Built for sites where the production network is off limits.
Most IT teams' first question is what Command Centre needs from their network. The answer is very little, and nothing standing. ECS will walk your IT or OT security lead through the data collection, access model and governance before anything is set up.
No scanning of your production network
Command Centre is filled from a Capture site visit, an approved export from your own systems, or a controlled upload. It never needs discovery scanning or open access to the factory floor.
Remote access only when you authorise it
Where Connect is added, each session is authorised before it starts and closed when support ends. TLS 1.3 throughout, no always-on VPN, and no standing access between sessions.
Your data stays yours
Asset records, program backups and documents belong to you. You can export them at any time, and if a contract ends you get a structured export of everything held before access is removed.
Every action logged
Every change, download and remote session is recorded against a named user and a time, so you can show who did what, for your own records and for your auditors.
Credentials kept out of documents
Device passwords are held in Command Centre, encrypted and access-controlled. They are never written into a report or sent by email.
Restores follow your procedures
Command Centre stores and versions every backup. Your team confirms a backup is right before it goes onto live equipment, and ECS can support the restore through Connect.
Command Centre and Connect are designed around IEC 62443 principles. They are aligned with the standard, not certified against it. What that means in practice.
Talk to us about your site's security requirementsWhat Command Centre holds for you.
Everything is customer property. Command Centre provides structured storage, access control, version history and traceability. Your team confirms a backup is right before it goes onto live equipment, and every production change follows your site procedures.
- Asset records
- Hardware, part numbers, serial numbers, firmware, locations and lifecycle status.
- Program backups
- Every version, with who uploaded it, when, and who has downloaded it.
- Support history
- Connect sessions, fault notes and engineering changes.
- Documents
- Drawings, manuals and certificates, uploaded by your team or gathered on a Capture visit.
- Device credentials
- Encrypted and access-controlled. Never written into a report or sent by email.
Who did what, and when.
Every change, download and remote session is logged against a named user. It answers the questions an assessor or customer asks, and the ones you ask yourself after an incident.
Command Centre activity log. Example data.
Sending us a supplier security questionnaire?
NIS2 and customer security programmes ask you to check the suppliers who can reach your systems. Remote support is usually first on the list. These are the answers we are asked for most, and we'll complete your own questionnaire too.
- What standing access does ECS have to our systems?
- None. Connect sessions are authorised by your team before they start and closed when support ends.
- How is remote access secured?
- TLS 1.3 throughout, no always-on VPN, and a log of every session with engineer, start and end time, and what was done.
- How are device credentials handled?
- Held in Command Centre, encrypted and access-controlled, and never written into reports or sent by email.
- Can we get our data back?
- Yes. You can export asset records, backups and documents at any time, and receive a structured export if the contract ends.
Security questions
Does Command Centre need access to our production network?
No. It is filled from a Capture site visit, an approved export from your own systems, or a controlled upload. It does not scan your network and needs no standing connection to the factory floor.
Who owns the data?
You do. Asset records, program backups and documents belong to the customer. You can export them at any time, and if a contract ends you receive a structured export of everything held before access is removed.
How does Connect remote access work?
Each session is authorised before it starts, scoped to the support needed, and closed when support ends. It runs over TLS 1.3 with no always-on VPN and no standing access between sessions. Every session is logged with start and end time, engineer and what was done.
Is Command Centre IEC 62443 certified?
No. Command Centre and Connect are designed around IEC 62443 principles and are aligned with the standard, not certified against it. They support the asset, change and access parts of a security programme; full compliance needs an assessment of your whole system.
Can our IT team review the setup first?
Yes, and we recommend it. ECS will walk your IT or OT security lead through the data collection, access model and governance before anything is set up.