Don’t need an audit, but someone to challenge a specific assessment? For second opinions, bid reviews, design reviews, and quality assurance of decision documents, see Independent review and assurance.
Typical situations
If one of these sounds familiar, it is worth a conversation.
Hvert samsvar skal kunne spores til evidens som noen har sett og vurdert.
Basert på begrepene i IEC TS 62443-6-1:2024 og IEC TS 62443-6-2:2025. Lumiar tester ikke systemene teknisk. Testresultater kommer fra andre.
Lumiar-syntese
From requirement to verdict
Every conformity claim must be traceable to evidence that someone has seen and assessed.
Based on the terms in IEC TS 62443-6-1:2024 and IEC TS 62443-6-2:2025. Lumiar doesn’t test systems technically. Test results come from others.
Lumiar synthesisDelivery and method
We review the management system, technical documentation, and selected systems, and we interview the people who operate them. The assessment ends in a report with findings, deviations and recommendations, sorted by risk. Everything is documented, so it can be verified.
We can also help with requirements and expert assessment of suppliers and bids when this is part of the client’s assurance or procurement process. Supplier assessments are second-party assessments. They don’t provide certification. We use the methodology in IEC TS 62443-6-1 and 6-2, so that the results can be compared.
IEC 62443-2-2:2025 (protection in operation)
IEC 62443-3-3 (system)
IEC 62443-2-4 and 4-2 (suppliers), assessed under IEC TS 62443-6-1 and 6-2
Offshore Norge 104 rev. 7 · NIST CSF 2.0
Norwegian petroleum regulations · NIS2 · CRA · CER
Scope and format
Å oppfylle grunnkravene betyr ikke at restrisikoen er akseptabel.
Basert på Offshore Norge 104 rev. 7, kapittel 1.1: grunnkravene er minimumskrav for typiske løsninger og erstatter ikke virksomhetens egen risikovurdering.
Lumiar-synteseThe baseline requirements are the floor
Meeting the baseline requirements doesn’t mean the residual risk is acceptable.
Based on Offshore Norge 104 rev. 7, chapter 1.1: the baseline requirements are minimum requirements for typical solutions and don’t replace the organization’s own risk assessment.
Lumiar synthesisSikkerheten må vedlikeholdes gjennom hele livsløpet, fordi systemet, trusselbildet og evidensen endrer seg.
Offshore Norge 104 rev. 7 knytter NIST CSF 2.0 til Planlegg–Gjennomfør–Kontroller–Forbedre og krever at tiltakene styres gjennom livsløpet (kapittel 1.3 og 2).
Lumiar-synteseSecurity through the lifecycle
Security must be maintained throughout the lifecycle, because the system, the threat picture, and the evidence change.
Offshore Norge 104 rev. 7 links NIST CSF 2.0 to Plan–Implement–Check–Improve and requires the measures to be managed throughout the lifecycle (chapters 1.3 and 2).
Lumiar synthesis