ISA/IEC 62443 · assessment & assurance for OT estates
ZeroGap OT turns a plant, site or whole estate into a governed IEC 62443 model: zones and conduits drawn the moment you define them, a Cybersecurity Requirements Specification in one click, component evidence assessed against IEC 62443-4-2 and readiness tracked against approved targets — with an audit trail a regulator can follow.
Self-hosted. Offline-capable. Know your gaps, show your evidence.Inside ZeroGap OT
Follow one water treatment system through ten stages. Explore the screens, decisions and outputs that connect your architecture to your evidence.
Define scope, zones, conduits, assets, target vectors and controlled documents.
Control and monitoring of treatment, chemical dosing and treated-water storage.
Define zones to group assets with shared security requirements.
Record what the zone does, what it contains and where its boundary sits.
Record all seven SL-T values with rationale and approval context.
Draft targets stay visibly separate from approved targets.
Connect named zone endpoints and record exactly what may cross the boundary.
Conduits retain protocols, direction, permitted flows and trust-boundary context.
The drawing follows the recorded model, with zone targets and asset placement.
Export the drawing and Cybersecurity Requirements Specification from the same system model.
Place each device in its zone or conduit and keep the evidence attached to the right asset.
| Asset | Product / profile | Placement | Evidence | Assessment |
|---|---|---|---|---|
| PLC-04 · Treatment PLC | Embedded device | Process Control | 3 documents | Ready to assess |
| HMI-02 · Operator station | Software application | Process Control | 2 documents | Not started |
| SW-11 · Industrial switch | Network device | Process Control | 2 documents | Not started |
Run the IEC 62443-4-2 assessor against a defined device and its evidence.
Optional AI review is controlled by the deployment’s licence and policy.
Inspect the finding, evaluate the supporting evidence and record a reasoned decision.
Audit-log capability identified in the device documentation. Deployment configuration evidence is still required.
Approval records the reviewed outcome. It does not remove an unresolved gap or demonstrate an unverified capability.
Filter by system, zone, conduit and component profile, then inspect assets and findings.
Inspect an asset or finding to see the evidence and conditions behind the dashboard.
Requirement-level targets, capability, conditions and blockers.
| Requirement | SL-T | Current component contribution | Candidate component capability | Readiness projection | Status | Blockers and unresolved conditions |
|---|---|---|---|---|---|---|
| IAC | 2 | 2 | 2 | 2 | target ready | None recorded |
| UC | 2 | 2 | 2 | 2 | target ready | None recorded |
| SI | 2 | 1 | 1 | 1 | below target | PLC-04 · integrity evidence missing |
| DC | 1 | 1 | 1 | 1 | target ready | None recorded |
| RDF | 2 | 2 | 2 | 2 | target ready | None recorded |
| TRE | 2 | 1 | 2 | 1 | verification incomplete | HMI-02 · audit-log evidence unverified |
| RA | 2 | 2 | 2 | 2 | target ready | None recorded |
Readiness is not certification or an achieved security level (SL-A).
Choose scope, report type and format. Preserve the assessment state behind the output.
Live Insights and the CRS are separate outputs with their own scope and purpose.
DEVICE ASSESSMENT
Water Treatment SCADA · Process Control Zone
System scope → zone and conduit characteristics → architecture drawing → seven-part target profiles → derived requirements and open design actions. Missing recorded values stay visible.
| Gap | Owner | Required evidence | State |
|---|---|---|---|
| PLC-04 · Integrity | OT engineering | Configuration and integrity evidence | Open |
| HMI-02 · Audit logs | Control systems team | Verified logging configuration | Open |
Stage 1 · Workspace
Create the system under consideration, describe its intended use and define its scope. This is the main workspace your zones, conduits, assets and documents belong to.
A named, scoped system that gives every later assessment its context.
Guided interface examples based on the current application, using fictional data. Use the stage buttons, arrow keys or swipe the explanation to explore. No assessment data is submitted.
Zones and conduits, system requirements and component capability in one model.
