Ampyx Cyber Blog
The Intersection of Resilience & Regulation
Execution Integrity in the Age of NIS2 & CRA: What Comes After Perimeter Compliance
Many compliance programs under the revised Network and Information Security Directive (NIS2) are built around network architecture, but a firewall cannot verify what code actually runs on the controller behind it. This fifth report in the series maps what NIS2, the Cyber Resilience Act (CRA), and Germany's BSI Act ask for, draws on how US utilities met similar demands under NERC CIP, and sets out what a defensible firmware baseline requires, including for legacy operational technology (OT) that cannot verify its own firmware.
UEFI in OT: Hardware Trust, Secure Boot & CE Marking
Most industrial PCs and gateways in Europe run Unified Extensible Firmware Interface (UEFI) firmware that was shipped long before either of today's regulatory clocks started. This third report in the series explains where Secure Boot breaks down under real operational technology (OT) conditions, how the Cyber Resilience Act (CRA) divides responsibility for CE marking between component suppliers, equipment manufacturers, and operators, and what engineering and procurement teams can audit now under the revised Network and Information Security Directive (NIS2).
New NSA UEFI Guidance: Trust Starts Before the OS
UEFI Secure Boot is widely assumed to be enabled and enforcing, yet recent vulnerabilities show how easily trust at boot time can silently fail. NSA’s new guidance breaks down how Secure Boot actually works, where configurations commonly go wrong, and how organizations can validate and recover trust in the earliest stages of system startup.