OTVista
Book a demo

Early access

The OTVista Platform

One workspace for OT asset visibility, risk, compliance and remediation. Connect what you have, see what matters and prove what you've done.

Book a demoSee all modules

Why teams choose a connected platform

Connected data

Assets, zones, risks, controls, evidence and actions are linked, so a change in one updates the rest.

Multi-framework

Assess once against IEC 62443 and map the results to NIS2, NERC CIP, NCA OTCC, UK CAF and others.

Works with what you have

Builds on documentation, exports and the tools you already run.

Made for engineers and auditors

Engineers get detail, managers get summaries, auditors get evidence.

Platform modules

Fifteen modules that work together. Start with the ones you need and add more as your program grows.

  • Asset Visibility

    One inventory of controllers, HMIs, servers, network devices and software across every site.

    Asset Visibility

    • Import from spreadsheets, CMMS and OT monitoring tool exports
    • Normalized vendor, model, firmware and OS data
    • Site, area, zone and cabinet location hierarchy
    IEC 62443-2-1NIST CSF 2.0 ID.AMNCA OTCC
    Explore module Tap card to flip back

  • Zones & Conduits

    Model your OT architecture as security zones and conduits, and see what crosses each boundary.

    Zones & Conduits

    • Visual zone and conduit model per site
    • Purdue-level and custom layer views
    • Allowed flows documented with justification
    IEC 62443-3-2IEC 62443-3-3NIST SP 800-82
    Explore module Tap card to flip back

  • OT Risk Management

    Scenario-based risk register tied to assets, zones and real operational consequences.

    OT Risk Management

    • Configurable likelihood and consequence scales
    • Safety, availability, environment and compliance impact
    • Existing safeguards credited with evidence
    IEC 62443-3-2ISO 31000NIST CSF 2.0 GV/ID.RA
    Explore module Tap card to flip back

  • Standards & Compliance

    Assess once, map to many: IEC 62443, NIS2, NERC CIP, NCA OTCC, UK CAF and more.

    Standards & Compliance

    • Framework libraries for international and regional standards
    • Cross-mapping between overlapping requirements
    • Applicability decisions recorded per site and system
    IEC 62443NIS2NERC CIP
    Explore module Tap card to flip back

  • Governance & Policy

    OT security policies, roles and responsibilities that are owned, versioned and reviewed.

    Governance & Policy

    • Policy and procedure library with versioning
    • RACI for engineering, IT, operations and vendors
    • Review reminders and approval history
    IEC 62443-2-1NIS2 Art. 21NCA ECC
    Explore module Tap card to flip back

  • Identity & Access Review

    Find shared, default and dormant OT accounts and run periodic access reviews.

    Identity & Access Review

    • Account and role register per system
    • Shared and default account tracking
    • Dormant and leaver account flags
    IEC 62443-3-3 FR1/FR2NERC CIP-004 / CIP-007NCA OTCC
    Explore module Tap card to flip back

  • Vulnerability & Advisory Management

    Track vendor and CERT advisories against your asset versions and record each decision.

    Vulnerability & Advisory Management

    • Advisory register linked to affected assets
    • Applicability and exposure assessment workflow
    • Operational impact and patch feasibility notes
    IEC 62443-2-3NIST SP 800-82NERC CIP-007 R2
    Explore module Tap card to flip back

  • Patch & Firmware Management

    Plan patches and firmware updates around vendor approval and maintenance windows.

    Patch & Firmware Management

    • Patch backlog per asset and site
    • Vendor approval and test status
    • Maintenance window planning
    IEC 62443-2-3NERC CIP-007 R2NCA OTCC
    Explore module Tap card to flip back

  • Change Management

    Security review for logic, configuration, firmware and network changes, with full history.

    Change Management

    • Change requests linked to assets and zones
    • Security impact questions per change type
    • Approval workflow and emergency changes
    IEC 62443-2-1NERC CIP-010NCA OTCC
    Explore module Tap card to flip back

  • Evidence & Audit Trail

    Every control, finding and decision linked to its evidence, with a complete activity history.

    Evidence & Audit Trail

    • Evidence library with owners and review dates
    • Links from evidence to controls and findings
    • Immutable activity history
    IEC 62443-2-1NIS2NERC CIP
    Explore module Tap card to flip back

  • Third-party & Remote Access

    Know every vendor and remote access path, who approved it and when it is used.

