NIS2 and IEC 62443: what they ask and how Respondr helps.
NIS2 is a European directive that places security obligations on organizations. IEC 62443 is a series of standards on the security of industrial automation and control systems. This page explains what they ask, which Respondr features help you, and what is certified.
What is certified, and what is not
- IEC 62443
- Respondr holds no IEC 62443 certification from a third-party body. The architecture is designed with reference to the standard, targeting Security Level 2.
- NIS2
- NIS2 has no product certificates: the obligations fall on your organization, and Respondr helps you meet them.
- ISO 9001
- Teleproject, the company that develops Respondr, operates an ISO 9001:2015 certified quality management system. The certificate covers the company, not the product.
What NIS2 asks of your organization
Directive (EU) 2022/2555, known as NIS2, was transposed in Italy by Legislative Decree 138/2024. It applies to essential and important entities in sectors such as energy, transport, health, water and public administration, and the obligations fall on the organization, not on the products it uses.
Risk-management measures
Article 21 asks for technical and organizational measures proportionate to the risk: access control, encryption, business continuity and backup, vulnerability handling, staff training.
Secured communications
Among the measures, Article 21 names multi-factor authentication, secured voice, video and text communications, and secured emergency communication systems, where appropriate.
Incident reporting
A significant incident is reported to the CSIRT in three steps: an early warning within 24 hours, a notification within 72 hours and a final report within one month.
Supplier security
The organization has to assess the security of its suppliers and of the services it buys, including the software its team communicates with.
How Respondr helps
Respondr covers the communications part. Risk assessment, procedures and incident reporting remain your organization’s tasks: the features below help you carry them out.
| NIS2 area | What Respondr does |
|---|---|
| Access control | Respondr has two roles, administrator and operator, and access policies per resource: channels, gateways, users, settings and map. Each person sees and uses only what they need. |
| Authentication | You can turn on TOTP second-factor authentication for accounts. Five failed sign-ins lock the account for 15 minutes, and each user has a single active session. With Business and Enterprise you can use OIDC single sign-on with your identity provider. |
| Logs and reviews | Respondr logs sign-ins, PTT sessions, dispatch operations and configuration changes, and sends an email alert when an account signs in from a new device, IP address or country. With Business and Enterprise it also keeps the message archive. |
| Encryption | Voice and messages travel encrypted between the app, the console and the server: TLS 1.3 on every connection, and AES-128-GCM on audio sent over UDP. Recordings and saved messages are encrypted at rest with AES-256. |
| Business continuity and backup | The apps reconnect by themselves when the network comes back. With Enterprise on AWS, Teleproject manages encrypted backups in the same region; with the server on your own machines, backups follow your policy. The Respondr Mini, Pro and Max consoles work without a central server: if one stops, the others keep working. |
| Data location | With Free, Essential and Business the data is hosted on AWS in the European Union. With Enterprise the server is dedicated and the data stays in the country you choose or in your own network. |
| Suppliers and documentation | With Enterprise you receive the architecture and security description, the IEC 62443-4-2 self-assessment and the shared-responsibility model, under a non-disclosure agreement (NDA). Teleproject plans updates, tests them in pre-production and documents them with a changelog. |
| Incidents and vulnerabilities | Teleproject gives you a named cybersecurity contact for reporting incidents and vulnerabilities and for review requests. Respondr’s logs help you reconstruct what happened when you prepare your report. |
What IEC 62443 is
IEC 62443, also published as ISA/IEC 62443, is a series of international standards on the cybersecurity of industrial automation and control systems. Its parts address the operators of the facilities, the integrators and the makers of components.
Zones and conduits
The system is divided into zones, groups of components with the same security requirements, connected by conduits, the communication channels between one zone and another. The risk assessment (IEC 62443-3-2) gives each zone a target security level.
Security Levels
The levels run from SL 1 to SL 4. SL 2 protects against intentional attacks carried out with simple means, low resources and generic skills; SL 3 and SL 4 protect against attacks with sophisticated means.
