Meana Petro

IEC 62443

Seguridad y soberanía

Separación OT/TI, zonificación Purdue y qué significa realmente un despliegue aislado.

SEC

Seguridad

IEC 62443 zones and conduits, Purdue-model segmentation, identity and role-based access at every service boundary, encryption at rest and in transit, and full audit logging. The platform is designed to run air-gapped: no licence check, no telemetry callback, no model download at runtime.

Tecnologías

  • IEC 62443 zones and conduits
  • Keycloak / OIDC
  • HashiCorp Vault
  • mTLS between services
  • Immutable audit log

Datos de salida

  • Audit trail
  • Security alerts and segmentation gaps
  • Access reports for compliance
GOV

Gobernanza

Data ownership, model governance, versioning and change control across every layer. Every prediction records the model version, the input snapshot and the configuration that produced it, so a decision made eighteen months ago can be reconstructed exactly — which is what an audit, or an incident investigation, actually requires.

Tecnologías

  • Model registry with immutable versions
  • OpenLineage
  • Data contracts
  • Approval workflow
  • Reproducible run snapshots

Datos de salida

  • Reproducible decision records
  • Compliance and audit packages
  • Impact analysis for proposed changes
L5 — EnterpriseL4 — BusinessL3.5 — DMZL3 — Site operationsL2 — SupervisoryL1 — ControlL0 — Process

Acquisition crosses the dashed boundary in one direction only, enforced by network architecture rather than by configuration.