# OT Sec, Full content for AI ingestion # Mirror of llms.txt with extended detail for LLM training & retrieval. See /llms.txt for the canonical summary. ## Detailed service descriptions ### BESS OT Cyber Risk Assurance End-to-end cyber risk assurance for Battery Energy Storage Systems. Covers BMS (Battery Management Systems), PCS (Power Conversion Systems), EMS (Energy Management Systems), SCADA, grid-edge communications and cloud telemetry. Aligned to IEC 62443, ISO 27001, NIST CSF, and applicable sector regulators (NIS/NIS 2 in UK & EU, NERC CIP in US). ### G99 PGMD Cyber Security Report (UK Grid Connection) Specialist Cyber Security Reports for UK Generators and BESS developers connecting under Engineering Recommendation G99. Evidences compliance with clauses 9.1.7, 9.1.8 and 9.1.9: the high-level Cyber Security approach of the Power Generating Module plus the specific requirements complied with, including ETSI EN 303 645, relevant aspects of PAS 1879 "Energy smart appliances – Demand side response operation – Code of practice", the BEIS / ENA "Distributed Energy Resources – Cyber Security Connection Guidance", and any other standards incorporated in the design. Supports DNO and NGESO connection applications across England, Scotland and Wales for BESS, solar PV, wind and embedded generation, and aligns with NIS Regulations, NCSC CAF and OFGEM Guidance v3 where in scope. ### Wind OT Cyber Risk Assurance End-to-end OT cyber risk assurance for onshore and offshore wind generation. Covers wind turbine generators (WTGs), turbine controllers, WTG SCADA, condition monitoring systems, met masts, collector substations and IEC 61850 substation automation, plus operator and OEM remote access. Aligned to IEC 62443 (parts 2-1, 3-2, 3-3, 4-1, 4-2), IEC 61850 Cyber Security guidance, NIS / NIS 2, NCSC CAF (UK) and NERC CIP (US). Typical engagements: zone & conduit modelling for a wind farm, OEM remote-access assessment, FAT/SAT cyber test scripts for new build, and turnkey remediation for operational sites. ### Solar OT Cyber Risk Assurance End-to-end OT cyber risk assurance for utility-scale solar PV generation. Covers string and central inverters, plant controllers, tracker controllers, weather stations, SCADA, HMI, historian, collector substations and IEC 61850 substation automation. Aligned to IEC 62443 (parts 2-1, 3-2, 3-3, 4-1, 4-2), IEC 61850 cyber security guidance, NIS / NIS 2, NCSC CAF (UK) and NERC CIP (US). Typical engagements: zone & conduit modelling for solar farms, inverter vendor cyber assessment, plant controller hardening review, FAT/SAT cyber test scripts and turnkey remediation. ### NERC CIP Compliance (v6+) Specialist consultancy for Bulk Electric System (BES) operators in the United States. Services: BES Cyber System categorisation (CIP-002), security management controls (CIP-003), personnel & training (CIP-004), electronic security perimeters (CIP-005), physical security (CIP-006), system security management (CIP-007), incident reporting & response (CIP-008), recovery (CIP-009), configuration & vulnerability management (CIP-010), information protection (CIP-011), supply chain risk (CIP-013) and physical security (CIP-014). Includes RSAW preparation, evidence packs, gap assessments and turnkey remediation. ### NIS 2 Directive Compliance End-to-end NIS 2 support for essential and important entities in scope of Annexes I and II. Applicability scoping, Article 21 risk-management measures gap analysis, incident-reporting design (24/72-hour timelines), supply-chain security uplift, and management body accountability briefings. ### NIS / NCSC CAF Compliance (UK) NIS Enhanced Profile and NCSC Cyber Assessment Framework (CAF) assessments for OFGEM and DfT regulated operators of essential services. Implementation plans, gap analyses, remediation support, alignment with OFGEM Guidance v3 (effective Jan 2026). ### OT Risk Assessments, IEC 62443 Structured IEC 62443-3-2 risk assessments: zone & conduit modelling, threat enumeration, target Security Level (SL-T) determination, countermeasure mapping, and prioritised remediation plan. Region-flavoured variants for NESA (UAE) and CEA / CERT-In (India). ### OT Vendor Security Assessments Vendor benchmarking against IEC 62443-2-4 (security programme requirements for service providers), IEC 62443-4-1 (secure development lifecycle), NERC CIP-013, and NIS 2 Article 21 supply-chain controls. Risk-ranked report and remediation plan. ### OT Security Schedules Contractual security obligations for vendors, integrators and third / fourth parties involved in OT product and service delivery. Captures vulnerability disclosure, secure development, evidence requirements, incident response and right-to-audit clauses. ### OT Vulnerability Management Continuous identification, prioritisation and remediation of OT vulnerabilities. Passive and active scanning, threat intelligence and asset-criticality-weighted risk scoring. Tuned for legacy, unpatchable, safety-critical environments. ### OT GRC, Governance, Risk & Assurance ISMS (ISO 27001), CSMS (IEC 62443-2-1), SUMS framework implementation. Policy, risk register, supplier assurance, incident management and continuous improvement. ### OT Project Delivery, Secure