- Home
- What we do
Assess. Design. Build.
One team takes the network from zone model to commissioning. The method is IEC 62443.
Assess
What is connected, what is exposed, what to fix first.
- The estate mapped into zones, each with a target security level (IEC 62443-3-2)
- The risks ranked by what they would do to operations
- The network as built, assessed by looking and never by scanning: how it is separated, where it would fail, who can get in remotely
- The gap analysis and evidence pack for a NIS / CAF assessment
- A costed plan of what to fix first
Design
How much protection each zone needs, and a network that provides it.
- Signalling data network design, checking and sign-off as Contractor's Responsible Engineer on resignalling and recontrol schemes, to EN 50159
- A secure architecture to IEC 62443-3-3: a controlled boundary with the office network, each zone separated, remote access brokered
- Resilient IP networks for signalling, SCADA and voice, each system kept separate, built around the existing estate
- Cyber requirements for tenders and contracts, and suppliers assessed against them (IEC 62443-2-4)
- Safety-case and type-approval impact checked before any change is proposed, with controls kept outside the safety system wherever possible
Build
Our engineers supply, install and commission it, in your outage window.
- Firewalls, data diodes and hardened hosts, from any vendor, chosen on fit to the estate
- Servers, operator screens and engineering laptops locked down, patched and backed up
- Vendor remote access that is approved, time-limited and recorded
- The network itself: fibre, switches, routers, wireless, cabinets and power
- Installed, tested and commissioned in possessions, turnarounds and outages, then checked against the security requirements and handed over with drawings, test results and the remaining risks
Defined scope, defined outputs.
OT Security Health Check
What is connected, what is exposed, what to fix first.
- What is connected, found without touching anything
- The biggest risks, ranked by what they would do to operations
- Quick wins and a plan
- Briefings for the board and for the engineers
IEC 62443 Zone & Conduit Assessment
A control centre and its sites, assessed zone by zone to IEC 62443-3-2.
- The estate mapped into zones
- The risks and what they would do
- A target security level for each zone
- A costed plan of what to fix first
Network Architecture & Resilience Review
The network as it really is, compared with how it should be and how available it needs to be.
- A drawing of the network as built
- The gaps against IEC 62443
- Where it would fail and how fast it would come back
- Options for the target network, with costs
Capital Project Cyber Assurance
Cyber security in a resignalling, electrification, telecoms or process project from specification to handover.
- Cyber requirements for the tender and the contract
- Suppliers assessed against them (IEC 62443-2-4)
- Security tests witnessed before and after installation
- Handover pack with the remaining risks
One contract. One team responsible for the outcome.
IPGS takes on a defined scope and delivers it with its own engineers, who hold the design authority and sign the deliverables. The scope can be a single design package or a whole programme, contracted direct or as a specialist subcontractor to your prime contractor. Who is responsible for what is written down at the start, and a live risk register runs to handover.
We deliver it
From a signalling data network design, checking and CRE package to a full assess, design, supply, build and commissioning programme. One contract, one point of contact, work planned around possessions, turnarounds and outages.
We assure it
On the client's side of the table: review and challenge of supplier designs and submissions, security requirements traced to evidence, and risks stated plainly to the programme board.
What we produce against each part.
| Part | What we produce | Phase |
|---|---|---|
| 62443-2-1 Security programme | CSMS maturity assessment (ML 1–4) with evidence; improvement plan; asset inventory | Assess |
| 62443-2-4 Service providers | Supplier and integrator capability assessment with scoring; contract clauses; our own delivery practices documented against the same requirements | Design, Build |
| 62443-3-2 Risk assessment and zoning | System under consideration; zone and conduit model; threat and consequence register; target security level per zone; costed roadmap | Assess |
| 62443-3-3 System requirements | Security requirements specification per zone (SRs and REs for the SL-T); design evidence per requirement; verification by inspection and passive capture at handover | Design, Build |
| 62443-4-1 / 4-2 Products and components | Component security requirements in tenders; review of supplier product security evidence; gap list and closure plan | Design |
Also mapped: the NCSC CAF for NIS obligations; EN 50159 and CSM-RA on rail; COMAH, API 1164 and ATEX / IECEx on process sites. Alignment describes the requirements our work addresses, not certification by a standards body.
The network carries the control, so we engineer it ourselves.
Resilient networks for signalling, SCADA, protection and voice, with the zones built into the network itself.
- Core and access networks, with each system kept separate
- Fibre and cabling, and wireless for depots, stations and plants
- Firewalls, data diodes and remote access brokers
- Supplied, installed and commissioned by our own engineers, around possessions and outages
Design
Architecture and detailed design: security, timing, resilience.
Supply
Procurement, staging and pre-configuration, any vendor.
Deploy
Installation, commissioning, test results, handover.
Through the wider IPGS group
Some things an OT programme needs come from other IPGS practices, under the same contract: penetration testing, security monitoring, telecoms core, RAN and transport engineering, private cloud, and managed services after go-live. The OT team keeps the design authority and stays your single point of contact.
Scope an engagement
Send the requirement. We will propose the shortest route to a defined outcome.