Industrial lifting equipment supporting an engineering project

Services

OT Cybersecurity Engineering Support

A defined OT cybersecurity work package for risk, architecture, design review, supplier interfaces and assurance evidence within an active industrial project.

Discuss Your Project View services

Specialist capacity tied to a defined work package

This service adds OT cybersecurity engineering to an existing project team. The work package names the deliverables, design interfaces, review points and responsibilities; it is not an open-ended advisory retainer.

Meridian can work with the asset owner, integrator, package supplier and assurance team, while design authority, change approval and residual-risk acceptance remain with the responsible project organisations.

Information needed to define the work package

Project stage, delivery programme, customer cybersecurity specification and scope of responsibility
Available PLC/SCADA architecture, interfaces, design records and supplier documentation
Engineering contacts, review arrangements and operational or change-control constraints

Support through the project lifecycle

Definition

Clarify responsibilities, system boundary, customer requirements, interfaces and the artefacts the project must produce.

Design

Develop or review risk, zones and conduits, security requirements, architecture, supplier responses and implementation assumptions.

Build and test

Turn requirements into review points and FAT checks, record deviations and identify site-dependent verification for SAT.

Commissioning and handover

Close actions, verify installed interfaces, reconcile final records and organise the evidence needed for acceptance and operation.

Cybersecurity actions need the same project controls as other engineering work: a requirement, an owner, an interface, a due point and evidence that supports closure.

Engineering support by organisational role

Asset Owner / Operator

Owns or operates the industrial system and remains accountable for operational risk, governance and acceptance decisions.

Typical organisations

Utilities and infrastructure operators · Process and manufacturing site operators · Owners of operational technology estates

Common trigger

A programme, site or project needs a clear responsibility boundary, risk basis and evidence plan.

IEC 62443 context

• IEC 62443-2-1 for the asset owner security programme
• IEC 62443-3-2 and 3-3 for system risk, design requirements and verification

Relevant technical capabilities

Assess Risk Segment Assure

Problems this role often needs to resolve

IEC 62443 Requirements and Evidence Poor Asset Visibility Project Cybersecurity Assurance

• Define the system under consideration and operational constraints
• Set project and supplier cybersecurity requirements
• Review architecture, risk, FAT/SAT evidence and handover records

Start with a readiness review

System Integrator / IACS Service Provider

Designs, integrates, commissions or maintains industrial automation systems within an agreed customer and project scope.

Typical organisations

Control system integrators · Automation and electrical contractors · IACS maintenance and support providers

Common trigger

Customer requirements must be translated into delivery processes, engineering records and acceptance evidence.

IEC 62443 context

• IEC 62443-2-4 for security programme requirements for IACS service providers
• IEC 62443-3-2 and 3-3 where the scope includes system risk, design or verification

Relevant technical capabilities

Assure Assure Document Segment

Problems this role often needs to resolve

Supplier Package Integration Project Cybersecurity Assurance IEC 62443 Requirements and Evidence

• Translate customer requirements into an engineering work package
• Develop or review zones, conduits and secure architecture
• Prepare supplier responses, FAT/SAT checks and close-out evidence

Discuss engineering support

Product Supplier / Product Developer

Develops or supplies industrial automation products and is responsible for the product lifecycle and stated component capabilities.

Typical organisations

Industrial software developers · Control and protection product suppliers · Component and embedded-device developers

Common trigger

A product roadmap, customer requirement or assurance review needs a defined development and component evidence baseline.

IEC 62443 context

• IEC 62443-4-1 for the secure product development lifecycle
• IEC 62443-4-2 for technical security requirements of IACS components where applicable

Relevant technical capabilities

Assure Document Assure

Problems this role often needs to resolve

IEC 62443 Requirements and Evidence Project Cybersecurity Assurance

• Define product security requirements and evidence expectations
• Review development artefacts and component security documentation
• Support customer evidence responses without extending claims beyond the assessed product

Discuss a gap assessment

OEM / Machine Builder / Package Supplier

Delivers a machine or packaged system that combines products, integration work and project-specific interfaces.

Typical organisations

Machine builders · Skid and package-system suppliers · OEM engineering and delivery teams

Common trigger

A packaged system must meet customer requirements and integrate into the site without unclear responsibility or evidence gaps.

IEC 62443 context

• IEC 62443-2-4 where the organisation performs integration or service-provider activities
• IEC 62443-3-2 and 3-3 for the packaged system where system responsibilities are in scope
• IEC 62443-4-1 and 4-2 only where the organisation develops products or claims component capabilities

Relevant technical capabilities

Assure Assure Document Segment

Problems this role often needs to resolve

Supplier Package Integration Project Cybersecurity Assurance Insecure Remote Access

• Define package boundaries, interfaces and responsibility splits
• Review architecture, hardening and supplier evidence
• Prepare FAT/SAT checks, deviations and handover records

Start with a readiness review

The applicable IEC 62443 publications and requirements depend on the organisational role, system or product boundary, lifecycle stage, contractual requirements and agreed scope. These references do not state certification or compliance.

Engineering activities and artefacts

Activities available within the agreed package

Agreed work package, responsibilities, review points and deliverables integrated with the project team
Cybersecurity risk assessment, system boundaries, zones and conduits, and risk-based SL-T definition
Cybersecurity requirements, secure architecture, segmentation and hardening guidance
Design review, IEC 62443 documentation and supplier cybersecurity requirements
CAF/NIS, sector or client evidence mapping and remediation tracking
Cybersecurity review of safety-system interfaces without replacing functional-safety assessment
FAT/SAT cybersecurity support and project assurance evidence

Outputs agreed for the project

Agreed engineering work package and deliverable schedule
Scoped outputs such as a risk register, zone and conduit model, requirements specification or architecture review
Review comments, assumptions and action tracker
Verification or handover evidence where included in the scope

Interfaces and scope boundaries

Working with the project team

Review dates, supplier inputs, document-control status and acceptance criteria are agreed with the existing delivery process. Assumptions and blocked actions remain visible rather than being absorbed into a generic report.

Not included

An unlimited retainer, managed SOC or continuous monitoring service
Live configuration changes or intrusive testing without an agreed method, authorisation and operational controls
Certification, guaranteed compliance or acceptance of residual risk on your behalf

Compare the other engagement routes

IEC 62443 Readiness Review

Start here if you are unsure what applies or where to begin.

IEC 62443 Gap Assessment

Choose this when you need a detailed view against agreed requirements.

Related capabilities and guidance

Discuss the scope with Meridian

Use the 30-minute introductory call to outline the system, decision, project stage and evidence currently available. Keep sensitive site details out of the booking form.

Discuss Your Project