Ampyx Cyber Blog
The Intersection of Resilience & Regulation
Execution Integrity in the Age of NIS2 & CRA: What Comes After Perimeter Compliance
Many compliance programs under the revised Network and Information Security Directive (NIS2) are built around network architecture, but a firewall cannot verify what code actually runs on the controller behind it. This fifth report in the series maps what NIS2, the Cyber Resilience Act (CRA), and Germany's BSI Act ask for, draws on how US utilities met similar demands under NERC CIP, and sets out what a defensible firmware baseline requires, including for legacy operational technology (OT) that cannot verify its own firmware.
Supply Chain Trust: Verified Source, Unknown Origin
A firmware update can pass every cryptographic check and still come from a compromised or state-influenced vendor. This fourth report in the series looks beyond verification to the trustworthiness of operational technology (OT) suppliers. It covers what the revised Network and Information Security Directive (NIS2), the Cyber Resilience Act (CRA), and Germany's BSI Act expect from supply chain assessments, how ICS Advisory Project data can help evaluate vendor transparency, and how to document risk acceptance when a vendor cannot be replaced.
UEFI in OT: Hardware Trust, Secure Boot & CE Marking
Most industrial PCs and gateways in Europe run Unified Extensible Firmware Interface (UEFI) firmware that was shipped long before either of today's regulatory clocks started. This third report in the series explains where Secure Boot breaks down under real operational technology (OT) conditions, how the Cyber Resilience Act (CRA) divides responsibility for CE marking between component suppliers, equipment manufacturers, and operators, and what engineering and procurement teams can audit now under the revised Network and Information Security Directive (NIS2).
Firmware and Bootloader: The Verification Gap in OT Infrastructure
Proving that the code running on a field device is what the vendor shipped is one of the hardest problems in industrial security. This second report in the series compares four verification mechanisms, from SHA-256 hashing to remote attestation, and maps them to the revised Network and Information Security Directive (NIS2), the Cyber Resilience Act (CRA), and Germany's BSI Act. It also looks at what US utilities learned under NERC CIP, and which compensating controls work for legacy controllers that cannot verify their own firmware.
The European Union's Upgraded NIS2 Cybersecurity Framework
The European Union, with its commitment to digital governance and cyber protection, has recently updated its foundational cybersecurity framework, repealing the previous Network and Information Systems Directive (“NIS”) with the NIS2 Directive. Take a dive into the notable changes, implications, and suggested actions for businesses that fall under its scope.