Nicolas Hamel

CODRA Panorama guide

Nuclear SCADA integration in Africa with CODRA Panorama Suite

Panorama Suite can bring together data, alarms, history and operator views for non-safety supervision applications. Start with the project interfaces and responsibilities, then review the Andra reference and cybersecurity considerations below. Independent safety functions retain their role.

Discuss Panorama’s fit for your nuclear project

Share your country, the proposed supervision scope and the systems to integrate so we can identify relevant documentation and the right technical discussion.

Email CODRA AfricaContact Nicolas on LinkedIn

Published customer evidence

These CODRA customer references document specific deployments. Figures and project status refer to the cited publication. International examples illustrate technical scope; the country shown identifies where the project took place.

Andra · France · 2022

At the Bure research laboratory, Panorama hypervision consolidates local applications across surface facilities, access shafts and underground areas. The published account describes building services, access, video, personnel positioning and a decision-support unit providing scripted instructions for fire events. This is an operational supervision reference; it does not establish that Panorama replaces independent safety functions.

Read the CODRA customer reference (PDF) · EN

Contents

  1. Andra customer reference
  2. Why this matters now
  3. The regulatory and standards landscape in Africa and South Africa
  4. What makes nuclear SCADA different
  5. Common OT threat patterns
  6. Reference architecture aligned to IEC 62443
  7. 12 practical cybersecurity controls for nuclear SCADA
  8. Programme, governance and assurance evidence
  9. How ANSSI guidance supports African nuclear cybersecurity programmes
  10. A practical 90-day implementation roadmap
  11. Frequently asked questions

Why this matters now

Nuclear facilities depend on deterministic, high‑availability control systems. A cyber incident that degrades availability, integrity or operator trust can escalate into safety risk, production loss and regulatory non‑compliance. Across Africa, utilities and EPCs are modernising OT, extending plant lifetimes and planning for future capacity. Programmes are often phased and geographically distributed, so resilient hybrid architectures and trusted local delivery partners are as important as cybersecurity controls.

The regulatory and standards landscape in Africa and South Africa

Primary references: NNR regulatory framework and RG-0014 listing · IAEA computer security techniques · IEC cybersecurity and IEC 62443 · ANSSI ICS guide

Related resources: Sommet Africa Forward à Nairobi · BPI France interview

What makes nuclear SCADA different

  1. Safety is paramount: security controls must not compromise deterministic operation, trip setpoints or human‑machine interface reliability.
  2. Long lifecycles and heterogeneous estates: mixed generations of PLC, DCS and SIS technologies, patching constraints and legacy protocols require effective compensating controls.
  3. Regulatory assurance: operators need a documented, risk-based programme and evidence appropriate to the regulator, licence conditions and safety significance of the digital assets.

Common OT threat patterns

Reference architecture aligned to IEC 62443

1) Segmentation with zones and conduits

  • Separate Enterprise IT, Site DMZ, Plant DMZ, Operations (SCADA/DCS) and SIS into distinct zones.
  • Use monitored conduits (firewalls, data diodes, brokered services) with strict allow‑lists and protocol break‑points.

2) Plant and operations DMZs

  • Terminate remote access, patch and content staging, anti‑malware updates and Historian replication in DMZ layers, not directly in control zones.

3) SIS isolation

  • Physically and logically isolate Safety Instrumented Systems; prefer one‑way telemetry; avoid shared administration paths with basic process control systems (BPCS) and SCADA.

4) Deterministic communications

  • Strict allow‑listing at L3/L4 and deep inspection for industrial protocols where feasible; time‑bounded remote sessions.

5) Trusted time and logging

  • Signed, centralised logs and secure time sources for forensics and compliance evidence.

