Compliance & Standards.

Securing industrial automation and control systems

What it is

ISA/IEC 62443 is the leading international series of standards for the cybersecurity of Industrial Automation and Control Systems (IACS). Part 3-3 is the most operationally referenced document in the series: it defines the technical system security requirements and the security levels used to design and assess a control system.

Per IEC, Part 3-3 “provides detailed technical control system requirements (SRs) associated with the seven foundational requirements (FRs)” and defines control-system capability security levels.

Who it's for

Asset owners, system integrators, and product suppliers across critical infrastructure, manufacturing, energy, and process industries. It's increasingly referenced by regulation — for example, it underpins requirements tied to the EU's NIS2 directive and is central to ISASecure certification.

The core ideas Basalt models

• Zones and conduits. A zone is a grouping of assets that share the same security requirements; a conduit is the protected communication path between zones. In Basalt, zones are nestable containers (plant → line → cell) and every cross-zone connection is a typed conduit that must pass through an enforcement point at the boundary.
• The seven Foundational Requirements. Identification & authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability. Restricted data flow (FR5) is the requirement that justifies segmentation.
• Security Levels (SL 1–4). Levels are defined by the sophistication of the adversary they resist — from casual violation (SL 1) up to a well-resourced, IACS-skilled attacker (SL 4). Basalt distinguishes the target level a zone is designed to meet from the capability of the components chosen to meet it.

In a diagram

A 62443-aligned architecture reads as a set of nested, security-labeled zones joined only through conduits that cross boundaries at firewalls, DMZs, or data diodes — with the IT/OT line drawn explicitly. Basalt flags the anti-patterns assessors look for: flat OT networks, a router-only IT/OT boundary, zones with no boundary device, or a safety system that isn't isolated.

Official source: ISA and IEC — the ISA/IEC 62443 series.

The functional hierarchy underneath OT

What it is

The Purdue Enterprise Reference Architecture (PERA) organizes an industrial environment into ordered levels, from the physical process at the bottom to enterprise business systems at the top. ISA-95 formalizes the upper-level relationship between enterprise and operations systems. Together they are the vertical spine almost every OT security architecture is drawn against.

The levels

• Level 0 — Process: the physical equipment itself — sensors, actuators, drives.
• Level 1 — Basic control: PLCs, DCS controllers, RTUs, and safety controllers.
• Level 2 — Supervisory control: SCADA, HMIs, historians, DCS supervisory systems.
• Level 3 — Operations management: MES/MOM, production scheduling, quality and records.
• Level 4 — Business planning & logistics: ERP, scheduling, inventory (ISA-95 territory).
• Level 5 — Enterprise: corporate IT, the internet edge, cloud.

The Industrial DMZ

Between the operations levels (3 and below) and the enterprise levels (4–5) sits the Industrial DMZ — the single controlled crossing between IT and OT. It isn't a Purdue "level"; it's a buffer zone. A correct OT diagram shows it explicitly, and no connection passes straight through it — flows terminate in the DMZ and are re-originated.

In a diagram

Basalt renders levels as strictly ordered bands, inserts the IDMZ whenever IT and OT need to exchange data, and enforces the trust gradient — least trusted at the enterprise edge, most controlled at the process. Cross-level shortcuts that jump from Level 4 to Level 1 without passing through the intervening boundary are flagged as architecture flaws, not style choices.

Governance and outcomes

What it is

Where 62443 and Purdue describe topology, NIST CSF describes governance. It's a technology-neutral taxonomy of cybersecurity outcomes that applies across IT, OT, IoT, cloud, and AI. Published as NIST CSWP 29 in February 2024, CSF 2.0 is voluntary but is the single most widely referenced framework in the industry.

The six Functions

• Govern — the risk strategy, roles, and policy that inform everything else. New in 2.0, it sits at the center of the model.
• Identify — understanding assets, suppliers, and risks.
• Protect — the safeguards that manage risk.
• Detect — finding and analyzing possible attacks.
• Respond — acting on a detected incident.
• Recover — restoring assets and operations.

A key subtlety Basalt respects: these are not a linear pipeline. Govern, Identify, Protect, and Detect run continuously; Respond and Recover are ready at all times and fire on an incident. A CSF diagram that draws the six Functions as a left-to-right sequence misrepresents the model.

Structure

The framework breaks each Function into Categories and Subcategories with fixed identifiers (for example, GV.SC for supply-chain risk management — a major emphasis added in 2.0). Basalt keeps categories under their correct Function and preserves the framework's intentional, non-sequential numbering. It also supports the Tier ladder (Partial → Risk Informed → Repeatable → Adaptive) and the Current / Target / Community Profile workflow.

Official source: NIST Cybersecurity Framework 2.0 (NIST CSWP 29).

