Securing OT Cloud Connections Under IEC 62443

Unidirectional data flows protect PLCs while enabling 15-25% industrial energy savings.

OT cyber security for energy cloud connectivity is the systematic enforcement of technical, physical, and administrative controls to protect operational technology (OT) assets while securely transmitting real-time utility data to external cloud networks. Industrial facilities, specifically within highly regulated chemical and pharmaceutical manufacturing sectors, face a persistent conflict between operational efficiency and cyber-physical security. To reduce greenhouse gas emissions and verify compliance with environmental standards, manufacturers must collect granular energy consumption data. Collecting this data requires connecting physical assets, such as steam boilers, chillers, and electrical distribution panels, to cloud-based analytics engines.

However, bridging the gap between isolated OT networks and public cloud environments introduces severe risks. A compromised cloud connection can provide an entry point for threat actors seeking to pivot laterally into programmable logic controllers (PLCs), potentially disrupting production, contaminating sensitive batches, or causing catastrophic physical failures. Securing this boundary requires strict adherence to international industrial cyber security standards, ensuring that data flow remains strictly outbound and that external write-back capabilities are engineered out of the network architecture.

Defining the Technical Scope

Securing the IT-OT boundary for energy telemetry involves protecting the control plane while enabling high-frequency data extraction. The data flow originates from field-level sensors measuring six core utility streams: electricity, gas, water, steam, compressed air, and oil. These measurements pass through PLCs or local remote terminal units (RTUs) up to a gateway device. The gateway package acts as the protocol converter and boundary guard, transmitting data over a wide area network (WAN) to the cloud analytics platform. OT cyber security protocols ensure that this WAN connection cannot be manipulated to send unsolicited commands, modify PLC registers, or alter system configurations.

The Operational Reality of Energy Monitoring

Traditional industrial environments often relied on 'air-gapped' networks to guarantee security. This isolation is no longer practical when facilities must track energy performance indicators in real time to satisfy corporate sustainability mandates. Modern energy intelligence engines require continuous data streams to perform complex calculations, such as tracking consumption per batch or identifying sub-metre anomalies. To gain these insights without compromising physical safety, engineers must replace the traditional air gap with a cryptographically secure, unidirectional logical boundary.

Regulatory Pressure in Chemical and Pharmaceutical Manufacturing

Regulated manufacturing facilities operate under stringent quality management frameworks. In pharmaceutical manufacturing, facilities must comply with Good Manufacturing Practice (GMP) standards, where any unauthorised change to control processes can invalidate an entire production batch, costing millions of pounds. Chemical plants operate under strict safety guidelines due to the hazardous nature of the processes. Consequently, any cloud-connected device must provide absolute assurance that it cannot interfere with the underlying control loops. Furthermore, these sites must produce audit-ready data for:

• ISO 50001 (Energy Management Systems)
• SECR (Streamlined Energy and Carbon Reporting)
• ESOS (Energy Savings Opportunity Scheme)
• EU ETS (European Union Emissions Trading System)

---

IEC 62443-3-3: The Standard for IT-OT Boundary Protection

The international standard IEC 62443-3-3:2013 serves as the primary technical benchmark for securing industrial automation and control systems (IACS). This standard defines detailed system security requirements and evaluates the system under consideration against target Security Levels (SL-T), achieved Security Levels (SL-A), and capability Security Levels (SL-C).

Capability Security Levels (SL-C) and Target Levels (SL-T)

Security levels within IEC 62443-3-3:2013 range from SL 1 (protection against casual or coincidental violation) to SL 4 (protection against sophisticated threats with high resources). For chemical and pharmaceutical manufacturers establishing cloud connectivity, aiming for SL-C 3 or SL-C 4 is necessary to resist deliberate cyber attacks. To meet these capability security levels, systems must satisfy strict requirements across the seven Foundational Requirements (FRs):

1. FR 1: Identification and Authentication Control (IAC)
2. FR 2: Use Control (UC)
3. FR 3: System Integrity (SI)
4. FR 4: Data Confidentiality (DC)
5. FR 5: Restricted Data Flow (RDF)
6. FR 6: Timely Response to Events (TRE)
7. FR 7: Resource Availability (RA)

System Requirements for Energy Analytics

To achieve secure cloud connectivity, security architects focus intensely on FR 5 (Restricted Data Flow). This requirement dictates that the control system must segment networks into logical zones connected by secure conduits. When transmitting energy telemetry to the cloud, the conduit connecting the trusted local OT network (typically Level 2 or 3 of the Purdue Model) to the untrusted Enterprise Zone or Cloud (Level 5) must prevent unauthorised communication. Under IEC 62443-3-3:2013, any bridge across these zones must enforce restricted, filtered, and monitored pathways.

