IEC 62443 and NIS2: how OT security changes in Industry 4.0

IEC 62443: the standard redefining OT security in the NIS2 era

The IEC 62443 standard represents today the most comprehensive technical framework for the security of technological operational environments (OT), introducing key concepts such as segmentation into zones and conduits, security levels, and the seven fundamental requirements. Its relevance has become critical with the entry into force of the NIS2 directive, which imposes stringent requirements for digital operational resilience on all essential service operators.

Quick Response

Structural differences between IT and OT security

The OT industry has unique characteristics: legacy systems often not designed for connectivity, decade-long life cycles, and priorities of availability and physical security that prevail over IT ones. Unlike IT environments, where data protection is the main objective, OT environments require an approach that ensures operational continuity and the physical security of plants.

The impact of the NIS2 directive

The NIS2 directive has revolutionized the OT security landscape in Europe, extending the scope of application to a greater number of sectors and introducing stricter requirements for risk management. Among the main innovations, the obligation for essential service operators to implement security measures based on recognized standards such as IEC 62443.

Non-human digital identities: a new frontier of security

According to the CyberArk 2025 Identity Security Landscape, for every employee registered on the payroll, an organization manages an average of eighty-two non-human digital identities. This number includes API keys, service principals, OAuth grants, TLS certificates, application secrets, and autonomous agent accounts. Managing these identities represents a significant challenge for cybersecurity, requiring advanced solutions to prevent unauthorized access and data breaches.

The evolution of production plants towards autonomous networks

A crucial moment occurs when a production plant installs a private 5G network or an autonomous campus network to connect industrial robots, AGV (Automated Guided Vehicle) systems, IoT sensors, and operating stations. This step transforms the plant into a telecommunications operator, introducing new security risks that require an integrated approach to protect critical infrastructures.

The vulnerabilities of the Traffic Collision Avoidance System

At the 14th edition of the Cyber Crime Conference, Prof. Alessio Merlo presented the results of research conducted by the Centro Alti Studi per la Difesa (CASD) together with the University of Genoa on the vulnerabilities of the Traffic Collision Avoidance System. This system, fundamental for air traffic safety, was found exposed to potential cyberattacks that could compromise its functionality and put flight safety at risk.

Cybersecurity in the automotive industry

From July 1, 2024, every vehicle produced and sold in the European Union must comply with the UNECE WP.29 UN R155 and R156 regulations. These regulations establish binding requirements for vehicle homologation, including cybersecurity standards that must be integrated from the design phase. Italy, with the presence of Stellantis, is a key player in this sector, making compliance with these standards a strategic priority.

Underwater habitats and the security of critical systems

Projects like Vanguard, an advanced underwater habitat, represent new challenges for cybersecurity. These environments, equipped with sensors, life support systems, and communication networks, require advanced security solutions to prevent cyberattacks that could compromise the safety of occupants and the stability of the habitat.

Supply Chain Sovereignty and the defense of strategic assets

Supply Chain Sovereignty is today one of the most critical fronts in the defense of national strategic assets. The Alpi case highlights how seemingly financial decisions can have devastating operational consequences, underscoring the importance of an integrated approach to supply chain security that considers both technical and strategic vulnerabilities.

EU Regulation 2023/2854: the Data Act and data ownership

Regulation (EU) 2023/2854, known as the EU Data Act, is fully applicable from September 12, 2025. Unlike the GDPR, which focuses on the protection of personal data, the Data Act concerns the ownership and control of data generated by the use of connected products, from industrial machinery to household appliances. This regulation introduces new rules on data management, requiring organizations to adopt measures to ensure the security and integrity of data generated by their products.

Gyala and the reform of security strategies

Gyala redefines the rules of the game in a scenario where trust is no longer an option. For years, cybersecurity has been measured based on what we could control: firewalls, perimeters, internal policies. However, the evolution of threats requires a broader approach that also considers the security of third parties and the supply chain. This requires a review of traditional security strategies and the adoption of new technologies and practices to address emerging challenges.