Episode 05 — From network observations to reviewable evidence
Reference check: 6 November 2026.

NCSC, Introduction to the Cyber Assessment Framework.
https://www.ncsc.gov.uk/collection/cyber-assessment-framework/introduction-to-caf
Context: outcome-based assessment, assessment scope, indicators of good practice and informed assessor judgement.

NCSC Cyber Assessment Framework 4.0.
https://www.ncsc.gov.uk/files/NCSC-Cyber-Assessment-Framework-4.0.pdf
Context: examples of monitoring, log protection, collection health, alert review and effectiveness expectations. Always agree the applicable framework version and any sector profile for the actual assessment. This episode does not grade an organisation against the CAF.

ENISA, NIS2 Technical Implementation Guidance, 26 June 2025.
https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance
Context: examples of evidence and mappings. This specific guidance concerns entities in the digital infrastructure, ICT service management and digital provider sectors under Commission Implementing Regulation (EU) 2024/2690. It is not presented as a blanket manufacturing-sector compliance specification.

Directive (EU) 2022/2555, official reference.
https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng
The EUR-Lex text was blocked by its automated access check during this run. No article-by-article legal conclusions are made. The episode directs viewers to confirm entity scope, jurisdiction, relevant national implementation and sector arrangements with responsible owners.

ANSI/ISA-62443-3-2-2020, public ISA preview.
https://www.isa.org/getmedia/661c718f-8e64-446d-acf9-2c6286db1b33/isa-62443-3-2-preview.pdf
Context: system under consideration; zones and conduits; risk assessment; target security levels; documented security requirements.

ISA Global Cybersecurity Alliance, Security Lifecycles in the ISA/IEC 62443 Series.
https://gca.isa.org/hubfs/21-29%20-%20ISAGCA/ISAGCA%20Security%20Lifecycles%20whitepaper%20FINAL.pdf
Context: initial and detailed assessment, tolerable risk, requirements and asset owner approval; the asset owner establishes the assessment methodology.

ISA Global Cybersecurity Alliance, Leveraging ISA 62443-3-2 for IACS Risk Assessment and Risk Related Strategies, May 2021.
https://isaorgwebsite.blob.core.windows.net/media/isa/media/pdf/isagca/gca-leveraging-isa62443-7-wht-paper_fin.pdf
Context: threat/vulnerability scenarios, consequence and likelihood, unmitigated risk, target security levels, countermeasures, residual risk, documented requirements and approval. Consult the licensed applicable standard when conducting the assessment.

The packaging-line observation, evidence ID and workshop sequence are original illustrative teaching material. They are not customer evidence, a completed risk assessment, a legal opinion or a compliance decision. The evidence workflow supports review of bounded claims. It distinguishes observations, interpretations, owner confirmation, gaps, risk decisions and wider framework judgements.
