OT cybersecurity IEC 62443: treat locating systems like the rest of the plant.Locating systems are often the weak spot on the OT network.
OT cybersecurity to IEC 62443 for locating systems: IoT OT security hardening of RTLS and RFID programmes without killing the operating use case.
Independent, framework-aligned (IEC 62443, NIS2, NIST CSF, ISO 27001). We don't sell hardware, so our advice stays independent. We design the architecture and the remediation plan, then verify it.
Free 30-minute call with an adviser · written proposal with the price after · fixed-scope engagements from £3k.
OT security stalls when the RTLS VLAN is treated like another IT laptop subnet.
Asset inventory first
You cannot protect tags, gateways and controllers you have not listed. Start with a living OT inventory.
Segment and supervise
IEC 62443-minded zoning beats a flat wireless flat. Monitor east-west, not only the firewall.
Supplier remote access
OEM tunnels are a common breach path. Time-box, MFA, and log, or refuse.
Three OT-layer failure modes we see again and again.
The findings repeat across verticals. Naming them is the first step in closing them.
PLCs and tags share the office VLAN
The original network was flat because that was the fastest path to go-live. Today, an RFID reader, a PLC, a meeting-room TV, and a finance laptop are all one broadcast domain away from each other. A single compromised endpoint reaches the line.
No segmentation between OT and IT
Purdue levels exist on the architecture diagram but not in the firewall. East-west traffic between the MES and the BI warehouse flows unfiltered. Lateral movement is free of charge for anyone who lands a phishing payload in HR.
Remote access is a back door
OEM suppliers hold permanent VPN credentials so they can support machinery. Nobody knows who is logged in right now, what they touched last week, or whether the shared service account is still in use by the engineer who left.
Six workstreams. Run together. Framework-aligned.
Every workstream maps to an IEC 62443 foundational requirement and produces evidence your auditor and your CISO will both accept.
OT cyber posture assessment
Map every IoT/RTLS/PLC device, classify by criticality, document actual data flows, identify the gap to IEC 62443-3-3 SL2 or SL3.
Zone & conduit design
Segment by Purdue level, define the conduits between zones, and specify firewall rules in independent form so any procured firewall can implement them.
Identity for things and people
Device identity (certificate-based), service-account hygiene, integration with your IdP (Entra, Okta, Ping) for the human side.
Hardened remote access for suppliers
Jump host, MFA, session recording, time-bounded access for OEM suppliers needing to support machinery without owning a permanent VPN.
OT-aware SOC integration
Mirror traffic to a SOC that understands Modbus, OPC UA, MQTT, S7, EtherNet/IP, not a generic IT SIEM with no protocol context.
OT incident response runbook
Pre-built runbooks for ransomware, tag-fleet compromise, AGV malfunction. Tabletop-tested before you need them.
Three ways to bring us in.
Sized to where your OT estate actually is, from a first-time posture check to embedded remediation alongside your IT/OT team.
Posture audit · 4-6 weeks
Full map, gap analysis, prioritised remediation roadmap. Scoped per project.
Architecture & design · 8-12 weeks
Zone/conduit design, identity model, monitoring spec, supplier RFP for tooling.
Embedded remediation · 4-9 months
We sit alongside your IT/OT team through the actual remediation. We exit when KPIs are met.
Framework-led, independent, evidence-based.
Who sells OT cyber for locating systems and what they miss.
The market splits into three camps. Framework certifiers and assessors (UL Solutions and peers on ISA/IEC 62443) produce mature risk assessments, CSMS design and certification evidence: excellent for board and regulator audiences, lighter on the quirks of UWB anchors, Passive RFID readers and LoRaWAN gateways sitting on the same OT VLAN. OT security platforms (Dragos, Claroty, Nozomi, Armis, Fortinet, Palo Alto Networks and similar) sell visibility, segmentation and monitoring tools; their professional services naturally centre on deploying that tooling. Big-4 and large SI cyber practices bring enterprise change programmes and often subcontract the RF-aware detail.
Locating programmes create a specific attack surface that generic OT audits under-weight: supplier remote access for reader firmware, PoE switch hop latency that can be abused as well as misconfigured, tag identity spoofing, and zone/conduit designs that treat every Locator as “just another IoT endpoint.” IEC 62443 SL2-SL3 targets are right. The control selection has to respect RF timing and the reality that many locating suppliers still ship with shared credentials and flat networks.
What programmes get wrong: bolting a SOC tool onto an unzoned locating VLAN after go-live, or accepting the supplier’s “secure by design” slide without a tabletop that includes tag cloning, rogue gateway and remote-support compromise scenarios.
We map the locating estate, design zones and conduits, write the identity and remote-access model, and either remediate beside your IT/OT team or hand a scored RFP to whoever should own the tooling. Framework-led, evidence-based, locating-aware.
Air-gapped or on-prem estates on defence and secure sites: see Defence & aerospace.
Frequently asked questions.
Do you apply OT cybersecurity IEC 62443 to locating systems?
Primarily IEC 62443, with zone-and-conduit design, OT-aware monitoring, and hardened remote access for suppliers.
Is this IoT OT security for locating systems or IT security?
OT-focused. We secure the operational technology and location and IoT infrastructure, working alongside your IT security team.
Do you sell security products?
No. We are independent and recommend and integrate the right controls for your environment.
Can you assess an existing deployment?
Yes, we run audits and gap assessments and provide a prioritised remediation plan.
Last updated: 5 October 2026