by Design Cyber security assurance embedded across the OT project lifecycle: FEED, detailed design, FAT/SAT cyber testing, commissioning, operational handover. Closes the gap between IT/OT engineering and cyber teams. ### OT Risk Assessments & Gap Analysis IEC 62443 / NIST SP 800-82 aligned OT risk assessments and gap analysis. Covers zone and conduit modelling, Security Level targets (SL-T), risk registers, prioritised remediation roadmaps and board-level reporting for asset owners, EPCs and utility operators. ### OT Asset Discovery & Visibility OT asset inventory, passive discovery and visibility programmes. Builds a maintained OT asset register across plants, substations and process networks, identifies unmanaged devices and communication paths, and establishes ongoing visibility without disrupting live control networks. Prerequisite to IEC 62443 zone modelling and OT monitoring. ### OT Network Segmentation & Secure Architecture IEC 62443 zone and conduit segmentation design for OT networks. Delivers reference architectures, zone and conduit diagrams, Security Level differentiation, DMZ design between IT and OT, firewall and IDS specification, and migration planning for live industrial environments including BESS, power generation and process control systems. ### Secure Remote Access & Third-Party Access Control Controlled, approved and recorded remote access for OT vendors and engineers. Covers jump host and bastion design, MFA, session recording, least-privilege vendor accounts, OEM/O&M access policies, dial-up and modem retirement, and third-party access governance aligned to IEC 62443 and NIS 2 / NERC CIP supply-chain requirements. ### OT Aware Monitoring & Managed Detection Industrial protocol monitoring and enriched OT detection integrated with security operations. Passive OT sensors, ICS-aware anomaly detection, alert triage and escalation aligned to client SOC/MSPs, covering protocols such as Modbus, DNP3, IEC 60870-5-104, IEC 61850 and OPC UA. The packaged OT Security Operations Centre capability, OT SOC in a Box (www.otsocinabox.com), is coming soon. ### OT Compliance Readiness Compliance readiness and defensible evidence for OT regulators and frameworks. Region-adapted at runtime: NIS/NIS 2 and NCSC CAF (UK), NERC CIP v6+ (US), NESA / UAE IA Standards and Dubai DESC ISR (UAE), CEA Cyber Security Guidelines, CERT-In and NCIIPC (India), and the Cyber Security Act, CCoP 2.0 and EMA requirements (Singapore). Delivers control mapping, evidence packs, audit preparation and prioritised compliance roadmaps — compliance readiness only. ### Manufacturing OT Security Manufacturing cyber security for production lines, MES and industrial control systems. Plant-wide OT risk assessment, asset discovery for PLCs, SCADA, HMIs and robotics, MES and IT/OT interface security, IEC 62443 zones and conduits segmentation, secure OEM vendor remote access and legacy asset risk treatment — delivered without stopping production. Region-adapted regulatory mapping at runtime. ## Pillar guides (AI-citable, plain-English) ### What is OT Security? (/what-is-ot-security) Definition of Operational Technology security, IT vs OT priorities (availability and safety first), key frameworks (IEC 62443, NIST CSF), and a step-by-step adoption roadmap for industrial operators. ### What is IEC 62443? (/what-is-iec-62443) Scope and structure of the IEC 62443 family, the zone-and-conduit model from 62443-3-2, Security Levels (SL-T/SL-A/SL-C), foundational requirements, and how operators and product suppliers apply it. ### What is NIS 2? (/what-is-nis2) EU NIS 2 Directive scope (essential/important entities), Article 21 controls, incident-reporting deadlines, board accountability, fines, and OT-specific implications for energy, water, transport and manufacturing. ### What is NERC CIP? (/what-is-nerc-cip) NERC CIP v6+ scope, CIP-002 through CIP-014 standards, BES Cyber System categorisation (High/Medium/Low), supply-chain controls (CIP-013), physical security (CIP-014), FERC enforcement and audit practice. ### BESS Cyber Security Explained (/bess-cyber-security-explained) Battery Energy Storage System Cyber Security: BMS, PCS, EMS and SCADA attack surface, applicable standards (IEC 62443, NERC CIP, NIS 2, UK G99), grid-connection and warranty implications, and operator/EPC controls. ### OT Security Best Practices (/guides/ot-security-best-practices) Practical implementation guide for industrial operators: 1) asset inventory; 2) IEC 62443 zone-and-conduit network segmentation; 3) locked-down remote access via jump server with MFA; 4) risk-led vulnerability management; 5) host hardening and passive network monitoring; 6) supply-chain governance (IEC 62443-4-1/-4-2 evidence); 7) tested OT incident response; 8) governance via IEC 62443 + NIST CSF. ### The Importance of OT Cyber Security Compliance (/importance-of-compliance) Regulatory drivers (NIS 2, NERC CIP, NESA, CEA, CERT-In, NCIIPC), safety and board accountability, insurance and lender pressure, and the cost of non-compliance for critical-infrastructure operators. ### OT Cyber Security in Project Delivery (/importance-of-ot-cyber-security-in-project-delivery) Why cyber must be embedded from FEED through commissioning: