BRIGANTIA Industries

Industrial cybersecurity

See the architecture
IEC 62443Security for industrial automation and control systems
NIS2Directive (EU) 2022/2555
Decree-Law no. 125/2025Portuguese Cybersecurity Legal Framework, in force since 3/4/2026
GDPRRegulation (EU) 2016/679 (GDPR)

Zones and conduits

Network zones separate office systems, production and machine control. The BRIGANTIA server runs on site in the operations zone.

Z4 · ENTERPRISE

ERP, email, office

ERPEmailWorkstations
C1 · FIREWALL, ALLOWED FLOWS ONLY
Z3.5 · INDUSTRIAL DMZ

Controlled connections between IT and OT

ReplicaUpdatesJump host
C2 · DATA OUT ONLY, TLS 1.3
Z3 · OPERATIONS

BRIGANTIA server, on site

BRIGANTIA serverDatabaseLogs
C3 · FILTERED INDUSTRIAL PROTOCOLS
Z2 · SUPERVISION

Production monitoring

SCADA / HMIVisionDashboards
C4 · ISOLATED FIELD NETWORK
Z1 · CONTROL

Cells and machines

PLCRobotsControllers
Optional

EU cloud

Encrypted copies and dashboards outside the factory. Can be switched off at any time.

No direct internet access to the control network. Remote commands require local authorisation.

Security controls

OT/IT segmentation

Separate network segments for production and office systems.

Zones and conduits

Each zone has a target security level. Each conduit has a closed list of allowed flows.

Least privilege

Named accounts, role-based access and multi-factor authentication.

Audit logs

Write-only logs with synchronised timestamps, stored on site.

Encryption

Encryption in transit and at rest. Customer-managed keys.

Updates

Signed and tested updates, installed during agreed maintenance windows.

NIS2 in industry

NIS2 includes the manufacture of machinery, electrical equipment, electronics, vehicles and other transport equipment among the sectors covered. In Portugal it applies through Decree-Law no. 125/2025, since 3 April 2026.

Sources: Directive (EU) 2022/2555, Annex II; CNCS, cncs.gov.pt; Diário da República, DL 125/2025 and Regulation no. 756/2026.

Risk management
Technical and organisational measures proportionate to the risk, approved by the management body.
Supply chain
The factory is also responsible for the security of its suppliers. BRIGANTIA provides its system's security documentation for that process.
Notification
Early warning within 24 hours, notification within 72 hours and a final report within one month, for significant incidents.
Accountability
Management bodies are accountable for the measures and receive training.

Data storage

On-site storage by default. Optional cloud backups and reporting.

Recommended

On site

Server inside the factory, in the operations zone. Production continues without internet.

Data: customer's factory · Keys: customer · Remote access: only with local authorisation

Optional

EU cloud

Encrypted copies and dashboards accessible outside the factory, hosted in the European Union.

Data: EU · Keys: customer · Outbound: data only, never commands

Optional

Hybrid

On-site production with cloud reporting and backups.

Data: factory and EU · Keys: customer · Can be switched off at any time

Incident response

Before

Prepare

Plan, contacts, tested offline backups.

Hour 0

Detect and contain

Isolate the affected zone.

Within 24 h

Early warning

Support for the customer's early warning to the national CSIRT.

Within 72 h

Notify and recover

Assessment, restore from clean backups.

Within 1 month

Report and lessons

Cause, fixes, updated plan.

Phases per NIST SP 800-61. Notification deadlines: NIS2, Article 23.

Technical measures

Request technical specifications
Encryption in transitTLS 1.3
Encryption at restAES-256, customer-managed keys
AuthenticationMulti-factor, named accounts, SSO with the factory directory
AuthorisationRole-based profiles; temporary privileges for maintenance
LogsWrite-only, synchronised time, exportable to the customer's SIEM
Remote accessThrough a jump host in the DMZ, recorded session, local approval
SoftwareSoftware bill of materials (SBOM) and signed updates

Contact

hello@brigantia-industries.com