IEC 62443
Seguridad y soberanía
Separación OT/TI, zonificación Purdue y qué significa realmente un despliegue aislado.
Seguridad
IEC 62443 zones and conduits, Purdue-model segmentation, identity and role-based access at every service boundary, encryption at rest and in transit, and full audit logging. The platform is designed to run air-gapped: no licence check, no telemetry callback, no model download at runtime.
Tecnologías
- IEC 62443 zones and conduits
- Keycloak / OIDC
- HashiCorp Vault
- mTLS between services
- Immutable audit log
Datos de salida
- Audit trail
- Security alerts and segmentation gaps
- Access reports for compliance
Gobernanza
Data ownership, model governance, versioning and change control across every layer. Every prediction records the model version, the input snapshot and the configuration that produced it, so a decision made eighteen months ago can be reconstructed exactly — which is what an audit, or an incident investigation, actually requires.
Tecnologías
- Model registry with immutable versions
- OpenLineage
- Data contracts
- Approval workflow
- Reproducible run snapshots
Datos de salida
- Reproducible decision records
- Compliance and audit packages
- Impact analysis for proposed changes
Acquisition crosses the dashed boundary in one direction only, enforced by network architecture rather than by configuration.