The Cisco / Rockwell reference architecture

What it is

CPwE is the joint Cisco and Rockwell Automation design guidance for building secure, resilient plant-floor networks. It's built on the Purdue model and ISA-99/IEC 62443, and it's the reference most integrators reach for when translating security principles into an actual switched network.

What it adds

• A concrete zone stack — Enterprise Zone (Levels 4–5), DMZ as the buffer, Manufacturing Zone (Levels 0–3), and nested Cell/Area Zones (Levels 0–2).
• A Safety Zone for safety-critical systems that stays logically distinct even when it shares a network.
• The access / distribution / core hierarchy overlaid on the zones, with the distribution layer as the Layer-2/Layer-3 demarcation.
• Correctly typed links — routed Layer-3 links, Layer-2 trunks, and single-VLAN access links.

The hard rules

CPwE is strict about a few things Basalt enforces: the DMZ is the only connection point between Manufacturing and Enterprise; no traffic traverses the DMZ; IACS protocols never appear on links leaving the Manufacturing zone; and remote access is always proxied through the DMZ, never direct to control devices.

Official source: Cisco & Rockwell Automation — the Converged Plantwide Ethernet Design Guide.

Computerized system validation for regulated pharma

What it is

GAMP 5 is ISPE's guidance for Computerized System Validation (CSV) in GxP-regulated pharmaceutical environments. It isn't law, but it's the de facto standard, and it maps directly onto FDA 21 CFR Part 11 and EU GMP Annex 11. The current line is GAMP 5, Second Edition (2022).

Why it's different

Unlike the network-topology frameworks above, GAMP 5 is about process and lifecycle — so a "GAMP-compliant diagram" is usually a validation lifecycle, a V-model, or a traceability flow, not a network map.

The core ideas Basalt models

• The V-model. Each specification on the left (User Requirements → Functional → Design) pairs with its verification on the right (PQ → OQ → IQ), joined by horizontal traceability links. Basalt keeps IQ, OQ, and PQ in their correct meanings and preserves the requirement-to-test pairing.
• The lifecycle. Concept → Project → Operation → Retirement, in order, with the long Operation phase showing change control, periodic review, and re-validation.
• Risk-based, scalable validation. Rigor scales with risk and software category — from infrastructure, through configured products, up to custom applications.
• The QMS and quality-risk-management umbrella, aligned with ICH Q9, enclosing the whole lifecycle.

Basalt can also overlay the regulatory anchors teams are assessed against — 21 CFR Part 11 controls, EU Annex 11, and ALCOA+ data-integrity principles.

Official source: ISPE GAMP 5 (2nd Edition), with FDA 21 CFR Part 11 and EU GMP Annex 11.

The practitioner's overlay

What it is

The SANS Five ICS Critical Controls are a prioritized, practitioner-focused set of the controls that matter most in operational technology. They're not a topology standard on their own; they're an overlay that tells you what protections and separations must be visible on an ICS architecture.

The five controls

1. ICS incident response — a plan tailored to the facility and process, including the ability to operate in manual mode.
2. Defensible architecture — visibility, segmentation, and enforced process communications, with IT/OT segmentation as the top priority.
3. ICS network visibility & monitoring — continuous, protocol-aware monitoring, ideally through an OT or merged IT/OT SOC.
4. Secure remote access — multi-factor authentication, a jump host, session recording, and least privilege; never ad-hoc or back-door.
5. Risk-based vulnerability management — assessing each vulnerability by impact and attack vector rather than blanket patching.

The architecture rules Basalt enforces

SANS translates into concrete pass/fail structure: safety instrumented systems must be firewall-restricted or air-gapped and never share a flat network with enterprise IT; no OT asset may be dual-homed with IT; the IT/OT boundary must be explicit; the interior of the OT network must be hardened rather than relying on a perimeter alone; and where data must leave OT for IT, a unidirectional gateway (data diode) is preferred. Because IT-to-OT is the single most common attack path into industrial environments, Basalt treats every IT/OT crossing as a controlled choke point.

Official source: SANS Institute — The Five ICS Cybersecurity Critical Controls.

Guide to OT security

What it is

NIST Special Publication 800-82 is the U.S. government's guide to securing operational technology. It complements the Purdue model with a formal network-zone taxonomy — public access, operations, restricted, and industrial-control-restricted zones — and a strict set of rules for which zones may connect to which, and through what.

How Basalt uses it

As a second, orthogonal segmentation overlay on top of the Purdue level stack: the industrial-control zone is prohibited from connecting directly to the public-facing zone; every inter-zone link is an approved conduit rather than an ad-hoc crossing; and no routable segment or host may span two zones. It pairs naturally with the risk gradient — impact rises as you descend from enterprise toward the physical process, where a failure can mean loss of life.

Official source: NIST SP 800-82 — Guide to Operational Technology (OT) Security.

The difference isn't that Basalt knows these frameworks — it's where that knowledge lives.