Case studies

What we did, and what we did not do

Six projects, three for product makers and three for plant owners. Each sets out what we did and what we chose not to do, because that part says as much about how we work. Client names are withheld.

Talk to an advisor View all services

For product makers

Sized to the company, not to a template

Each project fitted the company in front of us: its process, its product and its size.

01Product cybersecurity

12 monthsto CRA compliance

Client: OEM of automation controllers
The value behind it: The least change to how you build

Related serviceEU CRA Compliance

CRA compliance in 12 months, built on the process they already had

The situation

An OEM of automation controllers needed its products to comply with the EU Cyber Resilience Act. Its engineering already ran on processes based on ISO/IEC/IEEE 15288, the international standard for system life cycle processes.

What we did

We used those processes as the base. Each CRA requirement went into the process that already did similar work, such as risk management, configuration management, verification or maintenance. Where a requirement had no home, we added it to the nearest process rather than start a parallel one.

What we did not do

Replace their process with a CRA template, or run the CRA as a separate project beside engineering.

The result

CRA compliance in 12 months, with the evidence coming out of the process the engineers already follow.

02Product cybersecurity

SM-10why a supplier needed IEC 62443-4-1

Client: Component manufacturer supplying an OEM
The value behind it: No work you do not need

Related serviceIEC 62443-4-1 SDLC Certification

Their customer needed IEC 62443-4-1, so they did too

The situation

A component manufacturer made one small, custom component for an OEM. The OEM works to IEC 62443-4-1, and its requirement SM-10 covers custom components from third-party suppliers. So the OEM required its supplier to hold an IEC 62443-4-1 certificate.

What we did

We built their IEC 62443-4-1 process around that one component, writing each of the eight practices from how their engineers already worked.

What we did not do

Build a process for a whole product line. They needed IEC 62443-4-1 for one small component, and the process should fit that.

The result

An IEC 62443-4-1 process that fits the component, ready for the certificate the OEM asked for.

03Product cybersecurity

ML3ready quickly, with under 70 people

Client: Product maker with under 70 employees
The value behind it: Honest about what fits your size

Related serviceIEC 62443-4-1 SDLC Certification

Ready for IEC 62443-4-1 ML3 quickly, because the team was small

The situation

A product maker with fewer than 70 employees needed its development process to meet IEC 62443-4-1 at maturity level 3 (ML3). ML3 asks for more than written policies: the process has to be repeatable across the company and shown to be practiced.

What we did

We wrote the policies and procedures, and got the whole team to follow them as written. With everyone working the same way from the start, the evidence ML3 asks for built up quickly.

What we did not do

Pretend it would work at any size. It worked because fewer than 70 people had to change how they work. In a company of 500 or more, the same approach would not work.

The result

Ready for ML3 in a short time, with the whole team already working the way the policies say.

For plant owners

What the plant needed, and nothing more

We advised against an IDS in one plant and fixed one in another. The tool is never the point; the risk is.

04OT cybersecurity

Gap, not riskthe assessment that fitted

Client: Plant owner
The value behind it: We say no when it is the right answer

Related serviceGap Assessment

They asked for a risk assessment. We did a gap assessment.

The situation

A plant owner asked us for a risk assessment. They were at the start of their OT security journey. At that stage a risk assessment mostly confirms gaps that a lighter review would find, and it takes longer and costs more.

What we did

We recommended a gap assessment instead, and did only that. It was passive: documents, architecture and interviews, with nothing touching the running plant. We measured where they stood against IEC 62443 and ranked what to fix first.

What we did not do

Sell them the risk assessment they asked for. A risk assessment is worth doing once the known gaps are closed, and we told them so.

The result

An IEC 62443 maturity score, quick wins they could act on straight away and a phased roadmap, in less time and for less money than a risk assessment.

05OT cybersecurity

DMZ, not SOCthe fix that mattered

Client: Plant owner
The value behind it: Clarity over fear. Integrity over sales.

A DMZ, not a SOC: fixing the boundary between IT and OT

The situation

Our risk assessment found IT and OT poorly segregated. A 24x7 SOC, an IDS and microsegmentation were all on the table.

What we did

We helped them establish a DMZ between IT and OT, so the two networks meet only there, and only for the traffic the plant needs.

What we did not do

Implement the 24x7 SOC, the IDS or microsegmentation. For this plant they did not make sense: the risk that mattered was the weak boundary, and a DMZ fixes that. Each of the three costs money to buy and money to run. We advised against all three and held that position.

The result

IT and OT now meet only through the DMZ. The plant fixed the risk that mattered, without buying tools it did not need.

06OT cybersecurity

Under 15%of assets covered when we started

Client: Plant owner
The value behind it: What you own, first

Fixing an IDS that saw less than 15% of the assets

The situation

The plant already had an IDS, but it was poorly configured. It covered less than 15% of the assets and raised too many alerts.

What we did

We reconfigured the IDS for full visibility, as much as the network allowed. Then we refined the alerts, filtering out the noise so the ones left are worth acting on.

What we did not do

Replace the IDS or add another tool. The IDS was not the problem; the way it was set up was.

The result

Visibility across as much of the network as possible, up from less than 15% of assets, and alerts cut down to the ones that matter.

Talk to RelyBlue

Want an honest second opinion?

Product or plant. We will tell you what you need, and what you do not.

You talk to a senior advisor, never a salesperson