Control Path Protection for Upstream, Midstream, and Refinery

Oil and gas operations span remote wellheads, offshore platforms, pipelines, and refineries. Each environment runs safety-critical control systems that must remain isolated from corporate networks and external threats.

Key threats addressed

100%

DCS and SIS isolation from corporate IT

Zero

Persistent vendor paths to safety systems

5

Operational zones with independent governance

Full

IEC 62443 and NIS2 compliance evidence

"We had 23 active contractor VPN tunnels into our DCS network. When we audited them, seven belonged to contractors whose projects had ended more than a year ago. The tunnels were still live."

Where each module is deployed, and what it does there.

One row per module. Placement on the network, then plain-English purpose at that point.

1. 

   Isolate

   At every Purdue boundary

   Each layer sits on its own physical fabric. A compromise in one does not walk into the next.

2. 

   Firebreak

   On the L5 to L4 link and the L4 to L3.5 link

   Real hardware off switches on the public and office boundaries, cutting the live path into operations when needed.

3. 

   Validate

   On the L5 to L4 link and inside the L3.5 DMZ

   Before data feeds operations, Validate checks its origin and integrity. A spoofed reading does not become a process action.

4. 

   Relay

   Inside the L3.5 DMZ

   Telemetry and operational data land inside a defined route. Nothing streams unattended.

5. 

   Execute

   On the L2 to L1 link

   Pushing a change to a controller holds until the right approval is in place.

6. 

   Lock

   On the L1 to SIS link and the SIS to L0 link

   Safety and field access ties to named engineers with the right authority and the right device.

Sovereign Process Data

All process control configurations and safety system logic remain within the agreed jurisdiction in NATO-approved Firevault Bunkers.

Multi-Party Access Control

Contractor and vendor access requires sign-off from both operations and HSE teams before any path is activated.

IEC 62443 Evidence

Automated compliance logging maps directly to IEC 62443 zone and conduit requirements and NIS2 Article 21 outcomes.

Satellite Failover

Out-of-band management ensures control plane access to offshore and remote facilities independent of primary communications.

Tamper-Proof Logging

Every contractor session, configuration change, and access authorisation is recorded in immutable logs on physically separate infrastructure.

Verified Safety Configuration Baselines

Verified baselines of SIS logic and safety configuration enable restoration of control-plane state during total compromise scenarios.

Process Network Assessment

Map all network paths between corporate IT, DCS, SIS, and contractor access points across upstream, midstream, and downstream operations.

Zone and Conduit Design

Design physically separated zones aligned to IEC 62443 requirements with Control modules governing each conduit between zones.

Single Facility Pilot

Deploy at one facility with full zone separation, contractor access governance, and compliance logging to validate operational procedures.

Enterprise Rollout

Phased deployment across all facilities with verified configuration baselines, continuous compliance evidence, and out-of-band management.