Stakeholder
Compliance & Assurance
For teams that need requirements, evidence, exceptions and open actions traced through review and close-out.
Decisions and constraints for this role
Questions likely to need resolution
- defensible evidence
- requirements traceability
- audit readiness
- IEC 62443 interpretation
- CAF alignment
- cybersecurity governance
- verification evidence
Review focus
Meridian helps assurance teams trace requirements through scope, assumptions, verification records, residual risks and close-out actions.
Work and outputs
Engineering work
- Clarify scope, assumptions, boundaries, and evidence expectations for assurance and review activity.
- Map project or site evidence against IEC 62443-aligned requirements, CAF-style considerations, or internal controls.
- Identify gaps in a way that supports accountable close-out rather than vague compliance statements.
- Produce concise evidence packs that help reviewers understand what has been checked, what remains open, and why.
Records produced
- Assurance evidence matrix
- IEC 62443-aligned gap review
- Cybersecurity action and close-out tracker
- Verification evidence plan
- Review summary for audit or governance discussion
Evidence by responsible party
Assurance starts by identifying the applicable requirement, the available evidence, the gap, the action owner and how closure will be demonstrated. IEC 62443 evidence supports wider CAF, NIS and client assurance where relevant; it does not by itself establish regulatory compliance.
| Responsible party | Relevant reference | Example evidence |
|---|---|---|
| Asset owner or operator | IEC 62443-2-1 where applicable | Programme responsibilities, operational controls and records |
| Integrator or service provider | IEC 62443-2-4 where applicable | Delivery, maintenance, access and supplier process evidence |
| System design and engineering | IEC 62443-3-2 and 3-3 where applicable | Risk basis, zones and conduits, system requirements and verification |
| Product developer or component supplier | IEC 62443-4-1 and 4-2 where applicable | Development practices and component capability evidence |
A scoped review can produce an evidence map, gap register, remediation tracker and supplier or project assurance record. The appropriate route depends on the requirement and current evidence.
Related industries
These sectors commonly create the operating constraints, supplier dependencies, and assurance pressures relevant to this audience.
Gas & Energy Infrastructure
OT cybersecurity support for gas transmission, energy infrastructure, compressor control, telemetry, vendor access, safety interfaces and assurance requirements.
Industry approach
Water Utilities
Cybersecurity and documentation support for remote pumping stations, telemetry, legacy PLCs, mixed vendor estates, and ageing SCADA platforms.
Industry approach
Offshore & Process Industries
Assurance for vendor package systems, remote support links, strict change control, safety interfaces, and constrained maintenance windows.
Industry approach
Nuclear & High-Hazard Environments
Evidence-focused assurance for regulated engineering environments with strict change control, supplier review, and documentation requirements.
Industry approachRelevant technical capabilities
These engineering activities can be included in a scoped engagement.
Assure
IEC 62443 consultancy and project support
IEC 62443-aligned engineering support for project teams and integrators: define the system boundary, review supplier requirements and organise traceable design and verification evidence.
View capability detailsAssure
Engineering Assurance
Independent review of supplier designs, FAT/SAT evidence, cybersecurity documentation, and project close-out evidence for control system delivery.
View capability detailsRisk
IEC 62443-Aligned OT Cyber Risk Assessments
Structured assessment of credible cyber threat scenarios, operational consequences, existing controls and risk treatments for a defined industrial control system.
View capability detailsDocument
Documentation & Design Support
Network drawings, IP schedules, firewall schedules, interface registers, cybersecurity procedures, and FAT/SAT documentation that support assurance and maintainability.
View capability detailsRelated services
Choose this when you need a detailed view against agreed requirements. Requirement-by-requirement review of current arrangements and evidence against an agreed IEC 62443 baseline, producing a classified gap register and remediation roadmap.
Start here if you are unsure what applies or where to begin. Establish the boundary, applicable lifecycle context, available evidence and next engineering work before a detailed IEC 62443 assessment or project decision.
Plan a practical assurance approach
Use the discovery call to discuss the responsibility, project stage, evidence gap or operating constraint without sharing sensitive site details.