IAC, UC, SI, DC, RDF, TRE and RA stay separate. No averaged compliance score.
Generated from the recorded system, with targets on the drawing.
PDF, CSV and canonical JSON snapshots with scope, provenance and review state.
Regulatory alignment
Operators of essential services are asked the same question by regulators, NIS-style regimes, customers and insurers: can you demonstrate your industrial control systems are secured to a recognised standard? ISA/IEC 62443 is that standard. ZeroGap makes the answer a governed record rather than a slide.
Every system under consideration carries its applicable regulations, policies, sites, tolerable-risk criteria and risk-assessment references. They travel into the CRS and every governed report, so the regulatory context is never reconstructed after the fact.
Seven foundational requirements stay independent. Machine findings are proposals; human decisions carry reviewer, rationale and independent approval. ZeroGap never averages a compliance score and never asserts an achieved security level it cannot evidence.
Checksum-verified evidence, a tamper-evident audit chain and a cryptographic audit export with SHA-256 integrity proofs. Reports snapshot the exact review state, policy version and evidence cut-off behind each result.
Zones & conduits · instant
Add a zone or conduit and it is on the drawing. ZeroGap generates the ISA/IEC 62443-3-2 zone-and-conduit drawing from the recorded model — with trust boundaries, protocols, permitted flows and each zone's SL-T target — so the architecture, the requirements and the drawing never drift apart.
CRS · one click
The Cybersecurity Requirements Specification is the document IEC 62443-3-2 asks for and most OT teams assemble by hand. In ZeroGap it is a button on the system workspace. Scope, architecture, zone and conduit characteristics and the seven-element SL-T vectors, with their status and rationale, are compiled from the live model and opened for saving as PDF.
Simplifying 62443 for OT estates
IEC 62443 alignment usually lives in spreadsheets, Visio files and inboxes. ZeroGap puts the model, the targets, the component assessments, the review decisions and the reports in one governed workflow — across every system, site and organisation in your estate.
Create each system under consideration with its zones, conduits and assets. References are auto-suggested; trust boundaries, protocols and permitted flows are recorded as you go.
Record a seven-part SL-T vector per zone and conduit with rationale and approval. Export the zone-and-conduit drawing and a draft Cybersecurity Requirements Specification instantly.
Run the signed IEC 62443-4-2 component assessor against uploaded, checksum-verified evidence. Findings are kept as an immutable machine baseline.
Reviewers accept, reject or override with rationale. Approvers sign off independently. Gaps get owners, due dates and implementation evidence.
Compare demonstrated capability with approved targets per zone, then snapshot governed reports for auditors, regulators and the board.
Built for estates, not single sites
Organisations hold many systems under consideration. Each keeps its own zones, conduits, assets, targets, evidence and review history, while roles, search and reporting work across the whole estate.
Find any asset, vendor, model, zone or system across the estate with wildcard search, then open it in context.
Schedule first and repeat assessments per asset. A firmware change flags the device for reassessment while earlier results stay available.
Assessors, reviewers, approvers, risk owners and auditors have distinct permissions. Approvers cannot approve their own decisions.
Checksum-addressed documents assigned to systems and assets, with bulk assignment and a register of everything reviewers relied on.
Outputs for the work you do
Explore the current picture, document the system design or preserve an assessment for review and audit. Every governed report carries scope and provenance metadata and keeps the seven security levels independent.
A posture dashboard built from finalised reviews: approved SL-T comparisons, findings by requirement, defence-in-depth indicators and inventory drill-downs, exportable with its scope and filters.
A live snapshot of the workspace.The CRS and zone-and-conduit drawing with target profiles, derived requirements, open specification actions and asset placement.
An input to security architecture and design.Thirteen governed report types plus the CRS, generated from a snapshot of the approved review state by a dedicated worker.
Immutable snapshots with recorded review and approval state.Controlled by your organisation
ZeroGap OT is a licensed, self-hosted platform. Your deployment holds the system model, evidence, review history and reports — on your network, including fully disconnected sites.