IEC 62443, ISO 27001, TISAX ISA, CADIS and NIS2 interlock with one another. CONSUVATION GmbH brings all standards together – for a coherent security concept for your OT environment – in the DACH region and internationally.
Quick Check
30-second quick check – free & without registration
What Is OT Security?
OT security refers to the protection of Operational Technology – i.e. control and automation systems such as SCADA, PLCs and DCS – from cyberattacks and outages.
Unlike classic IT, OT environments prioritise the availability of physical processes above all else – an attack can endanger not just data, but machinery, facilities and human lives.
Several standards govern OT security – ISO 27001, IEC 62443, TISAX, CADIS, NIS2 and KRITIS – and interlock with one another. CONSUVATION helps you keep an overview and meet all requirements efficiently.
Standards & Frameworks
OT security is not a single standard – it's an ecosystem of standards that build on one another. CONSUVATION knows them all and integrates them into a coherent concept for your facility.
Base Standard · ISMS
ISO/IEC 27001:2022
ISO 27001 is the foundation for all other standards. It defines the overarching information security management system (ISMS) – and is directly referenced or assumed as a basis by TISAX, CADIS and NIS2. For OT operators, an ISO 27001-compliant ISMS is the most efficient entry point into all other standards.
Foundation for: IEC 62443 · TISAX · CADISOT Standard · Core Standard
IEC 62443 – Industrial Cybersecurity
IEC 62443 is the international OT standard. It defines security zones, channels and security levels (SL 1–4) specifically for SCADA, PLCs and DCS. CADIS references IEC 62443 directly for its OT module. NIS2 names IEC 62443 as a recognised technical implementation path. No other standard goes as deep into OT technology.
Referenced by: CADIS · NIS2 · KRITISAutomotive · VDA / ENX
TISAX ISA – Automotive OT
TISAX combines ISO 27001 Annex A with automotive-specific requirements. TISAX ISA (current) brings a decisive step: explicit focus on the IT and OT availability of suppliers. Production facilities are therefore now a direct subject of assessment – OT security is no longer optional, but a TISAX requirement.
Includes: OT Availability · Based on: ISO 27001DEKRA Assessment Procedure · Defence
CADIS – Defence Industry Suppliers
CADIS (Cybersecurity Assessment for Defence Industry Suppliers) is the first European assessment procedure for defence industry suppliers – developed by DEKRA Certification. It examines 14 modules, including OT security according to IEC 62443 explicitly. Referenced standards: ISO 27001, IEC 62443, NIST CSF, BSI C5, NIS2 and GDPR. CONSUVATION is an official CADIS consulting partner.
References: IEC 62443 · ISO 27001 · NIS2 · BSI C5EU Regulation · Since Dec. 2025
NIS2 Directive (German Implementation Act)
The NIS2 Directive obliges operators of essential and important entities – including OT operators – to implement cybersecurity measures. Technically recognised implementation path: IEC 62443 and ISO 27001. Mandatory since 6 December 2025 for critical infrastructure operators and industrial companies from 50 employees / €10 million in revenue across 18 sectors.
Technical Basis: IEC 62443 · ISO 27001German Regulation · BSI
Critical Infrastructure / BSI IT-Grundschutz
The German Critical Infrastructure Ordinance obliges operators of critical infrastructure in Germany. BSI IT-Grundschutz provides OT-specific modules for ICS/SCADA. Since December 2025, the German NIS2 implementation act has significantly expanded these requirements – the BSI registration deadline expired on 6 March 2026.
Basis: BSI-Grundschutz · IEC 62443 · NIS2Cross-Connections
Your company often needs to satisfy several standards simultaneously. We show you the synergies – and help you avoid duplicate work.
ISO 27001 covers the management system. IEC 62443 provides the OT-technical requirements. Together they form a complete ISMS with OT depth – without duplicate work.
TISAX builds on ISO 27001 Annex A. Companies that already have ISO 27001 reach TISAX with significantly less effort. TISAX ISA adds OT availability as a new mandatory field for production facilities.
CADIS references IEC 62443 directly for its OT security module. An IEC 62443-compliant environment is the strongest lever for a successful CADIS assessment in the defence supply chain.
NIS2 requires appropriate security measures but does not name specific tools. IEC 62443 + ISO 27001 are the internationally recognised evidence for NIS2 compliance in OT environments.
