IEC 62443, taken through to mitigation that can be implemented.
In a validated plant the difficult part is not identifying the risk; it is making a change without invalidating the qualification. Our scope runs from assessment through mitigation design to implementation, with the qualification evidence produced alongside it.
An OT network you cannot patch, cannot restart, and cannot leave as it is
Industrial control systems in life sciences carry a specific contradiction: they run software old enough to have public vulnerabilities, on hardware that cannot be taken offline, inside a qualified state that any change disturbs. Generic IT security guidance recommends patching, segmentation and MFA without accounting for what each one costs in revalidation.
What usually goes wrong
Common findings on first engagement.
- InventoryNo complete list of PLCs, HMIs and engineering workstations exists
- Remote accessVendor connections that were temporary three years ago
- Flat networkProcess control and office IT on the same broadcast domain
- No recoveryPLC programs held on one laptop, with no version control
- Orphan riskAn assessment report that cannot be acted on without disturbing qualification
How we approach it
The constraints stated before the recommendations.
- Consequence firstSecurity levels assigned from process impact, not asset value
- Change controlEvery control routed through your existing GxP change process
- CompensatingWhere patching is not possible, controls that can be justified to a regulator
- EvidenceQualification evidence produced alongside the technical change
- HandoverYour team runs it afterwards — the review calendar included
Six phases, assessment through review
Engagements can start at any phase. Skipping the first is the most common and most expensive decision.
Asset inventory
Every PLC, HMI, SCADA node, historian, engineering workstation and remote access path — including undocumented assets.
Zones & conduits
Segmentation model per IEC 62443-3-2, with security levels assigned against the actual process consequence.
Risk & gap
Threat modelling, CVE exposure on installed firmware, and the gap against target SL — stated quantitatively rather than as a colour scale.
Mitigation design
Compensating controls chosen for a plant that cannot be taken down, with the GxP impact of each stated up front.
End to end
Firewall rules, hardening, patch strategy, backup and version control: specified, routed through change control and evidenced. We implement directly where we have access, and otherwise work alongside your automation team or your integrator.
Review & monitoring
Periodic reassessment, CVE surveillance on your asset base, and the documentation an NIS2 or GMP inspector will ask to see.
Automation software version control
A recurring gap that sits between security and compliance, and is frequently owned by neither.
PLC and automation software archiving
TIA Portal projects, PLC programs, HMI applications and SCADA configurations held under client-owned version control — not on the integrator's server.
- Short-term framework using tooling you already license
- Medium-term migration to a dedicated version management platform
- Clear boundary: the vendor's repository is a supplier SDLC tool, not your record
- Recovery testing, so the archive is proven rather than assumed
OT Security Baseline Pack
The fixed-fee entry point: what you have, what it exposes, and what can safely be changed.
- Complete OT asset inventory including remote access paths
- Zone and conduit model with target security levels
- CVE exposure analysis on installed firmware and software
- Prioritised mitigation plan with GxP impact per control
Start with the inventory. Everything else depends on it.
If you cannot produce a current list of what is on your process network, that is the first engagement — and it usually takes less time than expected.