Proof and Credibility

A tier 2 mining company engaged our specialist engineer to audit their Process Control Network (PCN) and establish a clear path to cybersecurity compliance. The PCN underpinned critical plant operations including dewatering and infrastructure control systems, but had grown organically over time without formal segmentation or lifecycle management.

Our expert applied the DMAIC framework to structure the engagement. The Define phase established audit objectives and scope across the PCN infrastructure. The Measure phase involved physical validation of site locations, logical topology mapping, and a thorough review of existing schematics. The Analyse phase identified critical segmentation deficiencies, end-of-life equipment exposure, and cybersecurity risks across the L2 flat topology.

The Purdue Model was applied to define a future-state segmented architecture, establishing clear zone boundaries and dedicated subnets for PLC-to-IO, PLC-to-SCADA, SCADA-to-HMI, and management traffic. Three architecture options were developed at varying investment levels, each providing a structured path from the existing flat topology to a segmented, access-controlled, and ISA 62443-aligned PCN. A full Cisco Bill of Materials was produced to support procurement planning.

A tier 1 mining company required a comprehensive redesign and refresh of both enterprise IT and Process Control Network infrastructure across active operational sites. The existing PCN operated as a flat Layer 2 topology, creating significant dependency management challenges and non-compliance with cybersecurity standards including ISA 62443 and ISA 99.

Our lead engineer directed the architectural redesign of the PCN, converting it from a flat L2 topology to a routed Layer 3 architecture. This conversion enabled proper network segmentation and dependency management across all critical control traffic flows: IO to PLC communication, PLC to SCADA, SCADA to HMI, and inflow-to-outflow PCN paths. Each segment was allocated a dedicated subnet with access control enforced at zone boundaries in alignment with ISA 62443 security zone requirements.

Concurrent with the PCN redesign, our engineer delivered a full refresh of the enterprise IT network covering WAN, DMZ, and LAN layers. Industrial wireless mesh infrastructure was selected, designed, and deployed across operational areas to support OT and mobile connectivity requirements. Cisco infrastructure was supplied through authorised distribution, configured against the design, and commissioned on site. Full HLD and LLD as-built documentation was produced for operational handover.

CSNX is delivering an OT cyber maturity baseline across a critical infrastructure operator's process control environment. The engagement establishes a defensible, evidence-backed starting point against IEC 62443-3-3, so improvement can be measured over time rather than assumed.

Each site is assessed as three independent audits, Infrastructure, Control Systems, and Hosting, scored across all seven Foundational Requirements (FR1 to FR7). CSNX Scout runs on the plant network to collect audit evidence automatically, positively passing or failing the controls it can verify and honestly marking the rest for manual review. Evidence stays on site; only the pass and fail results are synced into the platform.

The verdicts feed the PCNAudit platform, which scores maturity from ML1 to ML4, builds a prioritised gap and remediation register, and produces board-ready reporting. Maturity is tracked continuously as evidence is submitted and gaps close, giving the operator a live view of its OT security posture and a clear, sequenced path to its target Security Level.