Our services
For the products you build and the plants you run
EU CRA compliance and IEC 62443 certification for the products you ship. Assessments, programmes, solutions and training for the plants you run. SEMI E187, E188 and E191 for the semiconductor ecosystem.
All services
Every service, in one place
Each area has its own page with who each service is for, what you get and how long it takes.
- EU CRA ComplianceFrom the first gap assessment to the conformity assessment, for every product with digital elements you sell in the EU.
- IEC 62443-4-1 SDLC CertificationA secure development lifecycle built from how you already work, written down once, and certified.
- IEC 62443-4-2 CSA CertificationFind the security features your product is missing, design them in, and certify the component.
- Fractional Product Security AdvisorA senior advisor who knows the CRA and IEC 62443, a few days a month, without a full-time hire.
- IEC 62443 Product Security TrainingAn advanced track on IEC 62443-4-1 and IEC 62443-4-2 requirements, with hands-on labs.
Assessments
- Gap AssessmentA rapid review of architecture, governance and maturity gaps, with zero impact on operations.
- Risk AssessmentDetailed, standards-driven validation (IEC 62443, NIST) through passive methods.
- Penetration TestingAttack simulation during FAT, SAT or scheduled downtime, or in a test environment.
Transformation
- Strategy & RoadmapFindings turned into a phased plan, with the money to buy and the money to run, ready for board approval.
- Cybersecurity ProgramGovernance, policies, and incident response planning for long-term security.
- Cybersecurity SolutionsVendor-agnostic deployment, from firewalls to the OT SOC, with no disruption to processes.
Enablement
- Awareness TrainingFundamentals for plant and field staff: USB safety, threat recognition.
- Job Readiness TrainingRole-specific defence skills for engineers taking on security duties.
- Cybersecurity TestbedsPortable, realistic OT testbeds with real PLCs and SCADA.
- Incident Response TTXHigh-pressure simulations testing technical and executive teams together.
- Fab Security & SEMI ComplianceA structured assessment of your fab against SEMI E187, E188 and E191, scoped around yield, uptime and IP.
- Equipment OEM SecurityHarden your tools to SEMI E187 and prove it with evidence fabs accept.
- Malware-Free Equipment ProgramAn E188 intake programme, plus a patch and AV strategy built on E191 status reporting.
- Ecosystem AdvisoryThe whole vertical in one view: how E187, E188 and E191 fit together, and which service fits your role.
Where to start
Start with your situation
Most engagements begin with one of these. If yours is not here, tell us what you are dealing with and we will point you to the right first step.
You build products
You sell connected products in the EUEU CRA Compliance A customer asked for IEC 62443-4-1IEC 62443-4-1 SDLC Certification A customer asked for a certified componentIEC 62443-4-2 CSA Certification You need direction, not a full-time hireFractional Product Security AdvisorStandards and regulations
The rules we work to
Who each standard or regulation applies to, and the service that gets you there. Each industry page adds the rules specific to that sector.
International
| Standard or regulation | What it covers | Who it applies to | Our service |
|---|---|---|---|
| IEC 62443-2-1, 3-2, 3-3 | Security programme, risk assessment, zones and conduits, and system security levels for industrial control systems | Asset owners and system integrators | Gap AssessmentRisk AssessmentCybersecurity Program |
| IEC 62443-4-1 | Secure development lifecycle for industrial products | Product makers | IEC 62443-4-1 SDLC Certification |
| IEC 62443-4-2 | Technical security requirements for components, by security level | Makers of controllers, devices, network components and software | IEC 62443-4-2 CSA Certification |
| IEC 61511 | Functional safety for safety instrumented systems; clause 8.2.4 asks for a security risk assessment of the SIS | Process plants with a SIS | Risk Assessment |
| NIST SP 800-82 | Guide to OT security | A reference used worldwide, and by US federal agencies | Risk Assessment |
European Union
| Standard or regulation | What it covers | Who it applies to | Our service |
|---|---|---|---|
| EU Cyber Resilience Act | Cybersecurity of products with digital elements; reporting from 11 September 2026, the rest from 11 December 2027 | Manufacturers and importers selling in the EU | EU CRA Compliance |
| RED Delegated Act | Cybersecurity of internet-connected radio equipment, in force since 1 August 2025 | Makers of radio equipment sold in the EU | EU CRA Compliance |
| NIS2 | Risk management and incident reporting | Essential and important entities, including energy, transport, water and manufacturing | Gap AssessmentCybersecurity Program |
India
| Standard or regulation | What it covers | Who it applies to | Our service |
|---|---|---|---|
| CEA Cyber Security in Power Sector Regulations, 2026 | Governance, OT and IT separation, and incident reporting for the power sector, in force from 1 April 2027 | Generators, captive plants and storage of 50 MW and above, and power exchanges | Gap AssessmentCybersecurity Program |
| NCIIPC guidelines | Protection of critical information infrastructure | Organisations whose systems are notified as critical information infrastructure | Gap AssessmentRisk Assessment |
| CERT-In Directions, 2022 | Report cyber incidents to CERT-In within 6 hours | Organisations operating in India | Cybersecurity ProgramIncident Response TTX |
Middle East
| Standard or regulation | What it covers | Who it applies to | Our service |
|---|---|---|---|
| NCA OTCC | Operational technology cybersecurity controls | Organisations in Saudi Arabia that run OT in critical national infrastructure | Gap AssessmentCybersecurity Program |
| DESC ICS Security Standard | Security of industrial control systems | Government and private entities in Dubai that run industrial control systems | Gap AssessmentCybersecurity Program |
Sector
| Standard or regulation | What it covers | Who it applies to | Our service |
|---|---|---|---|
| SEMI E187, E188, E191 | Fab equipment security, malware-free equipment integration, and device status reporting | Equipment makers, fabs and OSATs | Equipment OEM SecurityFab Security & SEMI ComplianceMalware-Free Equipment Program |
| IACS UR E26 and E27 | Cyber resilience of ships and of the systems on board, for ships contracted from 1 July 2024 | Shipyards and owners (E26), equipment makers (E27) | Risk AssessmentIEC 62443-4-1 SDLC Certification |
Ways to work with us
Fixed price or by the day
Pick the model that fits how clear the scope is.
- 01
Lump sum
Fixed scope, fixed price
For a project with a clear scope, or a whole programme, such as taking a product from gap to certificate. You know the price before we start.
- 02
Timesheet-based project
Billed on time spent
For work whose scope becomes clear as it runs. You pay for the time recorded on timesheets, and you can change direction as you learn more.
- 03
Timesheet-based short engagement
A few days when you need them
Senior time for a focused question: a design review, a second opinion before an audit, or a few days of advice each month.
Talk to RelyBlue
Tell us what you are working on
Product or plant. One conversation, no sales pressure.
- You talk to a senior advisor, never a salesperson