Industrial Automation and Control Systems (IACS): Securing Critical Infrastructure with Certified Cryptography

Robust, certifiable security solutions for next-generation industrial control systems

Industrial Automation and Control Systems (IACS) form the backbone of modern manufacturing, utilities, and infrastructure. From SCADA controllers and industrial drives to proprietary fieldbus networks and human-machine interfaces, these systems operate under stringent safety and cybersecurity requirements. FortifyIQ provides hardened cryptographic hardware and software solutions that deliver certified resistance to sophisticated physical attacks, enabling SoC designers, system integrators, and security leaders to meet evolving regulatory demands without compromising performance or reliability.

The IACS Security Challenge

Long Equipment Lifecycles
& Legacy Deployments

Many industrial control devices remain in operation for decades, often lacking hardware cryptographic protections but facing modern security standards.

Compliance &
Audit Readiness

Regulations like IEC 62443, NIST SP 800-82, and the EU NIS2 Directive demand proven, certifiable cryptographic modules with documented security lifecycles.

Diverse &
Interconnected Environments

Expanding connectivity between operational technology (OT) and IT increases exposure to cyber-physical threats, including side-channel and fault-injection attacks (SCA/FIA).

Operational Safety &
Performance

Security solutions must operate deterministically with minimal latency and resource overhead, ensuring no disruption to critical control loops.

Why FortifyIQ is Your Trusted Partner?

Technology-, implementation-, and foundry-agnostic, our algorithmic cryptographic protection applies equally in any silicon process or system architecture.

Certified cryptographic IP and software libraries — Validated against stringent standards including FIPS 140-3 Levels 3 and 4, SESIP Level 3 and higher, and Common Criteria AVA_VAN.5, ensuring robust protection against SCA/FIA in real-world industrial environments.

Optimized for Industrial Use Cases — Hardware IP cores and software crypto libraries with exceptional power, performance, and area (PPA), designed to run efficiently on constrained MCUs, MPUs, and custom SoCs used in SCADA, industrial drives, and fieldbus interfaces.

Modular Cryptobox and Root-of-Trust IPs — Combining AES, PKA (ECC/RSA), PQC, and HMAC-SHA2, customizable to your application’s needs for secure boot, firmware authentication, encrypted communications, and device lifecycle security.

Platform-agnostic and integration-ready — Delivered as synthesizable soft macros, FortifyIQ’s cryptographic IP is technology-neutral and integrates seamlessly into industrial ASICs, FPGAs, and legacy SoCs, with no need for proprietary instructions or hardware changes.
Quantum-era readiness for long-lived infrastructure — FortifyIQ offers SCA/FIA resistant post-quantum cryptography (ML-KEM, ML-DSA), ensuring long-term protection for industrial systems with decades-long deployment cycles.

Field Upgradeable Security — Our software libraries support over-the-air (OTA) updates, enabling legacy equipment to be retrofitted with certified cryptographic protection, extending device lifetime and compliance readiness.

Advanced Validation & Assurance — FortifyIQ’s Side-Channel Studio and Fault Injection Studio tools provide pre- and post-silicon vulnerability analysis, supported by SGS independent validation. We offer comprehensive validation documentation and integration support for certification.

FortifyIQ Solutions for Industrial Automation

Software Cryptographic Libraries

  • Hardened AES-256, HMAC-SHA2, and ECC/RSA, and soon PQC libraries for devices lacking hardware crypto engines.
  • Designed for secure boot, firmware integrity, secure telemetry, and encrypted communication.
  • Certified compliant and suitable for resource-constrained legacy and modern industrial MCUs and MPUs.

Hardware Crypto IP Cores

  • AES, HMAC, ECC/RSA, and Post-Quantum Cryptography (PQC) IP cores hardened for side-channel and fault-injection resistance.
  • Designed for secure SoCs powering PLCs, industrial gateways, and embedded control devices.
  • Minimal area, power, and latency to support real-time industrial operations.

Root-of-Trust & Cryptobox IPs

  • Hardened subsystems combining multiple cryptographic primitives for robust lifecycle security.
  • Ideal for securing firmware updates, cloning prevention, and device authentication in industrial networks.

Typical
Use Cases:

SCADA Controllers & Industrial Gateways

Secure boot, encrypted data channels, and tamper-resistant firmware updates.

Industrial Drives & Motor Controllers

Protect intellectual property, secure operational parameters, and prevent reverse engineering.

Fieldbus and Proprietary Networks

Ensure secure authentication and encryption in resource-constrained communication nodes.

OEM Embedded Modules

Integrate certifiable cryptographic protections for supply chain security and anti-counterfeiting.

Compliance & Certification Support

FortifyIQ’s cryptographic IP and software, along with our extensive security documentation are designed to facilitate compliance with key industrial security frameworks, including:

IEC 62443 — Supporting secure development lifecycle and operational security

EU NIS2 Directive — Enabling critical infrastructure operators to meet stringent cybersecurity mandates

NIST SP 800-82 — Meeting industrial control system cybersecurity requirements

What FortifyIQ Provides:
  • Cryptographic IP and software aligned with IEC 62443 for secure development lifecycle and operational security.
  • Solutions designed to meet NIST SP 800-82 requirements for industrial control systems.
  • Support for compliance with the EU NIS2 Directive, enabling critical infrastructure operators to meet cybersecurity mandates.
  • Hardened cryptography resistant to side-channel and fault injection attacks, securing SCADA controllers, industrial drives, and fieldbus communications.
  • Validation for FIPS 140-3 Levels 3/4 and Common Criteria AVA_VAN.5.
What You Should Address:
  • Operational technology (OT) network segmentation and monitoring.
  • Organizational cybersecurity policies, incident response, and risk management.
  • Integration with broader ICS security architectures.

Proven Security Assurance

FortifyIQ solutions undergo rigorous internal validation using our proprietary Side-Channel Studio and Fault Injection Studio tools.

Our AES cryptography is validated at Common Criteria AVA_VAN.5 by SGS Brightsight, and after release, when relevant, our IP cores are validated and/or certified by third party labs either as standalone blocks or integrated into complete secure chips, ensuring that your cryptographic modules meet the highest assurance levels demanded by industry and regulators.

Learn more about our SGS validation and security assurance process.

Secure Your Industrial Control Systems Today

With FortifyIQ’s hardware and software cryptographic solutions, industrial automation leaders can confidently secure critical control systems, protecting intellectual property, operational integrity, and regulatory compliance for decades to come.

 

Fortify’s AES security evaluation by SGS

“Summary. The leakage analysis (Welch t-test) on over 30 million traces did not show statistically significant first- and second-order differences between trace sets with fixed and random inputs. The template-based DPA analysis, on the pseudo-random trace set for the profiling phase (15 million traces) and on a sub-set of 300k fix input traces for matching phase targeting the first-round S-box output, and template attack on ciphertext, did not indicate any potential information leakage.”

” The results for the soft IP presented in the report were obtained on the TOE which is the basic hardware implementation of the soft IP without additional levels of security (e.g. that are present in a secure silicon layout). Therefore the internal strength of the soft IP itself was evaluated. This indicates that the investigated features and parameters of the soft IP implementation should be robust against SCA and fault injection attacks in different implementations including ASIC. Nevertheless, according to the Common Criteria rules, the strength of the final composite product must be evaluated on its own.”

Request Technical Details