Architecture & Zoning
- Purdue Model Level 0–5 architecture design and re-architecture
- IEC 62443-3-2 zones-and-conduits definition, with Target Security Levels (SL-T) per zone
- Cybersecurity Requirements Specification (CRS) suitable for EPC or systems-integrator tender
- IT/OT convergence architecture and Industrial DMZ (iDMZ) design
- Safety-cyber interface: separation and interaction of SIS (IEC 61511) and BPCS under cyber events
Segmentation & Conduit Control
- Network segmentation strategy for brownfield sites — staged, availability-safe migration paths
- Firewall rulebase design, policy hardening, and conduit documentation
- Micro-segmentation design for high-consequence cells (SIS, turbine control, GPU fabric)
- East–west traffic control between production cells, utilities, and shared services
- Data diode and unidirectional gateway specification where one-way flow is mandated (regulated, safety-critical)
Asset Visibility as a Design Input
- Passive asset discovery and network baselining (vendor-neutral — typically Claroty, Nozomi, Dragos, Tenable OT, Armis; selection driven by environment, not partnership)
- Flow mapping and conduit validation against the as-designed architecture
- Shadow-OT identification and integration into the zone model
Secure Remote & Third-Party Access
- Remote access architecture: jump-server, broker, and zero-trust patterns for OEMs and maintenance vendors
- Privileged session recording and just-in-time access design
- Third-party risk boundary — contractual and technical, not just contractual