Q1: What is SBOM?
An SBOM(Software bill of materials) is a formal, machine-readable inventory of software components and dependencies, including their hierarchical relationships. It encompasses both open-source and proprietary software, whether widely available or access-restricted. As the technical foundation for vulnerability management, it is a mandatory requirement for compliance with the EU Cyber Resilience Act (CRA). For SBOM implementation and compliance with CRA, we provide training and advisory.
Q2: If we have ISO 27001 certification, can we assure OT security of our industrial products and factory?
ISO 27001 is a management system standard for ISMS (Information Security Management System) and provides a structured governance standard applicable across various organizational environments. However, its primary focus is on enterprise information security and IT-oriented risk management.
ISA/IEC 62443, in contrast, is specifically developed for industrial automation and control systems and provides comprehensive technical and process requirements across the entire IACS lifecycle. It defines specific requirements for Asset Owners (2-1), Service Providers (2-4), and Product Suppliers (3-3, 4-1, 4-2). While ISA/IEC 62443-2-1 can be integrated into an ISMS, ISA/IEC 62443 extends deeper into the Product Security Life Cycle and prioritizes the high-availability requirements unique to OT environments.
The two standards are complementary and can be implemented together to establish a more comprehensive security posture for both IT and OT domains.
Q3: What certifications are available for OT security experts?
ISA offers the ISA/IEC 62443 Cybersecurity Certificate Program that consists of:
Certificate 1: ISA/IEC 62443 Cybersecurity Fundamentals Specialist
Certificate 2: ISA/IEC 62443 Cybersecurity Risk Assessment Specialist
Certificate 3: ISA/IEC 62443 Cybersecurity Design Specialist
Certificate 4: ISA/IEC 62443 Cybersecurity Maintenance Specialist
Individuals who achieve Certificates 1, 2, 3, and 4 are designated as ISA/IEC 62443 Cybersecurity Experts. As an official ISA training partner, we provide the complete training path of all 4 certificates above to achieve international certification.
Q4: What is Sun Square’s core strength?
Sun Square delivers technical advisory rooted in our active participation in global standards development. As active contributors to international standards such as ISA/IEC62443, SEMI E187 and ISO/IEC5230(OpenChain), we leverage our experience as former assessors to bridge the gap between regulatory requirements and practical, production-secure architectures.
Q5: We need to address security of our factories around the world. Can you support us?
Yes. Leveraging our multilingual consultancy (English/Japanese/Mandarin) and decade-long field experience, we support global manufacturers in designing and implementing consistent, robust OT security architectures across international sites.
Q6: Can you provide the training and advisory on how to build a PSIRT?
Yes. While regulations do not explicitly mandate a PSIRT by name, they impose strict obligations for vulnerability handling and security management throughout the product lifecycle. We assist organizations in establishing the necessary processes and frameworks to meet these global requirements, such as those defined in the EU CRA. Our advisory enables clients to operationalize a resilient response capability, typically structured as a PSIRT, to ensure professional vulnerability disclosure and remediation.
Q7: Can you provide the training and advisory for critical infrastructure?
Yes. Critical infrastructure including Energy(Oil, gas, renewable energy and etc.)Power(Generation/transmission/distribution, DER, Microgrid, and etc.), Transportation(Railway, marine and etc.) and Water is a core area of our expertise. We provide sector-specific advisory to align industrial operations with international OT security standards and local cybersecurity regulations.
