Resources
Technical documentation, training material and reference guides.
A library built from the field
We gather here the material we use daily with our clients: methodology guides, standard summaries, assessment checklists and training content dedicated to the security of SCADA, ICS and DCS systems.
What the library covers
Four families of documents. None of it is marketing material: everything here is something we use ourselves on an engagement, which is also why we would rather know who is reading it.
Standards
Working summaries of the texts that govern industrial cybersecurity — IEC 62443 and its parts, NIS2, ISO 27001, and the Machinery Regulation (EU) 2023/1230 which brings cybersecurity into the scope of machine conformity from 2027. We keep them as reading aids: what a requirement actually asks for, and what counts as evidence.
Methodology
The way we run an engagement, written down: how to scope a zone and conduit model, how to build a threat scenario that a plant manager will recognise, how to weigh a consequence on a process rather than on a server, and how to sequence a remediation plan so that it survives a budget cycle.
Assessment checklists
The lists we work from on site. They are dull on purpose: they exist so that nothing is skipped when the visit is short, the plant is loud and the person who knows the installation is available for twenty minutes.
Courses and exercises
Training material used with our clients' teams, including guided exercises with detailed answers. Industrial cybersecurity fails far more often on people who were never trained than on equipment that was badly configured.
Who it is written for
Industrial cybersecurity is one of the rare subjects where three very different audiences have to agree on the same document. We write with all three in mind.
Plant and operations teams
The people who will live with the decisions. The material is written to be usable without a security background, because that is who is actually on site.
OT and automation engineers
Those who know the process and the equipment, and need the security requirements translated into terms that apply to a controller rather than a server.
Compliance and risk managers
Those who have to produce the file. The standards material is organised around what an auditor asks for, and what satisfies them.
Looking for something we have not published?
If you are working towards a specific standard or preparing an audit, tell us which one. We will point you to the relevant material, and to the parts of the standard that usually cause trouble.
Ask us