OT and ICS cybersecurity for operators of critical services
Operational technology was built for availability and safety, not for connection to IT networks. IRM-Advisors assesses OT and industrial control environments and builds a programme that operations teams can live with.
- Pricing
- Fixed price, quoted after a 30-minute scoping call.
Since 1 April 2025, operators of critical infrastructure in Switzerland must report cyberattacks to the National Cyber Security Centre (NCSC) within 24 hours of discovery. Fines of up to CHF 100,000 for failing to report apply from 1 October 2025.
Who it is for
- Energy and electricity companies, including cantonal and municipal utilities
- Water suppliers and other critical infrastructure operators
- Manufacturers and pharmaceutical sites with connected production systems
What you receive
- An OT asset and network architecture review
- An IEC 62443-based risk assessment with a zones and conduits model
- A gap assessment against the Swiss ICT minimum standard
- Incident response and NCSC reporting readiness
- An IT/OT governance model and roadmap
How it works
- Site visitSite visits and interviews with operations, engineering and IT.
- ArchitectureDocument assets, connections and remote access paths.
- Risk assessmentAssess zones, conduits and target security levels using IEC 62443.
- RoadmapPrioritised measures that respect safety and production constraints.
Relevant credentials
Selected engagements
- Swiss electricity grid operatorCybersecurity assessment against Swiss laws and regulations.
Frequently asked questions
What is IEC 62443?
A series of international standards for the security of industrial automation and control systems. It covers asset owners, system integrators and product suppliers, and uses zones, conduits and security levels to structure protection.
Who must report cyberattacks to the NCSC?
Operators of critical infrastructure covered by the Swiss Information Security Act, such as energy and drinking water suppliers, transport companies and public administrations. Reports are due within 24 hours of discovery.
Do you test live control systems?
No intrusive testing is done on live control systems without a plan agreed with operations. Most of the work relies on passive analysis, documentation and interviews.
Discuss your situation in a 30-minute call. No preparation needed.
Book a call