CODRA Panorama guide
Cybersecurity for nuclear Unified Control Centres and OT/IT Data Management Platforms in Africa
A practical guide to resilient nuclear SCADA applications built on the CODRA Panorama Suite OT/IT Data Management Platform: governance, IEC 62443 zones and conduits, NNR and IAEA source material, ANSSI ICS practices and Edge-to-Service patterns for distributed African operations.
Contents
- Why this matters now
- The regulatory and standards landscape in Africa and South Africa
- What makes nuclear SCADA different
- Common OT threat patterns
- Reference architecture aligned to IEC 62443
- 12 practical cybersecurity controls for nuclear SCADA
- Programme, governance and assurance evidence
- How ANSSI guidance supports African nuclear cybersecurity programmes
- A practical 90-day implementation roadmap
- Frequently asked questions
Why this matters now
Nuclear facilities depend on deterministic, high‑availability control systems. A cyber incident that degrades availability, integrity or operator trust can escalate into safety risk, production loss and regulatory non‑compliance. Across Africa, utilities and EPCs are modernising OT, extending plant lifetimes and planning for future capacity. Programmes are often phased and geographically distributed, so resilient hybrid architectures and trusted local delivery partners are as important as cybersecurity controls.
The regulatory and standards landscape in Africa and South Africa
- National Nuclear Regulator (NNR, South Africa): the NNR regulatory framework lists RG-0014, Guidance on implementation of Cyber or Computer Security for Nuclear Facilities.
- IAEA Nuclear Security: Computer Security Techniques for Nuclear Facilities describes risk-informed policies, programmes, management-system integration and protection of sensitive digital assets.
- IEC 62443: a series of standards for cybersecurity of industrial automation and control systems. Concepts such as zones, conduits and security levels provide a useful engineering structure.
- ANSSI (France): its industrial control systems guidance provides a practical deployment method, management commitment and OT-specific security practices.
Primary references: NNR regulatory framework and RG-0014 listing · IAEA computer security techniques · IEC cybersecurity and IEC 62443 · ANSSI ICS guide
Related resources: Sommet Africa Forward à Nairobi · BPI France interview
What makes nuclear SCADA different
- Safety is paramount: security controls must not compromise deterministic operation, trip setpoints or human‑machine interface reliability.
- Long lifecycles and heterogeneous estates: mixed generations of PLC, DCS and SIS technologies, patching constraints and legacy protocols require effective compensating controls.
- Regulatory assurance: operators need a documented, risk-based programme and evidence appropriate to the regulator, licence conditions and safety significance of the digital assets.
Common OT threat patterns
- Ransomware spillover from IT to OT via shared services or unmanaged remote access.
- Supply-chain and maintenance laptop risks (engineering stations and media as initial access).
- Protocol misuse (legacy field protocols without native authentication).
- Insider and third-party exposure (contractor accounts and weak onboarding or offboarding).
Reference architecture aligned to IEC 62443
1) Segmentation with zones and conduits
- Separate Enterprise IT, Site DMZ, Plant DMZ, Operations (SCADA/DCS) and SIS into distinct zones.
- Use monitored conduits (firewalls, data diodes, brokered services) with strict allow‑lists and protocol break‑points.
2) Plant and operations DMZs
- Terminate remote access, patch and content staging, anti‑malware updates and Historian replication in DMZ layers, not directly in control zones.
3) SIS isolation
- Physically and logically isolate Safety Instrumented Systems; prefer one‑way telemetry; avoid shared administration paths with basic process control systems (BPCS) and SCADA.
4) Deterministic communications
- Strict allow‑listing at L3/L4 and deep inspection for industrial protocols where feasible; time‑bounded remote sessions.
5) Trusted time and logging
- Signed, centralised logs and secure time sources for forensics and compliance evidence.
12 practical cybersecurity controls for nuclear SCADA
- Asset inventory and critical digital asset (CDA) identification
- Hardening baselines for servers/HMIs/PLCs/engineering stations
- Strict role-based access control (RBAC) and least privilege; MFA for elevated and remote tasks
- Application allow‑listing and controlled removable media
- Patch and vulnerability management with maintenance windows and compensating controls
- Network segmentation with IEC 62443 zones and conduits and deep packet inspection (DPI) firewalls
- Secure remote access via jump hosts and session recording
- Change and configuration management for logic, graphics and setpoints
- Backups and golden images: offline, tested and tamper-evident
- OT anomaly detection integrated with a security operations centre (SOC)
- Incident response runbooks coordinated with safety procedures (graded)
- Competency and drills for operators, maintainers and third parties
Programme, governance and assurance evidence
- Computer Security Programme owned by plant leadership; scope includes all CDAs, interfaces and contractors.
- Risk‑based, graded approach mapped to plant safety significance.
- Periodic reviews and evidence (audits, tests and exercises) integrated with plant safety management.
How ANSSI guidance supports African nuclear cybersecurity programmes
France’s ANSSI guide for Industrial Control Systems is a practical handbook used by utilities and OEMs. It stresses executive sponsorship, a structured deployment method and OT‑specific compensating controls. This is particularly relevant to African operators modernising legacy fleets or planning new builds.
Read more: ANSSI: Cybersecurity for Industrial Control Systems
A practical 90-day implementation roadmap
Need a broader operating model for utilities and industry teams? Pair this guide with Building a Unified Control Centre in South Africa with CODRA Panorama Suite for architecture, delivery and partner-readiness context.
Weeks 0 to 4: baseline and gap assessment
- Asset inventory, CDA mapping, network walk‑downs
- Immediate priorities: USB lockdown and remote access hardening
Weeks 5 to 8: reference architecture
- Zone/conduit design, DMZs, logging/time, backup scheme
- Define SOC integration and monitoring scope
Weeks 9 to 12: hardening and assurance evidence
- Apply baselines and allow‑listing
- Test disaster‑recovery and run a tabletop incident drill
- Compile a compliance pack mapped to regulatory expectations
Frequently asked questions
Do we need IEC 62443 certification to comply?
Not necessarily. Applicable requirements come from the relevant regulator and licence conditions. IEC 62443 provides practical methods, including zones, conduits and security levels, that can support a risk-based cybersecurity programme.
Can security controls disrupt deterministic operations?
Controls must be engineered for OT: staged updates, protocol break‑points, and allow‑listing reduce risk while protecting availability and integrity.
Where should remote access terminate?
At DMZ jump hosts with strong authentication, least privilege and session recording, never directly inside control zones.
Need help?
I help organisations in South Africa and across Africa deploy CODRA Panorama Suite as an OT/IT Data Management Platform for nuclear SCADA applications and other highly regulated operational systems. For the wider platform and convergence context, read Panorama Suite for Africa: an OT/IT Data Management Platform for Unified Control Centres and IT/OT convergence in Africa: connect the business without weakening operations. Contact me on LinkedIn, read the BPI France interview, or see the CODRA Panorama Suite platform.