Ampyx Cyber Blog
The Intersection of Resilience & Regulation
From Analysis to Action: Building Your OT Firmware Security Program
The final report in the series turns the analysis of Reports 2 to 5 into a program. It sets out four parallel tracks for operational technology (OT) firmware security, from hardware trust and Unified Extensible Firmware Interface (UEFI) integrity to supply chain risk and audit readiness, each with an owner and target milestones. It also covers what managing directors need to know about fines and liability under the revised Network and Information Security Directive (NIS2) and Germany's BSI Act, and a 30-day sequence for getting started.
Execution Integrity in the Age of NIS2 & CRA: What Comes After Perimeter Compliance
Many compliance programs under the revised Network and Information Security Directive (NIS2) are built around network architecture, but a firewall cannot verify what code actually runs on the controller behind it. This fifth report in the series maps what NIS2, the Cyber Resilience Act (CRA), and Germany's BSI Act ask for, draws on how US utilities met similar demands under NERC CIP, and sets out what a defensible firmware baseline requires, including for legacy operational technology (OT) that cannot verify its own firmware.
The Execution Layer Gap: Why European Critical Infrastructure May Be Looking at the Wrong Regulatory Clock
Many European critical infrastructure operators are planning around December 2027, when the Cyber Resilience Act (CRA) fully applies. Its vulnerability reporting duty under Article 14 took effect on September 11, 2026, and it covers products already deployed in the field. This Foundation report, the first in a six-part series, looks at why regulators are turning to the firmware and bootloader layer below the operating system, how the CRA and the revised Network and Information Security Directive (NIS2) reach it, and what Germany's implementation adds.
New Joint Agency Guidance: Secure Connectivity Principles for OT
A Five Eyes plus European intelligence coalition has published a new doctrine for securing OT connectivity against nation-state threats. This Deep Dive examines what the NCSC principles mean for utilities and industrial operators, what breaks in legacy environments, and the safety, cost, and engineering realities of moving from compliance-driven security to true operational resilience.