CADIS Module 1 is based on ISO 27001. Module 12 covers GDPR. Module 14 addresses NIS2 obligations. Companies that pass CADIS fulfil substantial parts of all three requirement frameworks simultaneously.
With TISAX ISA, TISAX expands its scope to production environments. Automotive suppliers with OT facilities must now include these in the security assessment – a direct link to IEC 62443.
What Applies to Your Company?
Different obligations apply depending on industry and company size. Here are the four most common scenarios.
Zone model, security levels (SL 1–4), network segmentation, asset management, patch management for SCADA, PLCs and DCS – without stopping production.
Establish an information security management system, conduct risk analysis, document security policies and embed them in OT environments – as the foundation for all other standards.
For automotive suppliers: include OT facilities in the TISAX assessment, demonstrate availability and security requirements, complete Assessment Level 2 or 3.
Complete all relevant CADIS modules – including OT security per IEC 62443, supply chain management, GDPR and NIS2. CONSUVATION supports you as an official consulting partner.
Implementation Checklist
Services
From initial analysis to assessment readiness – across standards, without operational disruption, with senior consultants.
01
Complete inventory according to IEC 62443-3-2: assets, network architecture, vulnerabilities, risks – without operational disruption.
02
Gap analysis, zone definition and implementation of measures for operators, integrators and manufacturers – fully documented and auditable.
03
Build or extend your ISMS with OT-specific modules – as the foundation for TISAX, CADIS, NIS2 and critical infrastructure requirements in one integrated project.
04
Consulting on TISAX certification under TISAX ISA – with a focus on the new OT availability requirements for automotive suppliers.
05
As an official CADIS consulting partner, we guide you through all 14 modules of the DEKRA assessment procedure – from applicability analysis to assessment readiness.
06
Applicability assessment, measures planning, BSI registration and incident reporting integration for OT operators across 18 sectors.
07
Controlled attack simulation against SCADA, PLCs and industrial networks – without stopping production, with evidence for TISAX and CADIS assessors.
08
OT security training for technicians, operators and management – IEC 62443 fundamentals, CADIS preparation, TISAX awareness, NIS2 management training (§ 38 BSIG).
Frequently Asked Questions
Our OT Security Solutions
CONSUVATION guides you the whole way – from selecting the right standards to passing the assessment.
Turnkey OT information security management system, fully tailored to IEC 62443 and ISO 27001. Includes all documents, processes and evidence for TISAX, CADIS and NIS2.
Learn More →Practical handbook for OT security implementation – clearly prepared for management and OT staff. With concrete action guidance, checklists and template documents according to IEC 62443 and ISO 27001.
Download Now →Tailored OT security training for management, OT technicians and employees. IEC 62443 fundamentals, CADIS preparation, TISAX awareness and NIS2 management training – certified and verifiable.
Request Training →Complete OT process model including all security domains according to IEC 62443 and ISO 27001. Ready-made policies, procedures and forms for TISAX, CADIS and NIS2 – ready to use immediately.
Request Now →Our Expertise
CONSUVATION exclusively employs experienced senior consultants. With more than 25 years of experience in information security and industrial cybersecurity, we are among the pioneers of the industry.
Our experts were among the first certified BS 7799 auditors – the British standard considered the direct predecessor of today's ISO 27001. They combine this foundational knowledge with current practical experience in IEC 62443, TISAX and CADIS.
As an official CADIS consulting partner and active members of ISO working groups, we bring insider knowledge that flows directly into your OT security implementation.
Our Tool: OT Correlation Matrix
CONSUVATION has developed its own correlation matrix for OT security requirements, mapping all relevant standards – IEC 62443, ISO 27001, TISAX ISA, CADIS, NIS2 and BSI-Grundschutz. This allows us to identify synergies and overlaps immediately and produce a complete gap analysis in the shortest possible time – without duplicate work, with maximum standards coverage.
Consultants, auditors & ISO working group members – deep first-hand standards knowledge, from the BS 7799 era to today
Many years of experience in the automotive industry – VDA ISA, Assessment Level 2 & 3, including new OT availability requirements
Specialised expertise in defence cybersecurity – practice-proven across all 14 CADIS modules
Our consultants hold the most renowned international ISACA certifications – from IT audit to IT governance
Take Action Now
Get advice from an experienced CONSUVATION consultant – free of charge and without obligation.