Field notes

Field notes on IEC 62443 and EU OT regulation.

Practical engineering notes from the people who build OTRISK: how the IEC 62443 series and the new EU regulations actually land on an operating plant. Clause numbers over adjectives, mechanism over marketing. We publish when a piece is worth an OT lead's time, and not to fill a calendar.

The latest field note

STOP

29 DEC 2025 · 05:30

Incident analysis Featured

The Polish CHP breach ran on connections nobody drew.

An exposed VPN without MFA, a private APN where every client could reach every other, and default passwords the rest of the way. CERT Polska's report, hop by hop, and what an IEC 62443-3-2 assessment would have asked.

12 August 20266 min readCarlos Montes Portela

Read the field note →

All field notes

Topics IEC 62443 Regulations Field notes

Topics are a preview of where these notes go. Filtering is not live yet.

STOP

29 DEC 2025

Incident analysis

The Polish CHP breach ran on connections nobody drew.

No malware, no zero-days. An exposed VPN, an open APN and default passwords stopped a plant that heats 50,000 homes.

12 August 20266 min readCarlos Montes Portela

15 AUG

2026

Regulations

The Cyberbeveiligingswet countdown.

Cbw and Wwke take effect on 15 August 2026. The three duties, who is accountable, and what to have ready before the date.

31 July 20264 min readHarm van den Brink

Zone conduit Zone

IEC 62443

Five zone-partitioning mistakes we keep seeing.

Topology is not security need, safety is not the BPCS, and a line with no requirements is not a conduit. What IEC 62443-3-2 actually asks.

17 July 20266 min readCarlos Montes Portela

No newsletter, no forms.

New field notes land on this page. We do not run a mailing list yet, so there is nothing to sign up for and no email to hand over. If you would rather talk than wait, a demo is a good way to hear what we are working on next.

Book a demo

See the resources and glossary →