    Third-party & Remote Access

    • Remote access path inventory
    • Vendor register with contacts and contracts
    • Access request and approval records
    IEC 62443-2-4NIS2 supply chainSaudi Aramco SACS-002
    Explore module Tap card to flip back

  • Remediation & Task Tracking

    Turn findings into owned, scheduled actions and track them to verified closure.

    Remediation & Task Tracking

    • Actions linked to findings, risks and controls
    • Owners, due dates and dependencies
    • Outage-dependent work flagged
    IEC 62443-2-1NIS2UK NCSC CAF
    Explore module Tap card to flip back

  • Dashboards & Reporting

    Board-level summaries and engineer-level detail from the same live data.

    Dashboards & Reporting

    • Posture dashboards by site, zone and framework
    • Executive and technical report templates
    • Trend over time
    NIS2 management accountabilityNIST CSF 2.0 GVNCA ECC
    Explore module Tap card to flip back

  • Integrations

    Bring in data from OT monitoring, CMDB, ticketing and identity tools you already use.

    Integrations

    • Spreadsheet and CSV import templates
    • Imports from OT network monitoring tool exports
    • CMDB and CMMS data mapping
    Supports evidence for all frameworks
    Explore module Tap card to flip back

  • Vista AI AssistantIn development

    An assistant that drafts findings, explains requirements and summarizes posture from your data.

    Vista AI Assistant

    • Plain-language explanations of requirements
    • Draft findings and recommendations for review
    • Posture summaries for reports
    Works across all supported frameworks
    Explore module Tap card to flip back

Zones and conduits by sector

See how OTVista models real OT environments

Switch between five example sites and select any zone to see its role, risks and recommended controls.

