a Critical Infrastructure Risk Management Program (CIRMP) and report on it each year with board approval. The program covers cyber and information security, personnel, supply chain, and physical and natural hazards.

The cyber domain has to align with a recognised framework, such as the Essential Eight, ISO/IEC 27001, the NIST CSF, C2M2 or the AESCSF. Those frameworks were mostly written for IT. Applying them sensibly to control systems, where patching and application control work differently, is the part most programs struggle with.

What we do for your CIRMP

  • Identify the OT components critical to your asset and how they could be compromised
  • Assess OT cyber and physical hazards and record them in your program
  • Gap-assess your OT environment against your chosen framework
  • Design and implement remediation: segmentation, access, hardening, recovery
  • Produce the evidence and records behind your annual report

We deliver the technical side of compliance. We work alongside your legal and compliance advisers and don't give legal advice on whether or how the Act applies to you.

Questions

Our control network is air-gapped. Do we need this?
Probably less than you'd think, but it's worth checking. 'Air-gapped' networks often turn out to have a vendor modem, a dual-homed laptop or a USB habit. An inventory tells you what you really have.
Will an assessment disrupt production?
It shouldn't. We start passively, by observing traffic and reviewing configurations. Anything active is agreed in advance and scheduled into a window you choose.
Does security make our safety systems less safe?
Done badly, it can. Done properly, it protects them. Safety functions must keep working whatever the security controls do, so we keep them independent and design security around them.
Can you work with our IT provider?
Yes, and we prefer to. IT owns the enterprise side, we own the plant side, and the DMZ between them is designed together.

Find out what's really on your plant network.

Start with an OT asset inventory and a risk snapshot. It's the foundation for IEC 62443, SOCI and everything else.

Call 0430 178 187Start with an inventory
Call an engineer: 0430 178 187