Security & Compliance

Air-gapped OT networks with unidirectional data diodes between field devices and analytics layer. Purdue Model architecture enforced across all deployments. Zero direct internet access from control network tier.

Hardware MFA mandatory for all privileged access. Zero-trust network access (ZTNA) via BeyondCorp-compatible broker. Just-in-time access provisioning with 1-hour session windows for production systems.

AES-256 at rest, TLS 1.3 in transit across all endpoints. Key management via HSM (Thales Luna Network HSM 7). Field device telemetry encrypted at ingestion using OPC-UA SecureChannel with certificate pinning.

Continuous OT anomaly detection via Claroty Platform integration. AI-powered SIEM (Microsoft Sentinel) correlates 840M+ log events per day. Mean time to detect (MTTD) < 4 minutes across all monitored segments.

Software Bill of Materials (SBOM) published for every release. Third-party components vetted against NIST NVD and CISA KEV. Firmware signed with code-signing certificates validated by hardware root of trust.

NIST CSF-aligned IR plan. Automated playbooks handle 80% of Tier 1 incidents without human intervention. Cyber crisis retainer with Mandiant. RTO < 15 minutes for non-OT tiers; OT recovery via immutable backup restoration.