Home / Security and compliance
Security and compliance for critical infrastructure control rooms
Operators have to demonstrate secured voice and emergency communication. This page shows what openvocs contributes, which rules apply in each sector and which documents we supply.
Three levels
Organization, product and service each have their own rules. Keeping them apart shows which evidence is needed for what.
Spacecomms
Requirements arrive through contracts, supplier questionnaires and the operators’ qualification criteria. ISMS for development, delivery and support of openvocs: [Stand freigeben]
openvocs
Spacecomms is the manufacturer of the delivered distribution as defined by the Cyber Resilience Act. Vulnerability reporting obligations apply from the first delivery. Security updates are free of charge and separate from feature updates.
Installation and support
The system runs on the operator’s network and therefore within the operator’s ISMS. Remote maintenance: [Angebot offen]
Requirements by sector
The obligations lie with the operator. The right-hand column shows how openvocs supports them.
| Sector | Legal basis for the operator | Contribution of openvocs |
|---|---|---|
| Energy, grid operation | §§ 5c to 5e EnWG, IT security catalog, ISO 27001 certificate of the operator | Operation on the operator’s own network; self-assessment based on BDEW/OE/VSE white paper 3.0, which names VoIP explicitly |
| Water, district heating | BSIG, § 30 | secured voice and emergency communication (§ 30(2) no. 10) |
| Transport | BSIG, KRITIS ordinance; rail also § 16(2) EBO | Recorder with signed recording where recording is required |
| Space | NIS-2, Annex 1, space sector | proven in mission operations at GSOC |
| IT and data centers | BSIG, § 30 | Air-gapped operation, no external dependencies |
| Financial IT | DORA Art. 28 to 30 | Contract addendum according to DORA in preparation |
| Federal administration | §§ 29, 44 BSIG, IT-Grundschutz | Mapping to IT-Grundschutz in preparation |
Not legal advice. Whether and how an operator is affected is a question for its supervisory authority or law firm.
Documents for operators
On request and under confidentiality.
There is no NIS-2 certificate for products. NIS-2 places obligations on operators. That is why we do not call openvocs “NIS-2 compliant”. Instead we map each feature to the measure it supports.
- Source code
- Apache-2.0, public on GitHub available
- § 30 mapping
- Features per measure under § 30(2) BSIG in preparation
- BDEW self-assessment
- based on white paper 3.0 for grid operators in preparation
- SBOM
- machine-readable according to BSI TR-03183-2 in preparation
- Recorder data protection
- DPIA template, deletion concept, data processing agreement in preparation
- Report a vulnerability
- /.well-known/security.txt [security@spacecomms.com]
Request compliance documents
For the operator’s procurement, information security and data protection teams.