Question 1

Does NIS2 apply to my company?

Accepted Answer

NIS2 applies to medium- and large-sized companies in the so-called “essential” sectors (energy, water, transportation, healthcare, food, and digital infrastructure) and “important” sectors (manufacturing, chemicals, postal services, and waste management). If you operate connected industrial equipment in these sectors, you are likely affected. Visit the ANSSI website for the complete list or request an assessment from our team.

Question 2

Does the Eziwan gateway need to be CRA-certified?

Accepted Answer

Yes. The CRA (effective as of December 2027) requires a cybersecurity CE marking for any product containing digital components, including routers and IoT gateways. Eziwan is committed to a roadmap for full CRA compliance before the deadline. The gateway is already designed in accordance with the “Secure by Design” principles required by the regulation.

Question 3

What is "Zero Trust" as applied to OT?

Accepted Answer

The Zero Trust OT model means that no device is considered trusted by default, even within the network. In practice, with Eziwan: no open ports to the Internet (zero inbound ports), authentication of each gateway via an asymmetric certificate, strictly controlled user access (MFA, RBAC, expiration), and segmentation of each site into its own VPN tunnel.

Question 4

How do I document Eziwan compliance for my NIS2 audit?

Accepted Answer

Eziwan Cloud provides comprehensive audit reports, including equipment inventory, access logs, network events, and VPN configurations. Our team can provide a technical compliance report tailored to NIS2 requirements and ANSSI standards. Contact our security team to prepare for your audit.

Question 5

How do Eziwan and IEC 62443 correspond to each other?

Accepted Answer

The Eziwan architecture complies with the requirements of IEC 62443-3-3 at Security Level 2 (SL2): authentication, encryption, audit trail, flow control, and software integrity. For customers wishing to achieve SL3, enhanced configurations are available (physical isolation, hardware token authentication).

Question 6

How do I implement IT/OT network segmentation in my factory?

Accepted Answer

IT/OT network segmentation is the top priority recommended by IEC 62443 and ANSSI for protecting industrial systems. The reference architecture is the Purdue model (ISA-95/ISA-99), which defines five levels: Level 0 (field, sensors, actuators), Level 1 (PLCs, drives), Level 2 (SCADA supervision, HMIs), Level 3 (MES, data logging), Level 4 (ERP, IT office systems). The fundamental rule is that no traffic should cross two levels without passing through a DMZ (demilitarized zone) with application-level filtering. In practice, IT/OT segmentation is implemented using an industrial firewall (Fortinet FortiGate, Palo Alto PA-400, Cisco FirePower) configured in application mode to inspect OT protocols (Modbus, OPC-UA, EtherNet/IP). Dedicated VLANs isolate each zone: VLAN 10 for PLCs, VLAN 20 for supervision, and VLAN 30 for remote access. With Eziwan, segmentation is built-in: the OT gateway initiates an outbound OpenVPN connection to the cloud (zero inbound ports), and the VPN tunnel itself serves as an isolated channel compliant with IEC 62443-3-2. The OT network never sees the corporate IT network—each Eziwan site has its own encrypted tunnel.

Question 7

How is a cybersecurity audit of OT industrial systems conducted?

Accepted Answer

An OT cybersecurity audit differs fundamentally from a traditional IT audit in that it must be conducted without interrupting production. The standard methodology follows four phases. Phase 1 — Passive mapping (2–3 days): identification of devices on the OT network without injecting any active traffic. The tools used include Nmap in passive mode (monitoring existing traffic only), Claroty, Nozomi Networks Guardian, or Dragos Platform, which analyze network traffic captured via a SPAN port. This phase produces a comprehensive inventory: PLCs, HMIs, engineering workstations, and industrial switches, including their firmware versions. Phase 2 — Vulnerability Analysis (3–5 days): Cross-referencing the inventory with CVE databases (NVD, ICS-CERT) to identify active CVEs on your devices. Typical examples: Siemens SINEMA (CVE-2022-43767, CVSS score 9.8), Schneider EcoStruxure (CVE-2023-37196), Rockwell ControlLogix (CVE-2022-1159). Phase 3 — Controlled Penetration Testing (optional, off-production): penetration tests conducted during a scheduled maintenance window to verify the actual exploitability of the identified CVEs. Phase 4 — Report and Roadmap (5–10 days): final deliverable including CVSS severity scores, workflow mapping, prioritized recommendations, and a 12-month remediation plan. The total duration of a comprehensive OT audit is 4 to 8 weeks, depending on the scope (number of sites, number of PLCs). The cost ranges from €15,000 to €80,000, depending on complexity.

Question 8

Which PLCs are the most vulnerable to cyberattacks today?

Accepted Answer

Industrial control systems have significant structural vulnerabilities because they were designed at a time when connectivity was not a priority. The three product lines most frequently targeted in 2024–2025 are as follows. Siemens S7-1500: CVE-2022-43767 (CVSS score 9.8) allows remote code execution via the built-in web server on firmware versions prior to V2.9.4. CVE-2023-46280 affects OPC-UA communications. Schneider Electric Modicon M340: CVE-2022-45788 (CVSS 9.8) allows for a denial-of-service attack via the unauthenticated Modbus TCP port 502. Unity Pro firmware versions prior to V3.60 are also affected by privilege escalation vulnerabilities. Rockwell Automation ControlLogix: CVE-2023-3595 and CVE-2023-3596 (CVSS 9.8), disclosed in July 2023, allow unauthorized modification of ladder programs over the network. These CVEs have been exploited in attacks targeting critical U.S. infrastructure. The recommended firmware update process for all these controllers is: (1) review the PSIRT (Product Security Incident Response Team) bulletins from each manufacturer, (2) test the firmware in a simulation environment before deploying it to production, (3) deploy during a scheduled maintenance window with a rollback plan, (4) verify the integrity of the downloaded firmware (SHA-256 hash published by the manufacturer). Eziwan subscribes to the PSIRT bulletins from Siemens, Schneider, and Rockwell to alert affected customers within 24 hours of the publication of a critical CVE.

Cybersecurity Compliance
integrated manufacturing

What each regulation
requires you to

6 layers of security
Zero Trust OT

Zero Inbound Port

End-to-end encryption

Strong Authentication

RBAC & Access Control

OT/IT Segregation

Secure Firmware & OTA

Eziwan covers Key Requirements

Certified. Documented.
Auditable.

Frequently Asked Questions

Ready to Get Started on Your Compliance
Industrial cybersecurity?

Safety Requirement	CRA	NIS2	IEC 62443	ANSSI
Strong Authentication (MFA)
Encryption in transit (TLS 1.3)
Encryption at rest (AES-256)		—
Zero inbound ports (Zero Trust)
Granular RBAC	—
Immutable audit logs
Signed Firmware (OTA)		—		—
Vulnerability Management (CVE)		—	—	—
OT/IT Segregation	—
Continuity (Dual SIM Failover)	—		—
Sovereign Hosting in France	—	—	—
Complete technical documentation

Cybersecurity Complianceintegrated manufacturing

What each regulationrequires you to

6 layers of securityZero Trust OT