Part 1 defines four scenarios derived from two axes: where the programming software is located (engineering station vs vendor PC) and the scale of the OT operation (small with no SOC vs large with SOC, PAM, SIEM). Each scenario maps to a specific BifrostConnect product mix.The figure below shows the four implementations side by side. The detailed configuration for each scenario follows in the next four sections.
Part 1 requirement recap: Large utility or industrial site with vendor-owned licensed software on vendor laptops. Part 1 requires layered controls: NAC, vendor DMZ, OT-IDS with deep packet inspection, protocol-level monitoring, centralised SIEM, and isolation between vendor engagements.
Configuration:
- Bifrost Units deployed at each vendor access point on the OT network (Purdue L3 / DMZ).
- Unattended variant used for operations requiring admin-driven access without on-site presence.
- Bifrost Manager hosted on Dedicated Cloud or on-premises; SSO federated to enterprise IdP.
- SessionGuard VM deployed per customer engagement, giving isolation between different vendor-customer relationships.
- An OT-IDS co-deployed on the OT network to provide deep packet inspection on actual OT protocols (Modbus TCP, OPC UA, S7comm, IEC-104). This is co-deployment, not API-level integration: BifrostConnect and OT-IDS operate independently, correlated at the SIEM layer.
- SIEM receives: Bifrost Manager events, OT-IDS alerts, SessionGuard recording metadata. Correlation happens in the SIEM, not in BifrostConnect.
- A certified data diode is available for unidirectional log export or unidirectional Historian replication as a compensating control where required.
Compliance evidence mapping (Part 1, Scenario 4 regulatory alignment):
| Requirement (source) | Technical evidence BifrostConnect provides | Organizational control still required |
|---|---|---|
| NIS2 Art. 21(2)(d): supply chain (vendor device on OT) | JIT access, SSO-federated vendor identity, SessionGuard recording, Bifrost Unit network isolation, SIEM export. | Vendor device compliance verification (NAC health check), background checks for critical infrastructure, vendor contracts. |
| NIS2 Art. 23: 24h/72h/1-month staged reporting | Comprehensive session logs, SIEM-integrated audit trail, SessionGuard recordings for scope determination. | Incident response plan with 24/72-hour workflow, trained reporting team, legal counsel, designated authority contact. |
| IEC 62443-3-3:2019 FR 5 Restricted data flow + FR 1 SR 1.1 | Hardware-enforced zone boundary (Bifrost Unit at L3), scoped tunnel access. | Security level assignment per zone, documented conduit policies, periodic penetration testing. |
| BEK 260 §62: mandatory network segmentation during vendor access | Bifrost Unit in DMZ, masquerading, outbound-only OT posture. | Network architecture documentation, vendor VLAN policies, segmentation verification testing. |
| BEK 260 §74: alternative communication for incident response | Bifrost Unit over 4G/LTE provides out-of-band access independent of primary WAN. | Tested fallback communication procedures, documented alternative access paths. |
| CER Directive: supply chain supervision | Cross-vendor session audit trail, per-engagement isolation via SessionGuard VMs. | Cross-sector resilience assessment, supplier qualification program, periodic supply chain review. |
Implementation requirements for Scenario 4. Scenario 4 brings the most controls together. The following deployment decisions make each layer carry its weight:
- OT-IDS placement: position OT-IDS visibility downstream of the Bifrost Unit (on the decrypted L1/L2 traffic). DPI on Modbus / OPC UA / S7comm needs the cleartext, so the architecture must give the IDS a tap point past tunnel termination.
- Pair recording layers: SessionGuard is designed to capture the operator side; OT-IDS packet captures cover the wire side. Together they answer ‘who did what’ and ‘what hit the protocol’ – both questions an incident review needs.
- Data diode role: a certified data diode provides unidirectional transfer for log export and Historian replication. Deploy it where one-way movement is mandated; treat it as a transport guarantee, not a replacement for monitoring.
- Time-bound Direct Tunnel Access: operate Bifrost Manager on the Advanced plan or Dedicated Cloud tier, which enables Time-Based Access for Direct IP Tunnel so subnet mappings can be made time-bound. This converts the default-permanent posture to default-just-in-time, matching NIS2 Art. 21(2)(i) intent.
Maturity profile: minimum viable vs target state (Scenario 4). Scenario 4 is the most layered scenario. Minimum viable already brings most of the control set in place; target state hardens the trust boundaries and adds full diode-protected one-way transport for the most regulated environments.
| Capability | Minimum viable (Scenario 4 floor) | Target state (Scenario 4 ceiling) |
|---|---|---|
| Identity | Bifrost Manager with enterprise SSO (Dedicated Cloud / on-premises tier); RBAC and JIT in place. | Hardware-token MFA on admin accounts; impossible-travel detection; policy four-eyes principle on access scope changes. |
| Recording | SessionGuard per engagement on customer-deployed VMs. | SessionGuard + OT-IDS packet capture, both correlated at SIEM. |
| Network boundary | Bifrost Unit at L3 / DMZ, outbound-only. | Bifrost Unit + a certified data diode for one-way log export and Historian replication; segmentation verified by periodic pen-test. |
| File handling | Vendor file uploads logged and reviewed. | Inline file security gateway on every Direct Tunnel Access upload (multi-engine + content disarm/reconstruction). |
| Multi-customer isolation | Separate SessionGuard VMs per customer engagement. | Separate Bifrost Manager tenants per customer engagement; cross-tenant data flow architecturally segregated at the tenant boundary. |