Site A Transmission substationA control centre supervising a digital substation over a WAN, with IEC 61850 station and process buses.
Site A: Transmission substation OT reference architecture (Energy and utilities) L4 L3.5 L3 L2 L1 L0 Corporate WS, Enterprise IT Corporate WS ERP / GIS, Enterprise IT ERP / GIS Asset mgmt, Enterprise IT Asset mgmt Edge router, Enterprise IT Edge router Jump host, Control centre DMZ Jump host Historian mirror, Control centre DMZ Historian mirror Patch / AV, Control centre DMZ Patch / AV DMZ switch, Control centre DMZ DMZ switch SCADA / EMS, Control centre (EMS / SCADA) SCADA / EMS Operator WS, Control centre (EMS / SCADA) Operator WS Historian, Control centre (EMS / SCADA) Historian WAN router, Control centre (EMS / SCADA) WAN router Station HMI, Station level Station HMI Gateway / RTU, Station level Gateway / RTU Engineering WS, Station level Engineering WS GPS clock, Station level GPS clock Station bus, Station level Station bus Protection IED, Bay level Protection IED Protection IED, Bay level Protection IED Bay controller, Bay level Bay controller Bay controller, Bay level Bay controller Bay switch, Bay level Bay switch Merging unit, Process level Merging unit Circuit breaker, Process level Circuit breaker Power transformer, Process level Power transformer CT / VT, Process level CT / VT Disconnector, Process level Disconnector Enterprise ITIT Control centre DMZSL 2 Firewall: HTTPS, RDP via jump hostHTTPS, RDP via jump host Control centre (EMS / SCADA)SL 3 Firewall: OPC UA, historian replicationOPC UA, historian replication Station levelSL 3 Firewall: IEC 60870-5-104 over WANIEC 60870-5-104 over WAN Bay levelSL 3 IEC 61850 MMS / GOOSE Process levelSL 2 Assessment scope
Site B Gas processing facilityA DCS-controlled process with a separate safety instrumented system zone and a pipeline RTU.
Site B: Gas processing facility OT reference architecture (Oil, gas and process) L4 L3.5 L3 L2 L1 L0 Corporate WS, Enterprise IT Corporate WS ERP, Enterprise IT ERP Email, Enterprise IT Email Edge router, Enterprise IT Edge router Historian mirror, Plant DMZ Historian mirror Remote access, Plant DMZ Remote access Patch / AV, Plant DMZ Patch / AV DMZ switch, Plant DMZ DMZ switch DCS servers, Operations DCS servers Historian, Operations Historian Engineering WS, Operations Engineering WS Domain ctrl, Operations Domain ctrl Core switch, Operations Core switch Operator console, Supervisory Operator console Operator console, Supervisory Operator console Alarm mgmt, Supervisory Alarm mgmt Asset mgmt, Supervisory Asset mgmt Control switch, Supervisory Control switch Safety controller, Safety (SIS) Safety controller Safety controller, Safety (SIS) Safety controller DCS controller, Process control (BPCS) DCS controller DCS controller, Process control (BPCS) DCS controller Pipeline RTU, Process control (BPCS) Pipeline RTU Control net, Process control (BPCS) Control net ESD valve, Field instruments ESD valve Pressure TX, Field instruments Pressure TX Flow meter, Field instruments Flow meter Control valve, Field instruments Control valve Compressor, Field instruments Compressor Enterprise ITIT Plant DMZSL 2 Firewall: HTTPS, RDP via gatewayHTTPS, RDP via gateway OperationsSL 2 Firewall: OPC, historian replicationOPC, historian replication SupervisorySL 3 Firewall: DCS control networkDCS control network Safety (SIS)SL 3 Data diode: Read-only status to DCSRead-only status to DCS Process control (BPCS)SL 3 Vendor control protocol Field instrumentsSL 2 Assessment scope
Site C Discrete manufacturing plantMES and site services above production cells, each cell its own zone behind a cell firewall.
Site C: Discrete manufacturing plant OT reference architecture (Manufacturing) L4 L3.5 L3 L1–L2 L0 Corporate WS, Enterprise IT Corporate WS ERP, Enterprise IT ERP PLM, Enterprise IT PLM Edge router, Enterprise IT Edge router MES replica, Industrial DMZ MES replica Remote access, Industrial DMZ Remote access Patch / AV, Industrial DMZ Patch / AV DMZ switch, Industrial DMZ DMZ switch MES server, Site operations MES server Historian, Site operations Historian Engineering WS, Site operations Engineering WS Backup, Site operations Backup Core switch, Site operations Core switch Cell HMI, Cell 1: Assembly Cell HMI Line PLC, Cell 1: Assembly Line PLC Robot ctrl, Cell 1: Assembly Robot ctrl Cell switch, Cell 1: Assembly Cell switch Test HMI, Cell 2: Test Test HMI Test PLC, Cell 2: Test Test PLC Test bench, Cell 2: Test Test bench Cell switch, Cell 2: Test Cell switch Robot arm, Machines and field devices Robot arm Conveyor, Machines and field devices Conveyor VFD drive, Machines and field devices VFD drive Vision camera, Machines and field devices Vision camera Remote I/O, Machines and field devices Remote I/O Enterprise ITIT Industrial DMZSL 2 Firewall: HTTPS, REST APIsHTTPS, REST APIs Site operationsSL 2 Firewall: OPC UA, MQTTOPC UA, MQTT Cell 1: AssemblySL 2 Firewall: OPC UA from MESOPC UA from MES Cell 2: TestSL 2 Firewall: OPC UA from MESOPC UA from MES Machines and field devicesSL 1 Assessment scope
Site D Mainline railwayAn operations control centre for traffic and traction power, with interlocking and trackside assets.
Site D: Mainline railway OT reference architecture (Railways and transportation) L4 L3.5 L3 L2 L0 Corporate WS, Enterprise IT Corporate WS Timetabling, Enterprise IT Timetabling Passenger info, Enterprise IT Passenger info Edge router, Enterprise IT Edge router Data exchange, Operations DMZ Data exchange Remote maint., Operations DMZ Remote maint. Patch / AV, Operations DMZ Patch / AV DMZ switch, Operations DMZ DMZ switch Traffic mgmt, OCC: Traffic management Traffic mgmt Dispatcher WS, OCC: Traffic management Dispatcher WS OCC switch, OCC: Traffic management OCC switch Power SCADA, OCC: Traction power Power SCADA Power controller, OCC: Traction power Power controller SCADA switch, OCC: Traction power SCADA switch Interlocking, Signalling (SIL 4) Interlocking RBC (ETCS), Signalling (SIL 4) RBC (ETCS) GSM-R / FRMCS, Signalling (SIL 4) GSM-R / FRMCS Signal net, Signalling (SIL 4) Signal net Substation RTU, Traction substation Substation RTU Protection IED, Traction substation Protection IED Sub switch, Traction substation Sub switch Signal, Trackside Signal Point machine, Trackside Point machine Axle counter, Trackside Axle counter Balise, Trackside Balise Traction transformer, Trackside Traction transformer Enterprise ITIT Operations DMZSL 2 Firewall: HTTPS, file transferHTTPS, file transfer OCC: Traffic managementSL 3 Firewall: Application gatewayApplication gateway OCC: Traction powerSL 3 Firewall: Application gatewayApplication gateway Signalling (SIL 4)SL 4 Firewall: Signalling protocolSignalling protocol Traction substationSL 3 Firewall: IEC 60870-5-104IEC 60870-5-104 TracksideSL 2 Assessment scope
Site E Water utilityA control room supervising a treatment plant and remote pumping sites over telemetry.
Site E: Water utility OT reference architecture (Water and critical infrastructure) L4 L3.5 L3 L1–L2 L0 Corporate WS, Enterprise IT Corporate WS Billing / CRM, Enterprise IT Billing / CRM GIS, Enterprise IT GIS Edge router, Enterprise IT Edge router Historian mirror, Utility DMZ Historian mirror Remote access, Utility DMZ Remote access Reporting, Utility DMZ Reporting DMZ switch, Utility DMZ DMZ switch SCADA server, Control room SCADA server Operator HMI, Control room Operator HMI Historian, Control room Historian Engineering WS, Control room Engineering WS Core switch, Control room Core switch Treatment PLC, Treatment plant Treatment PLC Local HMI, Treatment plant Local HMI Dosing PLC, Treatment plant Dosing PLC Plant switch, Treatment plant Plant switch Outstation, Remote sites (telemetry) Outstation Pump station, Remote sites (telemetry) Pump station Radio link, Remote sites (telemetry) Radio link VPN gateway, Remote sites (telemetry) VPN gateway Chlorine dosing, Process and field Chlorine dosing Level sensor, Process and field Level sensor Flow meter, Process and field Flow meter Booster pump, Process and field Booster pump Reservoir, Process and field Reservoir Enterprise ITIT Utility DMZSL 2 Firewall: HTTPS, reporting exportsHTTPS, reporting exports Control roomSL 2 Firewall: OPC, historian replicationOPC, historian replication Treatment plantSL 3 Firewall: Modbus TCP, DNP3Modbus TCP, DNP3 Remote sites (telemetry)SL 2 Firewall: DNP3 over private APN / VPNDNP3 over private APN / VPN Process and fieldSL 2 Assessment scope
Enterprise ITDMZOT operationsCritical controlField / safety

