1What the AI assistant does
From a description of your OT facility—SCADA, PLCs, and industrial networks—the AI automatically generates the first sections of the IEC 62443 analysis:
📋
IEC 62443 Context
Title, SUC, operator, scope, objectives, and standards
⚠
ZCR2 — Initial Risk
Initial risk scenarios with assets, events, likelihood, and severity
🗺
ZCR3 — Zones & Conduits
Initial security-zone and conduit segmentation with target SL
The AI also suggests an initial security-zone structure with target security levels (SL-T) suited to the facility type. Treat it as a starting point to refine with your OT team.
2Configure the AI assistant
Enter your API key in Project Management → AI Configuration before first use.
| Provider | Benefits | Recommended for IEC OT |
|---|---|---|
| Gemini (Google) | Free, generous quota, good OT knowledge | ✓ Yes |
| Claude (Anthropic) | Excellent technical reasoning, MITRE ATT&CK for ICS | ✓ Yes |
| Mistral AI | European models, GDPR | Depends on model |
| Groq | Very fast, free quota | — |
| Ollama (local) | 100% local, no outbound data—suitable for an OIV/SEVESO site with no network egress | Depends on model |
Other engines—HuggingFace, OpenRouter, or an OpenAI-compatible server of your choice—are available in advanced configuration and marked Experimental.
For IEC 62443 analyses of critical systems such as OIV or SEVESO sites, Claude or Gemini gives the best results for specific OT threat scenarios. In a network-isolated environment, Ollama runs the model locally with no API key or outbound data.
3Open AI Scoping
In the side menu under IEC 62443 standard, click ✦ AI Scoping.
4Write the facility description worksheet
Paste a structured description of your System Under Consideration into the text area. Preloaded examples are available from the Drinking-water example and Biomass-plant example.
Recommended sections
| Section | Expected content |
|---|---|
| SUC identification | System name, facility type, operator, and sector |
| Functional description | Controlled process, capacity, and operating mode (24/7, seasonal, etc.) |
| OT architecture | PLCs (make and model), SCADA, HMI, industrial networks, and protocols |
| IT/OT interconnections | Gateways, VPN, remote-maintenance access, and ERP/MES links |
| Essential assets | Critical services or processes (continuity, safety, environment) |
| Access control | Authentication, shared accounts, MFA, and provider management |
| Past incidents | Known cyber incidents, intrusion attempts, and network anomalies |
Download the template using ⬇ Download worksheet (.txt) —it contains every section relevant to an IEC 62443 OT context.
Do not include real IP addresses, sensitive equipment names, or confidential network topologies in the worksheet sent to the AI.
5Choose sections to pre-fill
Select sections to generate based on your analysis progress:
| Section | Generated data | When to use it |
|---|---|---|
| IEC 62443 Context | Study title, SUC description, operator, scope, objectives, applicable standards, and assumptions | Start of study—replaces manual context entry |
| ZCR2 — Initial Risk Assessment | Initial risk scenarios by OT asset: feared event, loss type (availability, integrity, or confidentiality), likelihood, and severity | Before defining zones—helps prioritise critical assets |
| ZCR3 — Zones & Conduits | Initial security-zone structure with assigned equipment, target SL, and inter-zone conduits | Initial segmentation to refine with the OT team |
Importing replaces existing data in selected sections. Deselect sections that have already been approved to preserve them.
6Run the analysis
- Check that the worksheet is sufficiently detailed (OT architecture, essential assets, and interconnections)
- Select the sections to generate
- Click ✦ Analyse worksheet and pre-fill
- Confirm in the dialog—generation takes 20 to 60 seconds
If an error occurs
| Message | Solution |
|---|---|
| Enter an API key | Open AI Configuration and enter the key |
| API key not valid | Incorrect or expired key—check the provider portal |
| No valid JSON | Description too short—add OT architecture and essential assets |
7Complete the generated analysis
Checks after import
- Check the context —adjust the scope and objectives to the sponsor's requirements
- Validate the ZCR2 scenarios —confirm or adjust likelihood and severity with the OT team
- Refine the ZCR3 segmentation —suggested zones are indicative and must be adjusted to the actual network topology
- Complete manually ZCR1 (detailed asset inventory), ZCR4 (detailed vulnerability assessment), and ZCR5 (threat scenarios by zone)
Use the button AI in ZCR5 to generate detailed threat scenarios for each zone/asset pair, with likelihood and severity—available directly from the ZCR5 page.
The SUC diagram is generated automatically from the zones and conduits defined in ZCR3 and updates in real time after every change.