OT & Critical Networks: capability statement
IP Global Services · OT cyber security and critical network engineering for rail, energy, oil and gas
+44 (0)118 206 6657
Who we are
A team of operational network, SCADA and OT security engineers within IP Global Services. We assess, design and build secure operational networks using IEC 62443 as the working method. Our deepest experience is railway signalling, operational telecoms and traction power systems, alongside substation, utility and power station SCADA and carrier networks; we apply the same method across energy, oil and gas.
What is different
- One team, end to end. Assessment, design and network build under one contract, by the same engineers. Operational technology is a separate discipline within IPGS, staffed and billed apart from telecoms and enterprise IT.
- Two ways to engage. We deliver a defined scope under one contract, direct or through your prime contractor, from a signalling data network design and CRE package to a full programme, with our engineers holding the design authority; or we assure it, on the client's side, reviewing and challenging supplier designs. Who is responsible for what is written down at the start, and a live risk register runs to handover.
- The wider group behind it. Penetration testing, SOC-style monitoring, telecoms core, RAN and transport engineering, private cloud and managed services from other IPGS practices, under the same contract.
- IEC 62443 on every engagement. Zones, conduits and target security levels defined before controls are chosen; every deliverable cites the requirement it addresses.
- Operations first. Passive methods on live networks, work planned around possessions and outages, safety-case impact assessed before change.
- Engineering depth. IP/MPLS and VPLS, industrial Ethernet, fibre and wireless LAN designed and built by our own engineers.
Sectors
| Rail & metro | Signalling data networks (interlockings, object controllers, CBTC), operational telecoms (IP/MPLS, FTN / FTNx integration), traction power SCADA, control centres, stations and depots. IEC 62443, EN 50159, CSM-RA, NIS (DfT). |
| Energy, oil & gas | Substation automation and electrification SCADA (IEC 61850, IEC 104, DNP3), power station control networks, utility telemetry, terminals, pipelines, process plants, DCS and safety instrumented systems, vendor packages. IEC 62443 alongside the site's safety case, COMAH, API 1164, NIS. |
Standards
IEC 62443 (2-1, 2-3, 2-4, 3-2, 3-3, 4-1, 4-2) as the working method. NCSC Cyber Assessment Framework and NIS Regulations for UK operators of essential services; EU NIS2. Rail: EN 50159, EN 50126 / 50128 / 50129, CSM-RA, infrastructure manager telecoms and signalling standards. Process: COMAH, API 1164. NIST CSF 2.0 for reporting where the client's group uses it.
Services
Packaged engagements
| OT Security Health Check | One site or system. Asset snapshot, top risks by consequence, quick wins, roadmap. |
| IEC 62443 Zone & Conduit Assessment | One estate. Zone model, SL-T per zone, costed roadmap. |
| Architecture & Resilience Review | One network. As-built pack, gap analysis, target architecture options. |
| Capital Project Cyber Assurance | One project. Requirements, supplier assessment to 62443-2-4, FAT/SAT witnessing, handover pack. |
Engineering capability
- IP/MPLS, MPLS-TP and segment routing cores; VRF-per-zone; traffic engineering and fast reroute
- Carrier Ethernet, ERPS and MPLS-TP access rings; ruggedised industrial switching for lineside, substation and plant
- Fibre (incl. DWDM/CWDM), licensed microwave, diverse-path design, cabinets and power for harsh environments
- Network management systems, configuration control and Ansible automation for repeatable builds
- Wireless LAN for depots, stations and plants; CBTC data bearers; mobile RAN and core background
- Industrial firewalls and DMZs, data diodes, access brokers, SPAN/TAP provision for monitoring platforms, protocol-aware policy (IEC 104, DNP3, IEC 61850, Modbus, OPC UA); host hardening, allow-listing, patching, backup and recovery for OT servers, HMIs and engineering workstations
Team and assurance
Eight engineers with more than 110 years' combined experience on over 90 programmes: UK mainline resignalling and recontrol, rail operating centres, London Underground, Crossrail, international metro CBTC, operational telecoms transmission, electrification and traction power SCADA, utility and power station control networks, and defence networks. Roles held include Contractor's Responsible Engineer, design authority, design manager and technical authority. Certifications across the team include CISSP, CEng, IRSE licences, ISA/IEC 62443 Cybersecurity Fundamentals Specialist and Cisco, Juniper, Nokia and Westermo professional certifications. CVs are provided with proposals. IP Global Services holds ISO 27001, ISO 9001:2015, ISO 45001 and Cyber Essentials Plus; certificate scopes, insurance and supplier-assurance registrations are provided on request. Individual engineer certifications are listed in proposals. References available under NDA.