Tap a zone for its risks and controls, or a device for its security requirements.

Illustrative reference architectures, simplified for clarity. Security levels shown are example targets. Not live data.

Every record connected

An asset links to its zone, the controls that protect it, the evidence behind each control, the findings raised and the actions that fix them. Change one, and the rest stays current.

The OTVista Platform is in early access. Modules are released progressively, and demos show the current release. Ask us which capabilities are available for your environment today.

Conceptual OTVista workflow: assets, controls, evidence, findings, risks and actions linked together Assets Inventory and zones Controls Assessed requirements Evidence Documents, records Findings Gaps, observations Risks Rated with context Actions Owners and status Reassess
How records connect in the OTVista Platform (illustration).

Frameworks across four regions

Assess once and map the results to the requirements you face.

Explore standards by region
  • ISA/IEC 62443
  • ISO/IEC 27001 & 27002
  • ISO/IEC 27019
  • IEC 62351
  • IEC 61511
  • ISO 31000
  • NIS2
  • CRA
  • NCCS
  • CER
  • Machinery Regulation
  • CLC/TS 50701
  • NIS Regulations 2018
  • Cyber Security and Resilience Bill
  • NCSC CAF
  • HSE OG86
  • Cyber Essentials
  • NIST CSF 2.0
  • NIST SP 800-82 Rev. 3
  • NERC CIP
  • TSA Security Directives
  • AWIA 2018
  • CISA CPGs
  • DOE C2M2
  • CMMC 2.0
  • NCA ECC-2:2024
  • NCA OTCC-1:2022
  • NCA CSCC
  • SACS-002
  • UAE IA Regulation
  • Dubai ISR
  • Qatar NIA

See the OTVista Platform in action

Book a demo and we'll walk through the modules that matter for your sites and regulations.

Book a demo