12 practical cybersecurity controls for nuclear SCADA

  1. Asset inventory and critical digital asset (CDA) identification
  2. Hardening baselines for servers/HMIs/PLCs/engineering stations
  3. Strict role-based access control (RBAC) and least privilege; MFA for elevated and remote tasks
  4. Application allow‑listing and controlled removable media
  5. Patch and vulnerability management with maintenance windows and compensating controls
  6. Network segmentation with IEC 62443 zones and conduits and deep packet inspection (DPI) firewalls
  7. Secure remote access via jump hosts and session recording
  8. Change and configuration management for logic, graphics and setpoints
  9. Backups and golden images: offline, tested and tamper-evident
  10. OT anomaly detection integrated with a security operations centre (SOC)
  11. Incident response runbooks coordinated with safety procedures (graded)
  12. Competency and drills for operators, maintainers and third parties

Programme, governance and assurance evidence

How ANSSI guidance supports African nuclear cybersecurity programmes

France’s ANSSI guide for Industrial Control Systems is a practical handbook used by utilities and OEMs. It stresses executive sponsorship, a structured deployment method and OT‑specific compensating controls. This is particularly relevant to African operators modernising legacy fleets or planning new builds.

Read more: ANSSI: Cybersecurity for Industrial Control Systems

A practical 90-day implementation roadmap

Need a broader operating model for utilities and industry teams? Pair this guide with Building a Unified Control Centre in South Africa with CODRA Panorama Suite for architecture, delivery and partner-readiness context.

Weeks 0 to 4: baseline and gap assessment

  • Asset inventory, CDA mapping, network walk‑downs
  • Immediate priorities: USB lockdown and remote access hardening

Weeks 5 to 8: reference architecture

  • Zone/conduit design, DMZs, logging/time, backup scheme
  • Define SOC integration and monitoring scope

Weeks 9 to 12: hardening and assurance evidence

  • Apply baselines and allow‑listing
  • Test disaster‑recovery and run a tabletop incident drill
  • Compile a compliance pack mapped to regulatory expectations

Frequently asked questions

Do we need IEC 62443 certification to comply?

Not necessarily. Applicable requirements come from the relevant regulator and licence conditions. IEC 62443 provides practical methods, including zones, conduits and security levels, that can support a risk-based cybersecurity programme.

Can security controls disrupt deterministic operations?

Controls must be engineered for OT: staged updates, protocol break‑points, and allow‑listing reduce risk while protecting availability and integrity.

Where should remote access terminate?

At DMZ jump hosts with strong authentication, least privilege and session recording, never directly inside control zones.

Need help?

I help organisations in South Africa and across Africa deploy CODRA Panorama Suite as an OT/IT Data Management Platform for nuclear SCADA applications and other highly regulated operational systems. For the wider platform and convergence context, read Panorama Suite for Africa: an OT/IT Data Management Platform for Unified Control Centres and IT/OT convergence in Africa: connect the business without weakening operations. Contact me on LinkedIn, read the BPI France interview, or see the CODRA Panorama Suite platform.

Evaluate Panorama for your project

For nuclear environments, qualify the proposed non-safety supervision scope with the operator before selecting a platform. Use a segregated demonstration and review required product versions, security evidence and interfaces through the operator’s assurance process. Product credentials do not establish approval of the complete installation or its suitability for a safety function.

To prepare the enquiry, collect system versions, available interfaces and point lists, required functions and operating constraints. Agree a demonstration scenario and acceptance criteria with the users. See the common selection and acceptance criteria.

What evidence should you request?

Official documentation describes product capabilities. A demonstration verifies the project interfaces and operating scenario. For comparable customer evidence, request a documented scope and an authorised reference discussion where available. Examples in this guide are evaluation scenarios unless explicitly identified as customer references.

Product and partner sources: Panorama Edge-to-Service · Panorama COM · CODRA partner network.

Contact Nicolas Hamel at CODRA with the country, sites, existing systems and the first operating decision you want to improve.

What information should I prepare for a Panorama enquiry?

Prepare the countries and sites, system versions, available interfaces and points, required functions and operating constraints. Nicolas Hamel coordinates qualification with CODRA and the appropriate integration route.

Discuss Panorama’s fit for your nuclear project

Share your country, the proposed supervision scope and the systems to integrate so we can identify relevant documentation and the right technical discussion.

Email CODRA AfricaContact Nicolas on LinkedIn