Cybersecurity consulting for products, plants and organisations.
Engineers who assess, design and implement cybersecurity with your team, with AITIGRITY behind every result.
Consulting that ends with working security, not with a report.
Most cybersecurity projects stall between the assessment and the implementation. The gap list is clear, but nobody has the time or the method to close it. We were built to close that gap: our consultants assess, design and implement with your team, and stay until the evidence is accepted by your customer, your assessor or the authority.
We work on three levels that regulation now links together: the products you build, the plants you run and the organisation behind both. One team, one method and one platform, AITIGRITY, keep the results consistent across all three.
Who we work with
- Manufacturers of machines, components, vehicles and medical devices
- Operators of plants, utilities and critical infrastructure
- Suppliers asked by customers for CRA, TISAX or IEC 62443 evidence
- Product security, engineering, quality and compliance teams
Six services, one method
Each service stands on its own, and all of them share the same risk model, evidence base and team.
Regulation
Regulatory readiness and compliance
CRA, Machinery Regulation, RED, NIS2 and AI Act turned into one plan per product, through to CE marking.
Explore serviceProducts
Product security engineering
TARA, security concept, hardware security and a secure development lifecycle to ISO/SAE 21434 and IEC 62443.
Explore servicePlants
OT and plant security
Asset inventory, zones and conduits, secure remote access, monitoring and incident response for production.
Explore serviceOrganisation
Security management: implementation and audits
ISO 27001, TISAX and CSMS built and implemented with your team, through certification and operation.
Explore serviceResponse
Testing and vulnerability handling
Penetration tests, SBOM, a working PSIRT and readiness for CRA reporting within 24 hours.
Explore serviceAI
AI security
Threat modelling, secure agent architecture, red teaming and governance for AI in products and operations.
Explore servicePlatform
Supported by AITIGRITY
Our platform carries risks, requirements, tests and vulnerabilities from one project to the next.
See the platformStart
CRA Readiness Check
Not sure where to start? A short check shows which rules apply and what to do first.
Book the checkWhich service fits your question?
Start from the problem you have today. Each answer leads to the service that solves it.
Does the CRA apply to our products, and what do we do first?
Start with the CRA Readiness Check under regulatory readiness and compliance.
Regulatory readinessWe need a TARA, a security concept or IEC 62443-4-1 maturity.
Product security engineering covers analysis, design and the development process.
Product security engineeringOur customer asks for TISAX or ISO 27001.
Security management implements the system with you and supports you through the assessment.
Security managementOur plant or utility must meet NIS2.
OT and plant security starts with an inventory and a risk assessment of your sites.
OT and plant securityWe need to handle and report vulnerabilities under the CRA.
Testing and vulnerability handling sets up your PSIRT and rehearses the 24-hour report.
Testing and vulnerability handlingWe are adding AI agents or AI functions.
AI security analyses and tests the new attack surface before it ships.
AI securityHow an engagement runs
Step 1
Assess
Scope, gap analysis and risk assessment.
Step 2
Build
Measures, processes and documents, with your team.
Step 3
Prove
Internal audit, tests and preparation for the external assessment.
Step 4
Operate
Monitoring, updates and improvement, until you run it alone.
What makes our consulting different
Principles we apply in every engagement, whatever the size.
1
Engineers, not slide makers
The people who assess your product are the people who design and implement the measures.
2
Implementation included
We stay after the gap analysis and build the solution with your team.
3
Products, plants and organisation
One team covers all three, so nothing falls between the cracks.
4
Standards-based
Every result follows a named standard, so assessors can follow it.
5
Tool-supported
AITIGRITY keeps analyses reusable and evidence current.
6
Independent advice
We do not certify our own work. Accredited bodies do, and we prepare you for them.
Industries
Every industry has its own mix of risks and rules. Our industry pages show where the services apply.
Why Nord CS
Our team holds IEC 62443 Expert, TISAX and NIS2 implementer qualifications, and our founder serves on the ENISA Advisory Board. We combine consulting with our own platform, so your results stay reusable after the project ends.
Talk to a consultantQuestions we often hear
Can you take over a project another consultant started?
Yes. We review what exists, keep what is usable and continue from there.
Do you work on site?
Yes, for workshops, plant visits and audits. Analysis and documentation work is done remotely where that is faster.
Do we need AITIGRITY to work with you?
No. We work in AITIGRITY or in your existing tools. The platform makes results easier to reuse, but it is not a condition.
How do we start?
With a short call about your product or site and the rule you are facing. From there we propose a scope and a fixed first step.
Contact usWhere does your product stand?
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.