OT Cybersecurity

TL;DR: The Cyber Security and Resilience Bill cleared the Commons on 10 June 2026, entered the Lords on 17 June, and reforms the NIS Regulations 2018 rather than replacing them. It pulls data centres, medium and large managed service providers, large load controllers and designated critical suppliers into scope, adds 24-hour and 72-hour incident reporting,…

TL;DR: On 11 September 2026 the Cyber Resilience Act switches on its reporting obligations. From that date, any manufacturer whose product with digital elements is on the EU market must report an actively exploited vulnerability within 24 hours, file a full notification within 72 hours, and close it out within 14 days. Brexit does not…

Last updated: 24 July 2026 Short answer: a firewall decides what traffic is allowed; a data diode decides what is physically possible. In the data diode vs firewall comparison the firewall is software policy that can be misconfigured, bypassed or changed, while a diode is hardware that has no return path at all. That makes…

Data diodes let OT and ICS data leave the control network without letting anything back in. How one-way hardware fits the Purdue model, IEC 62443 and NCSC CAF.

Last updated: 1 July 2026 TL;DR: The core OT cybersecurity best practices are asset visibility, network segmentation, secure remote access, patch and vulnerability management, identity and access control, secure-by-design hardware, continuous monitoring, an OT-specific incident response plan, and staff training. Treat operational technology as a distinct discipline from IT, buy devices that are defensible by…