Resilient infrastructure. Secure control.

The portfolio covers securing SCADA and control systems with zones under IEC 62443, hardened remote access for unmanned sites, sensor data platforms for structural and water level monitoring, anomaly detection and inflow forecasting, encrypted control communication with HSM-backed keys, and KRITIS and NIS2 compliance with emergency operation. Each module can be commissioned on its own or as a package, with operation in German data centers.

We secure SCADA and control systems with zones under IEC 62443. We harden remote access for sites without staff on site. We build data platforms for measurements of structure and water level. We detect anomalies and create forecasts for inflow. We encrypt control commands with keys in the HSM. And we take care of KRITIS, NIS2 and practiced emergency operation. You can commission each module on its own or all together. With operation in German data centers.

No, if they are planned together with operations. Inventory and intrusion detection work passively and only read network traffic without sending commands to the controllers. We implement firewalls, access point and encryption in agreed maintenance windows, test them beforehand with operations staff and maintenance contractors and keep a way back ready for every step.

No, if we plan them together with operations. Inventory and attack detection work passively. They only read the network traffic. They send no commands to the controllers. We implement firewalls, access point and encryption in agreed maintenance windows. Beforehand we test them with operations staff and maintenance contractors. Every step has a way back.

Remote maintenance runs through a central access point with multi-factor authentication and is approved per session. Every session is recorded and can be terminated immediately, and service providers reach only the systems they actually maintain. We set down the requirements for manufacturers and maintenance contractors in the contract under IEC 62443-2-4.

Remote maintenance runs through a central access point. Login needs several factors. Every session is approved individually. Every session is recorded and can be stopped immediately. Service providers reach only the systems they maintain. The rules for manufacturers and maintenance contractors are in the contract. They follow the standard IEC 62443-2-4.

That depends on purpose and size. Reservoirs for drinking water supply and hydropower plants can reach the KRITIS thresholds, and under the German NIS2 implementation act many water utilities and power producers count as important or essential entities. We check applicability for each facility and, where needed, deliver registration, risk management and reporting channels. We work with operators of critical infrastructure and regulated industries. That is why these checks are part of our daily work.

That depends on purpose and size. Reservoirs for drinking water and hydropower plants can reach the KRITIS thresholds. Many water utilities and power producers also fall under NIS2. They then count as important or essential entities. The basis is the German implementation act. We check this for each facility. If you are affected, we deliver registration, risk management and reporting channels. We work with operators of critical infrastructure and regulated industries. That is why these checks are part of our daily work.

Not in our projects. The models calculate expected values and forecasts and send warnings and recommendations to the control room, while the operations staff decides on releases and gates according to the operating rules. The EU AI Act classifies AI systems as high-risk when they serve as safety components in the operation of water supply, so we document purpose, classification and limits of every model.

Not in our projects. The models calculate expected values and forecasts. They send warnings and recommendations to the control room. The operations staff decides on releases and gates. It follows the operating rules. The EU AI Act is the European law on artificial intelligence. It sees a high risk in some systems. This applies to AI as a safety component in water supply. That is why we document purpose, classification and limits for every model.

Remote terminal units and controllers often stay in the field for decades and will probably still be running when capable quantum computers can break today's algorithms. Certificates and firmware signatures based on RSA or elliptic curves must therefore be convertible to ML-KEM, ML-DSA or hash-based signatures at the next device replacement. The roadmap defines which devices and connections go first and ties the migration to renewals that are planned anyway.

Remote terminal units and controllers often stay in use for decades. They will probably still run when quantum computers can break today's encryption. Certificates and firmware signatures are based on RSA or elliptic curves today. They must be convertible at the next device replacement. The targets are ML-KEM, ML-DSA or hash-based signatures. These are new, quantum-safe methods. The roadmap defines which devices and connections go first. It ties the switch to renewals that are planned anyway.

Yes. We can scope a specific task first. We consider its interfaces with the rest of your infrastructure and agree which work is included before implementation.

Yes. We can scope a specific task first. We consider its interfaces with the rest of your infrastructure and agree which work is included before implementation.

A brief description of the challenge, the systems involved and your desired outcome is enough to start. Known deadlines and the relevant contacts are helpful. Please do not include credentials or confidential system documentation in an initial enquiry.

A brief description of the challenge, the systems involved and your desired outcome is enough to start. Known deadlines and the relevant contacts are helpful. Please do not include credentials or confidential system documentation in an initial enquiry.

OT security architect: Zone model, intrusion detection, IEC 62443. Cryptography specialist: PKI, HSM integration, PQC roadmap. Integration developer: Remote access point, site connectivity, measurement data interfaces. Data engineer: Time series platform, anomaly models, inflow forecasts. Compliance consultant: KRITIS, NIS2, IT-Grundschutz, emergency operation. Project lead: Milestones, maintenance windows, acceptance, reporting.

OT security architect: Zone model, intrusion detection, IEC 62443. Cryptography specialist: PKI, HSM integration, PQC roadmap. Integration developer: Remote access point, site connectivity, measurement data interfaces. Data engineer: Time series platform, anomaly models, inflow forecasts. Compliance consultant: KRITIS, NIS2, IT-Grundschutz, emergency operation. Project lead: Milestones, maintenance windows, acceptance, reporting.

We consider the systems, interfaces, available documentation and operational constraints. An agreed scope and milestones provide the basis for estimating effort. A fixed duration without these details would not be reliable.

We consider the systems, interfaces, available documentation and operational constraints. An agreed scope and milestones provide the basis for estimating effort. A fixed duration without these details would not be reliable.

Facilities, networks, remote access, measurement data and obligations under KRITIS and NIS2 Asset inventory, crypto inventory, gap analysis, list of measures prioritized by impact on facility safety

Facilities, networks, remote access, measurement data and obligations under KRITIS and NIS2 Asset inventory, crypto inventory, gap analysis, list of measures prioritized by impact on facility safety

Project: Clearly scoped undertaking such as a zone model for a dam, a central remote access point or a sensor data platform with a defined result, milestones and acceptance. Team reinforcement: OT security architects, cryptography specialists or data engineers work with your control systems, in your maintenance windows and under your approval processes. Managed service: OTOKO® operates intrusion detection, remote access point, PKI or sensor data platform with agreed service levels, reports and the evidence that KRITIS and NIS2 require.

Project: Clearly scoped undertaking such as a zone model for a dam, a central remote access point or a sensor data platform with a defined result, milestones and acceptance. Team reinforcement: OT security architects, cryptography specialists or data engineers work with your control systems, in your maintenance windows and under your approval processes. Managed service: OTOKO® operates intrusion detection, remote access point, PKI or sensor data platform with agreed service levels, reports and the evidence that KRITIS and NIS2 require.

Monitoring, certificates, exercises, knowledge transfer Intrusion detection in regular operation, certificate renewal, emergency exercises, stepwise handover

Monitoring, certificates, exercises, knowledge transfer Intrusion detection in regular operation, certificate renewal, emergency exercises, stepwise handover

We can account for future expansion in the initial concept. Documented interfaces and reusable rules provide a foundation. Each additional site or system still needs to be assessed for its particular requirements.

We can account for future expansion in the initial concept. Documented interfaces and reusable rules provide a foundation. Each additional site or system still needs to be assessed for its particular requirements.

Agree responsibilities, recurring tasks and change procedures alongside the technical implementation. Documentation and knowledge transfer help your team operate the solution. The specific activities and any ongoing support are part of the agreed scope.

Agree responsibilities, recurring tasks and change procedures alongside the technical implementation. Documentation and knowledge transfer help your team operate the solution. The specific activities and any ongoing support are part of the agreed scope.