Case 01
IndustrialClient not identifiedIEC 62443-3-3ENS · mp.com

A flat industrial network sharing a broadcast domain with office IT

Layer 1 · Problem

The line controller and an external supplier's laptop reached the administrative machines directly. Any email opened in the office had a path down to the plant floor.

Layer 2 · Framework applied

Zoning and conduits per IEC 62443-3-3. National framework communication-protection measures applied to the corporate segment. Asset inventory as a verifiable baseline.

Layer 3 · Measured outcome
64 → 0
Unauthorised paths into the industrial network
3
Authorised conduits, documented and monitored
4 min
Detection of anomalous traffic, previously undetermined
0
Production stoppages during the work
Case 02
Local governmentEntity not identifiedRD 311/2022EN 301 549

An e-government portal that worked but could not be evidenced

Layer 1 · Problem

The online procedure had been running for two years and nobody complained. There was no risk analysis, no system categorisation, no statement of applicability and no accessibility statement. In the first file that required medium category, there was nothing to submit.

Layer 2 · Framework applied

Risk analysis, system categorisation and statement of applicability under the National Security Framework. Portal reviewed against EN 301 549, with the accessibility statement published complete with method and date.

Layer 3 · Measured outcome
68 → 4
Accessibility criteria failed
Medium
System category, previously uncategorised
9 weeks
From kick-off to documented conformance
Case 03
Private care homeEntity not identifiedArt. 9 GDPRContinuity

A care centre whose backups had never once been restored

Layer 1 · Problem

Backups ran every night and the report had come back green for three years. Nobody had ever attempted a restore, and the only accessible copy lived on the same network as the clinical records server.

Layer 2 · Framework applied

Health data classified as a special category under Article 9 GDPR, a backup scheme with one replica disconnected from the network, and a full restore test measuring the real time back to service.

Layer 3 · Measured outcome
3 of 7
Systems that restored first time in the initial test
26 h → 4 h
Measured recovery time, previously only estimated
1
Offline copy, previously none
Case 04
Tourist accommodationEntity not identifiedGDPRSegmentation

A hotel where the guest wifi reached the booking server

Layer 1 · Problem

The guest network, the point of sale terminal, the cameras and the booking server shared the same addressing. Any guest connected from their room could see the machine holding the reservations and the traveller register.

Layer 2 · Framework applied

Guest network isolated, with client isolation between guests as well. Separate segments for the point of sale and for the cameras. Review of how traveller register data is processed and how long it is kept.

Layer 3 · Measured outcome
6 → 0
Servers visible from the guest wifi
4
Separate segments, previously one
17
Unknown devices found in the initial inventory

We never publish architectures, vendors, versions or console captures. Showing a client's blueprint would itself be a security incident.

Cases illustrating the working method. Client projects are documented under a confidentiality agreement.