IEC 62443
vocabulary

Why we assess the conduit, not the device.

“Conduit” is not our word. IEC 62443, the industrial automation and control systems security standard, describes a plant as zones — groups of assets that share a security requirement — and conduits, the communication paths between them. We use that vocabulary descriptively, because the engineers we work with already do. Wardhelm holds no certification under the standard, and an assessment certifies nothing.

01
one floor

One hospital floor, drawn as zones.

Take a single floor. The clinical and supervisory network is one zone. The plant behind it is another: the chiller, the air handler, the pressure regime on an isolation room, the medical-gas alarm panel. Between the two sits a management server that can issue commands, and controllers that act on them. The path carrying those commands is the conduit. It is short, it is unglamorous, and it is where a decision taken on the IT side becomes a change in a physical space.

A device audit answers a different question. It inventories what is on the floor, what firmware each unit runs, and which advisories apply to it. Knowing a controller is vulnerable is not the same as knowing what it does. An advisory does not say which register that controller writes to one particular isolation room, or whether the management server is permitted to write it at 03:00 from an account that also serves the ward. The conduit carries that. Read the path and you are reading the authority one zone actually holds over another: which commands are possible, in which direction, and what each one would change in the building.

Two zones on one hospital floor, joined by a single conduit Zone A, the supervisory network, holds the building-management server. Zone B, the plant side, holds the chiller, air handler, room-pressure and medical-gas alarm controllers. One conduit joins them between two endpoint marks. A dashed branch leaves the conduit at a mirror port and runs one way down into a Wardhelm box, which is closed off by a solid bar. No line runs back from Wardhelm towards either zone. ZONE A — SUPERVISORY Building-management server Issues the commands Sits on the IT side ZONE B — PLANT / FIELD Controllers that act Chiller · air handler Room pressure · gas alarm CONDUIT One named control path The two ticks are the agreed endpoints SPAN / MIRROR / PCAP A copy you provide WARDHELM Reads the copy NO RETURN PATH IS DRAWN because none exists
Figure 1 — one conduit between two zones on a hospital floor, and the one-way branch the assessment reads. The endpoint marks are agreed in writing before any work begins.

02
the unit

The conduit is also the unit of sale.

For a Wardhelm assessment, one conduit means one named control path between two agreed endpoints. Both endpoints are written down before any work starts. Everything outside them is out of scope for that engagement, and any additional path is a separate conduit, scoped and quoted separately. The price is fixed after scope confirmation, against that written scope.

The reading is done from a copy: a SPAN or mirror port, or a capture file you hand us. We place nothing in the path, transmit nothing into the control network, and write to no device. That boundary is also the limit, and the limit is the honest part — a copy of one conduit shows what crossed that conduit and nothing else. A serial leg, a local HMI cable, a technician standing at the panel: none of them leave a trace in it. The report names those gaps instead of closing them quietly.

The last step is not ours. The map we build from the traffic goes back to you before it is final, and your biomedical engineer red-lines the map. Those corrections are part of the method, not an exception to it. Your engineer countersigns the findings, so the physical meaning is confirmed by your side, not asserted by ours.

What comes back is one signed findings report, in four sections — not four separate documents:

  1. Register-consequence map
  2. Existing-control coverage
  3. What could not be established
  4. Evidence appendix

The next step is a scoping call: we agree the two endpoints in writing, and nothing starts before that.

Book a scoping call See what the report contains