Furthermore, FR 3 (System Integrity) requires mechanisms to detect and prevent unauthorised changes to the control system. Any energy monitoring integration must guarantee that no configuration changes, setpoint alterations, or firmware updates can be pushed back down from the cloud to the physical plant.

Zone Partitioning and Conduit Security

The standard requires a formal risk assessment to partition the plant into distinct security zones. For instance, the safety-instrumented systems (SIS) remain in the most isolated zone, while general control PLCs occupy a separate control zone. The gateway collecting energy metrics from Modbus, BACnet, or OPC UA networks acts as a conduit endpoint. System integrators configure this conduit to filter all packets, dropping any traffic that does not originate from the defined local energy monitoring hardware.

---

Engineering a Non-Invasive Read-Only Data Architecture

To satisfy the stringent requirements of ISO/IEC 27001 and NIST SP 800-82 Rev. 3, industrial security architects construct data boundaries that eliminate the possibility of external intrusion. The most reliable method to achieve this is through a read-only architecture, which ensures that data can only travel outbound.

Unidirectional Security Gateways and Physical Data Diodes

Unidirectional security gateways, commonly referred to as data diodes, enforce a physical, hardware-based one-way data flow. A physical data diode uses an internal fibre-optic link where the transmitter is physically separated from the receiver. There is no physical copper or fibre return path. Because the return path does not exist, it is physically impossible for a cyber actor in the cloud or enterprise network to send command signals back down to the PLC network.

This hardware-enforced barrier provides the highest level of security, satisfying the requirements of NIST SP 800-82 Rev. 3 for protecting critical national infrastructure and highly regulated manufacturing sites. The physical unidirectional configuration prevents common cyber threats, such as remote configuration tampering and malicious firmware injection, from reaching operational systems.

Read-Only Configurations for OPC UA and MQTT Protocols

For facilities where physical data diodes are cost-prohibitive, software-enforced read-only configurations are implemented. Security teams configure application layer protocols, such as OPC UA and MQTT, to strictly limit data transmission to outbound-only publishing.

In a typical read-only OPC UA deployment, the local gateway acts as an OPC UA Client, retrieving register values from the PLC (such as steam flow rates, water consumption, and electricity usage). The gateway transforms this data and pushes it outbound via encrypted HTTPS or MQTT to the cloud. The OPC UA Server in the PLC is configured to deny all write requests from the client gateway, locking down PLC register blocks. Firewalls at the network perimeter are configured to block all incoming connection requests, allowing only outbound connections initiated by the local gateway.

For MQTT, the local broker publishes telemetry to an external cloud broker using a publish-only account. The cloud-based analytics engine lacks the credentials or network access to publish commands back to the local broker, preventing malicious command injection.

Alignment with NIST SP 800-82 Rev. 3 and ISO/IEC 27001

The United States National Institute of Standards and Technology published NIST SP 800-82 Rev. 3 specifically to address the risks associated with IT-OT convergence. This revision emphasises that modern cloud integrations must treat the IT-OT boundary as a high-risk attack surface. Security architects configure boundary protection devices to drop unauthorised packets, disable unused ports, and restrict administrative access.

Similarly, ISO/IEC 27001 controls mandate secure network design and access restriction. By implementing a read-only architecture, manufacturers provide auditors with positive, deterministic proof that the energy monitoring system cannot compromise the confidentiality, integrity, or availability of core production processes.

---

Aligning Energy Monitoring with the UK NCSC CAF

The UK's National Cyber Security Centre (NCSC) publishes the Cyber Assessment Framework (CAF) to guide operators of essential services and critical national infrastructure (CNI) in securing their digital environments. The CAF is increasingly relevant to chemical and pharmaceutical manufacturers, particularly with the introduction of the Cyber Security and Resilience Bill in 2026, which places the CAF on a statutory footing for regulated manufacturing and essential services.

Network Segmentation under Principle B5

The NCSC CAF Principle B5 (Resilient Networks and Systems) emphasises the importance of network segmentation. Regulated manufacturing sites must isolate their production networks from corporate IT and external cloud environments. If a compromise occurs in the corporate domain, proper segmentation prevents the threat from moving laterally into the production facility.