System requirements (62443-3-3)
Part 3-3 groups the system requirements into seven foundational requirements: identification and authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events and resource availability.
Component requirements (62443-4-2)
Part 4-2 applies the same requirements to individual components: common requirements plus specific ones for software applications, embedded devices, host devices and network devices. For each requirement it states the security level from which it becomes mandatory.
Development process (62443-4-1)
Part 4-1 describes the supplier’s secure development lifecycle. Process (4-1) and component (4-2) certifications are issued by accredited certification bodies.
How Respondr is designed
Respondr’s architecture is designed with reference to ISA/IEC 62443, targeting Security Level 2. The architecture and security description maps Respondr’s features onto the system requirements of IEC 62443-3-3.
Separated traffic
On premise, the design puts the radio gateways on a dedicated VLAN, managed by you, and allows administrative access to the server only through a VPN. With Enterprise on AWS, security groups admit only the ports that are needed, and the radio networks connect over a dedicated encrypted tunnel. You can then place the server, the gateways and the clients in the zones and conduits of your own architecture.
Identification and use control
Users sign in with OIDC single sign-on through your identity provider or with credentials managed in Respondr, with a TOTP second factor. Roles and per-resource access policies follow least privilege, and each user has a single active session.
Data confidentiality
Voice and messages travel encrypted between the app, the console and the server: TLS 1.3 on every connection, and AES-128-GCM on audio sent over UDP. Recordings and saved messages are encrypted at rest with AES-256.
Response to events
Respondr logs sign-ins, PTT sessions, dispatch operations and configuration changes, with retention windows. Only administrators can read the logs.
Updates and contacts
Teleproject plans updates, tests them in pre-production and documents them with a changelog. For incidents, vulnerabilities and review requests you have a named cybersecurity contact.
IEC 62443-4-2 self-assessment
Teleproject has assessed Respondr against the IEC 62443-4-2 component requirements: for each requirement the document states the degree of coverage and notes on the parts still to be completed. With Enterprise you receive the self-assessment and the architecture and security description, under a non-disclosure agreement, for your organization’s security officer.
Which certifications the company and the infrastructure hold
These certifications exist, but neither of them certifies the Respondr product.
ISO 9001:2015, Teleproject
Teleproject operates an ISO 9001:2015 certified quality management system (certificate no. IT23-06005A, AXE Register), whose scope includes embedded software and web application development. The certificate covers the company and how it develops software, not the security of the product.
AWS data centers
Respondr Cloud and Enterprise servers on AWS run in Amazon Web Services data centers, which AWS certifies to standards such as ISO/IEC 27001. These are AWS’s certifications, not Respondr’s or Teleproject’s.
Frequently asked questions
No. Respondr holds no IEC 62443 certification from a third-party body. The architecture is designed with reference to the standard, targeting Security Level 2, and the self-assessment against the IEC 62443-4-2 requirements is available under a non-disclosure agreement.
NIS2 does not certify products: the obligations fall on organizations. Respondr helps you meet them with access control, two-factor authentication, logs, encryption and supplier documentation.
Documentation support is part of the Enterprise plan: you receive the architecture and security description, the IEC 62443-4-2 self-assessment and the shared-responsibility model between you and Teleproject, under a non-disclosure agreement.
Voice and messages travel encrypted between the app, the console and the server: TLS 1.3 on every connection, and AES-128-GCM on audio sent over UDP. Recordings and saved messages are encrypted at rest with AES-256. The server decrypts the audio because it has to relay it to the channel members. With Enterprise the server is dedicated, and the data stays in the country you choose or in your own network.
With Free, Essential and Business the data is hosted on AWS in the European Union. With Enterprise the server is dedicated: you can keep it on AWS in the country you choose or on your own machines, and the data stays there.
You can ask for the documentation in a demo.
We show you which Respondr controls answer which requirements, and how they fit into your architecture.