CFATS Expired. IEC 62443 and Your Insurer Now Set the Standard.

Direct federal cybersecurity mandates for chemical manufacturing are absent as of March 2026. CISA publishes voluntary guidance. OSHA PSM has indirect cyber implications through MOC documentation. CIRCIA mandatory incident reporting is expected to apply to the chemical sector when final rules publish. The near-term practical obligation comes from cyber insurance carriers requiring documented remote access controls as a condition of coverage.

IEC 62443-3-2 defines zones as logical groupings connected through conduits. The CSG functions as the conduit: the defined, monitored pathway through which external access enters the zone. Remote vendor access terminates at the CSG. The vendor sees the asset interface. The process control zone sees no external network connection.

CSG gateways capture session recordings with timestamps, user attribution, asset identifiers, session duration, and access scope. The records are on-premises, access-controlled, and export-ready for underwriter review. For typical insurer questionnaire items (MFA on remote access, session logging, time-limited vendor sessions, access provisioning and revocation procedures), Centralizer's session records provide the supporting documentation without manual reconstruction.

Persistent vendor monitoring access is the exact access path Triton exploited: a permanently available connection to your process control network. The architecture replaces persistent access with on-demand sessions. When the DCS vendor needs to check system status, an administrator approves a time-limited, scope-restricted session. The vendor's monitoring visibility is maintained. The persistent attack surface is architecturally closed as a direct remote access vector.

Deployment requires no changes to OT network topology or control system configurations. Network firewall policies may require minor updates to enable the CSG connection path. Vendor access request and approval workflows move to Centralizer's interface. The vendor connects through the same network path; the CSG intercepts and enforces the session controls. From the vendor's perspective, the primary change is an approval step before the session begins and an automatic termination at the end of the maintenance window.

Supported protocols include Telnet, VNC, HTTP/HTTPS, Modbus, DNP3, and IEC 62443-compatible industrial protocols. No protocol upgrades or endpoint agents required. The CSG brokers the session at the boundary without requiring the underlying asset to support modern authentication mechanisms.

NIS2 Article 21 requires supply chain security measures including access controls for external service providers. SEVESO III imposes change control obligations on major-accident hazard facilities. The same session recording architecture that satisfies IEC 62443 and insurance requirements also covers NIS2 supply chain controls and SEVESO III change documentation.

Centralizer provides centralized governance across every connected facility. One administrator manages access policies, reviews session recordings, and enforces controls for all 8 treatment plants from a single console. Each facility has a locally deployed CSG that operates independently of the others. Session Hold (v5.5) handles the intermittent connectivity that is standard across rural water infrastructure. Deploy at each facility in 20 minutes without sending an IT team.

The CSG operates without cloud dependency. Air-gapped batch processing networks remain air-gapped. No data leaves your facility. The platform deploys on-premises or in fully air-gapped configurations. No SaaS requirement. No external connectivity required for the access control layer to function.