When implementing energy monitoring, architects segment the collection devices into a dedicated "Energy Telemetry Zone". This zone has no direct connection to the main enterprise Active Directory, nor does it share routing paths with the primary office network. By restricting communication between the Energy Telemetry Zone and the corporate network, operators satisfy the CAF's requirement to limit the impact of security incidents.

Continuous Outbound Traffic Analysis

NCSC CAF Principle C1 (Security Monitoring) requires organisations to continuously monitor their networks to detect anomalous behaviour. For energy cloud connectivity, traffic analysis tools must inspect packets passing through the IT-OT boundary.

By deploying non-intrusive network taps, security teams inspect the metadata of outbound telemetry. This ensures that only authorised protocols, such as encrypted MQTT (MQTTS over port 8883) or HTTPS (over port 443), are crossing the boundary. Any unexpected outbound traffic, such as SSH or Telnet, immediately triggers alerts, enabling security teams to isolate the gateway before data extraction or lateral spread can occur.

Compliance with the Cyber Security and Resilience Bill

The Cyber Security and Resilience Bill establishes strict compliance requirements for UK-based industrial entities. Under this legislation, companies must prove that their cloud connections do not introduce vulnerabilities into processes classified as essential or critical. Implementing a verified read-only telemetry architecture that maps to the NCSC CAF principles provides a defensible compliance posture, protecting operators from substantial fines while ensuring continuous operations.

---

Operationalising Secure Energy Telemetry via Omni Vision

The Omni Vision Energy Intelligence Platform from EnerTherm Engineering provides an industry-compliant framework for establishing secure, cloud-based energy monitoring without compromising plant operational integrity. Built on a standardised 8 to 16 week turnkey deployment model, the platform combines precision local hardware integration with EPS's cloud-based AI analytics engine.

Non-Invasive Instrumentation and PLC Integration

To avoid interfering with existing plant operations or safety certifications (such as GMP in pharmaceuticals or HACCP in food and chemical sectors), the platform utilises non-invasive connectivity. Field devices and existing PLCs communicate energy data using standard protocols:

• Modbus TCP/RTU for electrical sub-metres and thermal energy calculators.
• OPC UA for structured metadata exchange from supervisory systems.
• BACnet for building services, HVAC, and chilling system telemetry.
• MQTT for lightweight, payload-efficient outbound transmission.

The local integration hardware acts as a strict read-only collector, retrieving high-frequency telemetry from the six core utility streams. The hardware is physically configured to perform a secure, one-way cloud push, ensuring zero write access to the underlying control PLCs. This completely mitigates the risk of external setpoint tampering or operational disruption.

One-Way Cloud Push to the EPSA AI Analytics Engine

Once the outbound data crosses the secure boundary, it enters the EPSA cloud analytics platform. This platform applies advanced AI-driven anomaly detection and predictive forecasting to the ingested telemetry. Because the connection is physically unidirectional, the AI engine processes the data, calculates production-linked KPIs (such as energy per batch or cost per tonne), and identifies waste streams entirely in the cloud plane.

This architecture guarantees that even if the cloud analytics interface is compromised, the attacker cannot reach back down the telemetry pipeline to affect the physical manufacturing plant. The local PLC networks remain entirely isolated, preserving plant safety and operational continuity.

Decarbonisation Auditing and Commercial Returns

By combining secure network architecture with high-fidelity telemetry, the platform enables chemical and pharmaceutical facilities to transition from manual, error-prone spreadsheet tracking to centralised, automated intelligence. The system provides:

• Real-time, granular audit-ready data to satisfy compliance requirements for the aforementioned environmental and carbon reporting frameworks.
• Automated Scope 1 and Scope 2 CO₂ emissions reporting linked directly to production batches, enabling precise product carbon footprinting.
• Rapid economic return, typically delivering 15 to 25 per cent energy cost reductions with a sub-12-month ROI through anomalous consumption alerts and peak demand forecasting to guide operator-led demand management.

Using this secure-by-design telemetry path, manufacturers successfully drive decarbonisation initiatives while maintaining an ironclad cyber defence posture that meets the highest standards of international OT security.

---

This article reflects the independent analysis and editorial opinion of EnerTherm Engineering. Product names, trademarks, and brands mentioned belong to their respective owners. EnerTherm Engineering is not affiliated with, endorsed by, or a licensee of any third-party software or product mentioned unless explicitly stated.