07 — SECURITY & COMPLIANCE
Migrations are a security event. ScadaPort treats them like one.
A migration is the one moment when someone reads every tag, every protocol and every user account in a plant. Wasting that moment is how insecure systems get carried forward for another decade.
07 — SECURITY & COMPLIANCE
Migrations are a security event. ScadaPort treats them like one.
Each conversion includes a security report mapped to ISA/IEC 62443 Foundational Requirements and the EU Cyber Resilience Act: unauthenticated protocols are flagged (e.g. bare Modbus/TCP), writable command tags are listed for Use Control review, critical alarms are checked for acknowledge requirements. And the porting itself is secure by design: source-project credentials, TOTP secrets and API keys are never written into the converted project — only usernames and roles, to be re-provisioned fresh. Risky scripts are flagged, never silently executed. A CycloneDX SBOM documents the toolchain.
Supports your risk assessment; does not replace a formal 62443 assessment.
SECURITY_REPORT.md — sample findings
- [MEDIUM]FR1 — Modbus/TCP without authentication, 54 tags affected → recommend OPC UA or 62443 zone isolation
- [MEDIUM]FR2 — 4 writable command tags → apply role-based write permissions
- [INFO]FR6 — 3 critical alarms → enforce mandatory acknowledge
08 — SECURE BY DESIGN
Guarantees that hold for every conversion.
No credentials are ever migrated
Passwords, password hashes, TOTP secrets and API keys present in the source project are never written into the converted project. Usernames and roles come across so you can re-provision deliberately.
Nothing runs, nothing connects
The engine parses files offline. It never opens a connection to a PLC, a gateway or a historian, and it never executes a script it finds in your project.
Risky logic is flagged, not guessed
Scripts the engine cannot faithfully translate are copied verbatim and listed in the rework report with file, screen and reason.
The toolchain is documented
A CycloneDX SBOM ships with every delivery, so your own supply-chain review has something to read.
Your files do not stay with us
Transfer over encrypted channels, NDA on request, deletion after delivery — confirmed in writing.