Operational technology in the ISMS, without a second inventory
A controller is not a server, and the question "what security level does our production have" has no single-digit answer. IEC 62443 requires zones with a shared protection need, conduits as the only permitted paths between them, and per zone a security level that is a vector across seven foundational requirements: target and achieved, per FR 1 to FR 7. The module keeps exactly that, and it creates no second inventory for it: every OT device remains an IT system of the existing inventory with its networks, rooms, vulnerabilities and risks, and gains an OT profile with device type, Purdue level, firmware version, vendor support and safety relevance. Risk assessment, catalogue, remote access register, patch decisions and sensor alerts build on that.
A zone’s security level is shown as a vector, "SL 2 {3 2 2 1 2 1 2}", target and achieved kept apart. The gap is computed per foundational requirement and turns red as soon as it is greater than zero anywhere. If the zone has no achieved level, the minimum of the device capabilities applies, and without either there is no gap, only a notice.
IT systems carry no firmware version, so CSAF matching came up empty for controllers. The OT profile feeds vendor, product and firmware to the matching as candidates, and every hit becomes a patch decision with a deadline by severity. If the profile requires vendor approval, no change and no rollout target can be created without it.
Whatever runs between two zones and is in no conduit is a violation. Sensor alerts from Claroty, Nozomi or Dragos are placed into the zone model via the SIEM, observed traffic is held against the conduits in the communication matrix, and conduits with enforcement "none" are counted separately by the cockpit.
Operational technology sits in the same ISMS as IT, with a security level that is evidenced per zone and foundational requirement rather than a single number on a slide.
Schedule a no-obligation demo – we will show you the module with your own use cases.
