Resources
Material to help you understand the problem before hiring anyone: where to start, what to ask and what the jargon means.
Start here
Three ten-minute reads
- NIS2, requirement by requirement — what the directive requires from a plant, without the noise of sales presentations.
- IEC 62443 explained — zones, conduits and security levels: the vocabulary used in your audits.
- The Purdue stack on the home page — the seven levels of a plant and the service that applies to each, on a single screen.
Quick reference
The Purdue model in one table
The reference we use throughout the website to position every service. If you learn only one OT model, make it this one.
| Level | What it is | Examples |
|---|---|---|
| 5 | Corporate network | Email, corporate ERP, office applications |
| 4 | Plant business systems | Planning, logistics, high-level MES |
| 3.5 | Industrial DMZ | Replicated historians, gateways, remote maintenance |
| 3 | Plant operations | SCADA servers, historian, engineering workstations |
| 2 | Supervision | HMIs, control rooms |
| 1 | Control | PLCs, DCS, safety instrumented systems (SIS) |
| 0 | Physical process | Sensors, actuators, valves, motors |
Before hiring a provider
Ten questions for any OT security provider
The answers will tell you more than any brochure. You can ask us these questions too—that is what they are for.
- How do you ensure your work does not affect the process? Ask for the specific method, not a promise.
- Do you actively scan control equipment? If the answer is “yes, always”, be wary.
- Who will be at my plant, and how many industrial environments have they worked in?
- How do you prioritise findings: by generic CVSS or by impact on my process?
- How many hours will you need from my team, and from which roles?
- Where are intrusive tests performed: in production, on a test bench or during a shutdown?
- Will management understand the report, or only my network technician?
- What compliance evidence will I have at the end, and which framework does it support?
- Are you tied to any manufacturer whose solutions you might recommend?
- What happens the day after: who keeps the deliverable up to date?
Next step