Industry
Nuclear & High-Hazard Environments
Evidence-focused assurance for regulated engineering environments with strict change control, supplier review, and documentation requirements.
Sector context
Nuclear and high-hazard environments require a higher level of assurance, evidence and configuration control than most industrial sectors. Cybersecurity must support safety, security, reliability and regulatory confidence without introducing unnecessary operational risk.
These environments can include nuclear generation, decommissioning, waste processing, fuel handling, high-integrity control systems, hazardous process facilities and safety-significant industrial systems.
Common OT cybersecurity problems in nuclear and high-hazard environments
Typical issues include
- Legacy control and safety systems
- Strict change control requirements
- Air-gap assumptions that need evidence
- Complex supplier and integrator interfaces
- High documentation expectations
- Cybersecurity requirements introduced into existing engineering processes
- Difficulty linking cyber controls to safety and operational constraints
- Need for clear audit trails and verification evidence
Relevant services
- Engineering assurance
- IEC 62443 support
- Documentation support
- FAT/SAT review
- Cybersecurity risk assessment
- Supplier evidence review
Stakeholders involved
Decisions and constraints
- Operations need safe and reliable plant
- Safety teams need confidence that cyber controls do not compromise safety functions
- Security teams need protection against unauthorised access and change
- Engineering teams need controlled, technically justified modifications
- Quality and assurance teams need traceable evidence
- Senior stakeholders need confidence that risk is being reduced in a defensible way
Relevant engineering work
Activities
- OT cybersecurity readiness reviews
- IEC 62443-aligned system scoping
- SuC definition, zones, conduits and interface clarification
- Cybersecurity requirements review
- Network architecture and segregation review
- Supplier evidence and document review
- FAT, SAT and commissioning evidence support
- Cybersecurity risk assessment support
- Audit and assurance evidence gap reviews
- Practical improvement plans aligned with change control constraints
Nuclear and other high-hazard requirements
UK civil nuclear security has its own regulatory framework, including the Office for Nuclear Regulation's Security Assessment Principles. Nuclear security and cyber or information-assurance obligations must be determined within that framework and the dutyholder's specific requirements.
For other high-hazard sites, HSE and COMAH requirements may provide a different context. IEC 62443 may support technical system or supplier assurance where applicable, but it does not replace ONR nuclear security requirements, HSE expectations or the relevant safety obligations.
Practical outcome
Decisions the review should support
- What is in scope and why
- Which interfaces matter
- Which assumptions need evidence
- Where segregation or access control needs improvement
- What verification evidence is missing
- Which actions are proportionate and technically justified
- How cybersecurity can support the wider safety and assurance case
Worked example
- Context
- A high-hazard industrial facility is preparing to accept a control system modification, but its cybersecurity documentation and verification evidence need independent review.
- Review focus
- Meridian can clarify system boundaries, review supplier evidence and identify verification gaps for the project team to address before acceptance.
Worked technical example only; it does not describe a completed Meridian client engagement.
Standards and guidance references
The following external references provide useful context for organisations considering OT cybersecurity, assurance, NIS alignment or IEC 62443-based control system security work.
Related OT cybersecurity topics
Related services
Choose this when your project needs specialist engineering capacity. A defined OT cybersecurity work package for risk, architecture, design review, supplier interfaces and assurance evidence within an active industrial project.
Start here if you are unsure what applies or where to begin. Establish the boundary, applicable lifecycle context, available evidence and next engineering work before a detailed IEC 62443 assessment or project decision.
Discuss nuclear & high-hazard environments OT cybersecurity
Make an enquiry about the control system, project stage, documentation gap or assurance requirement without exposing sensitive site or client details.