Where does my assessment data live?

In a UK/EU-hosted database. Your account can only ever read its own records, and you can delete your assessments at any time.

Do I have to upload sensitive documents?

No. XIRIQ is designed so you never have to upload sensitive documents. The evidence register records what evidence exists and where it lives in your own systems; attachments are optional and off by default.

Does this replace a consultancy or an audit?

No, and it doesn't pretend to. XIRIQ is assessment support tooling: it structures the work, keeps the evidence, and drafts the report. Findings should be verified against the source standards and reviewed by a qualified engineer. The report says so on every page.

Which frameworks are covered?

The UK NCSC CAF v4.0's 41 contributing outcomes, NIS2 governance, Article 21 measures and Article 23 reporting duties, and IEC 62443-3-3 base requirements (51, SL-T scoped).

An OT engineer working on live offshore wind SCADA and protection systems. Built because the alternative was another decade of £40k spreadsheet-shaped assessments.

NCSC CAF, NIS2 & IEC 62443 Assessment Tool

Know exactly where your OT estate stands.

XIRIQ turns the NCSC CAF v4.0, NIS2 and IEC 62443-3-3 into a guided assessment your engineers can actually complete, then produces the gap register, dashboard and board-ready PDF report a consultancy would charge tens of thousands for.

Free during early access · No credit card · UK/EU data residency

Understand the frameworks behind your assessment.

Practical guidance on the NCSC Cyber Assessment Framework, NIS2 and IEC 62443: what they require, where they overlap, and how they apply to OT, SCADA and critical infrastructure environments.

Framework Guides

CAF v4.0: What Actually Changed, Explained for OT Teams

The NCSC's CAF v4.0 moves from 39 to 41 contributing outcomes: threat hunting, threat understanding and secure software now have their own outcomes. Here is what changed, written for the engineers who have to answer the questions.

Read the guide →

Framework guides, comparisons and assessment-readiness articles, written for the engineers who have to answer the questions, not just the people who read the reports.

View all resources

Three frameworks. One assessment workflow.

Every requirement rewritten in plain engineering language, with the network zones, IEDs and remote-access realities of real industrial estates in mind.

UK NCSC CAF

41 outcomes

Cyber Assessment Framework

The version UK regulators assess operators of essential services against today.

+Full v4.0 coverage: all 41 contributing outcomes.
+Detailed mode assesses the CAF's own indicators of good practice.
+Sector overlays and regulator target profiles supported.

How XIRIQ assesses the NCSC CAF v4.0 →

NIS2

15 obligations

Directive obligations

Governance duties, the ten Article 21 risk-management measures, and the 24h / 72h / 1-month incident-reporting deadlines under Article 23.

NIS2 obligations in XIRIQ →

IEC 62443-3-3

51 requirements

System security requirements

All base requirements across FR1 to FR7, scoped automatically to your target security level (SL-T). The contractual standard on most energy projects.

IEC 62443-3-3 requirements and SL-T scoping →

From blank page to board-ready report

A structured workflow, not a chatbot. Your answers stay yours.

Define scope

Site, zones, target security level. The framework adapts to what is actually in scope.

Assess

Work through plain-language requirements. Mark implemented, partial or gap, with evidence notes.

See your position

Live dashboard with compliance by section and a severity-ordered gap register.

Issue the report

AI-drafted executive summary and a formatted PDF: referenced, paginated, review-ready.

Questions engineers actually ask

Yes. Free during early access, full functionality, no credit card. Paid team and multi-site tiers will come later; early users keep generous terms.