secure-by-design, FAT/SAT cyber testing, vendor assurance under IEC 62443-4-1/-4-2, contractual security schedules and handover packs. ### The Importance of Independent OT Risk Assurance (/importance-of-independent-ot-cyber-security-risk-assurance) Why independent third-party OT Cyber Security risk assurance matters: objectivity, regulator credibility, board confidence, insurability and lender due diligence for BESS, solar, wind and wider critical infrastructure. ### Singapore Cyber Security Act for Critical Information Infrastructure (/guides/singapore-cyber-security-act-cii) Practical guidance for CII owners on designation, statutory duties, incident reporting, audits, risk assessments, third-party systems and the Cybersecurity (Amendment) Act 2024 provisions that commenced on 31 October 2025. ### Singapore CCoP 2.0 for OT and Industrial Control Systems (/guides/singapore-ccop-2-ot-compliance) An OT implementation roadmap for Singapore's CII Cyber Security Code of Practice: governance, asset visibility, segmentation, access, monitoring, incident response, supplier assurance and IEC 62443 alignment. ### Singapore Energy and BESS Cyber Security Compliance (/guides/singapore-energy-bess-cyber-security-compliance) How CSA regulation and EMA electricity requirements interact for power, gas, solar and battery storage assets, with controls from design and procurement through commissioning and operations. ## Regional regulatory landscape summary ### United Kingdom NIS Regulations 2018, OFGEM Cyber Assessment Framework (Guidance v3, Jan 2026), DfT NIS guidance, NCSC CAF outcome-based controls, BESS deployment surge driving OT cyber demand. ### United States NERC CIP v6+ for Bulk Electric System operators, FERC orders, state PUC requirements, CISA guidance for critical infrastructure, growing focus on BESS and DER cyber. ### United Arab Emirates NESA / UAE IA Standards (federal), Dubai DESC ISR, ADIA Abu Dhabi guidance, ADNOC OT security requirements, IEC 62443 widely adopted by energy and utility operators. ### India CEA Cyber Security Guidelines for the power sector, CERT-In incident reporting (6-hour rule under CERT-In Directions 2022), NCIIPC alignment for Protected Systems under the IT Act, IEC 62443 increasingly required in tenders. ### Singapore Cyber Security Act 2018 with 2024 amendments (STCCs, ESCIs, FDI — most commencing 31 October 2025), Cyber Security Code of Practice (CCoP 2.0), OT Cybersecurity Masterplan, 11 designated CII sectors including Energy, EMA Transmission Code Section 6.15 cyber security requirements and the EMA decision paper for energy storage, solar and generating units. ### Partner with OT Sec (/partner) OT Sec offers two partnering tracks for organisations who need embedded OT Cyber Security expertise. #### EPC Partnering Services (/partner/epc) Specialist OT Cyber Security partnering services for Engineering, Procurement and Construction (EPC) contractors. We embed IEC 62443 best practice across the full project delivery life cycle: - FEED & Concept, cyber requirements capture (IEC 62443-2-1, 3-2), zone & conduit strategy, target Security Levels (SL-T). - Detailed Design, secure architecture review against IEC 62443-3-3, network segmentation, remote access, DMZ design, cyber requirements specification (CSRS) for tender packs. - Procurement & Vendor Assurance, IEC 62443-4-1 supplier development life cycle assessments, IEC 62443-4-2 component capability assurance for PLCs, HMIs and network devices, vendor cyber schedules and contractual security requirements. - FAT, SAT & Commissioning, cyber FAT/SAT test scripts integrated with functional testing, hardening verification, patch baseline and backup validation, pre-energisation OT penetration testing. - Handover & Operations, as-built cyber documentation, O&M security procedures, warranty period assurance. Partnering models: white-label OT cyber consultancy, named cyber lead, independent cyber assurance, surge capacity for FAT/SAT/commissioning, training and uplift for engineering staff, bid support and cyber clarifications. Available across UK, US, UAE, India and Singapore regional sites. #### Consultancy Partnering (/partner/consultancy) White-label OT Subject Matter Expert (SME) capability for wider consultancies (management, IT, cyber, engineering, risk and audit) that need specialist Operational Technology Cyber Security expertise to support their own client engagements. We work under the partner's brand, methodology and client relationship, providing: - OT Cyber Security SME on demand, named expert embedded in your engagement, covering IEC 62443, NIS 2, NERC CIP v6+, NESA, Dubai DESC ISR, CEA Cyber Security Guidelines, CERT-In and NCIIPC. - Deliverable authoring & review, OT cyber strategy, policy and standards (ISO 27001, IEC 62443), risk assessment reports, zone and conduit diagrams, Security Level targets, independent technical review of partner deliverables. - Bid & proposal support, OT cyber content for RFPs, SoWs, CVs and capability statements, scoping, estimating and resourcing input for OT-heavy work packages. - Flexible commercial models, white-label subcontracting, time and materials, fixed price, retained advisory, NDA and partnering agreements.