Defence and aerospace: protecting plants, communications and the supply chain

Three surfaces to protect

Bases, plants and platforms increasingly integrate information systems and operational technology. Communications are digital and distributed. The industrial supply chain, largely made up of specialised suppliers and SMEs, accesses the client’s data and systems.

Each of these surfaces is a potential entry point for persistent threats, often attributable to state actors.

What the rules require

NIS2 and the National Cyber Security Perimeter require security measures, incident reporting and supply chain control. For industrial environments, IEC 62443 defines zones, conduits and security levels; the Cyber Resilience Act extends requirements to products with digital elements.

Operational priorities

1. Map assets, flows and dependencies, including suppliers.
2. Segment IT, OT and communications networks into zones and conduits.
3. Continuously monitor IT and OT, with sector threat intelligence.
4. Regularly test controls and the supply chain with red teaming exercises.
5. Have response procedures that restore operational capability.