ZCR1 — Identify the SUC
ZCR 1 models the System Under Consideration (SUC): inventory of equipment and networks, functions provided, users and roles, access points, then a visual diagram of the system and an analysis of known vulnerabilities (CVE) for the listed equipment.
Tabs
Equipment · Networks (optional) · Functions · Users & Roles · Access points · SUC diagram · Guide.
The Networks switch in the header shows or hides the Networks tab (and the associated column in the Equipment table).
Data shared with EBIOS RM
Equipment and Networks are actually EBIOS RM supporting assets filtered by category (Hardware, Network), and Functions correspond to the business values of EBIOS RM Workshop 1.2. An asset created here is therefore visible from the EBIOS RM module and vice versa.
Equipment tab
Toolbar: ＋ Equipment, 📚 From library (import filterable by domain All/OT/IT/Both), search.
| Column | Description |
|---|---|
| Name | Industrial tag or functional label |
| Type | Multi-value chips (picker) — PLC/DCS, HMI, SCADA server, network, sensor/actuator, engineering workstation… |
| Description | Functional role |
| Location | |
| Owner | |
| Networks | Chips (if the Networks tab is enabled) |
Networks tab
Toolbar: ＋ Network (dialog Name + Type). Table: Name, Type (selector), Connected equipment (chips + association modal), Description, Location.
Functions tab
Toolbar: ＋ Function, 📚 From OT library. Table: Function name, Category, Type/Detail, Description, Owner.
Users & Roles tab
Toolbar: ＋ User. Table: Name/ID, Role (Administrator, Operator, Maintainer, Integrator…), Access level (SL1 to SL4 buttons), Description.
Access points tab
Toolbar: ＋ Access point, "X exposed" / "Y encrypted" counters. Table:
| Column | Description |
|---|---|
| Name | |
| Type | Access point type (physical, network, wireless, remote…) |
| Protocol | |
| Externally exposed | Yes/No toggle |
| Encryption | ✓/✗ toggle |
| Authentication | Mechanism in place |
| Description |
Rows for an exposed access point are highlighted.
SUC diagram
Graphical SVG editor for visually positioning equipment, zones and conduits.
Toolbar
| Button | Function |
|---|---|
| ☰ Palette | Shows/hides the side palette |
| ↖ Select | Selection mode |
| ↔ Link | Create a link between two nodes |
| ▭ Zone | Draw a zone by dragging |
| ⇥ Conduit | Create a conduit between two zones |
| ✕ Delete | Deletes the selected element |
| ⊘ Clear all | Empties the diagram (confirmation required) |
| ↓ Export SVG | Downloads the diagram as an SVG image |
| ＋ Equipment / ＋ Zones | Imports the elements not yet placed on the diagram |
| ⟳ Import ZCR3 | Imports zones, equipment and conduits defined in ZCR3 (see below) |
| ⊕ Anchors | Shows/hides the conduit anchor points |
Additional selectors: line thickness of the selected conduit (2/4/6/8/12), line style — ━ Straight, 〜 Curved, ⌐ Orthogonal.
The side palette lists the available elements (drag & drop), filterable by OT/IT/Both domain. Double-click a node to rename it; the Delete key removes it.
Import from ZCR3 and synchronisation with ZCR3 — Zones & Conduits
The ⟳ Import ZCR3 button pulls onto the diagram everything that exists in ZCR3 — Zones & Conduits but is not yet drawn:
- Zones — every ZCR3 zone missing from the diagram is added as a rectangle, with its name and its target SL-T level (coloured badge).
- Equipment — equipment attached to a ZCR3 zone is placed automatically inside the rectangle of its zone.
- Conduits — ZCR3 conduits whose two zones are present on the diagram are drawn.
The badge on the button shows the number of elements left to import. The import is incremental: nothing is duplicated or overwritten, only the missing elements are added — so you can click again after completing ZCR3.
Continuous synchronisation
Once linked (via import or creation), the diagram and ZCR3 stay consistent:
| Action on the diagram | Effect in ZCR3 |
|---|---|
| Draw a zone | Creates the corresponding ZCR3 zone |
| Draw a conduit (or connect a zone to an existing conduit) | Creates the corresponding ZCR3 conduit |
| Rename a zone or a conduit | Renames the linked ZCR3 object |
| Delete a zone or a conduit | Deletes the linked ZCR3 object |
| Move equipment into/out of a zone | Updates the equipment list of the ZCR3 zone |
The other way round, ZCR3 information (target SL-T level, description, applicable requirements) is shown live on the diagram and in the side panel — the SL-T can in fact be edited directly there. However, a zone or a conduit created in ZCR3 does not appear automatically: it feeds the counter on the ⟳ Import ZCR3 button, which lets you add it to the diagram.
Source of truth
ZCR3 remains the reference for analysis data (SL-T, requirements, equipment membership); the diagram is the graphical view of this partitioning.
Equipment CVE analysis
Accessible via the CVE Analysis button on the Equipment tab (dedicated route /iec62443/zcr1-vulnerabilites), this analysis cross-references the ZCR1 inventory with public vulnerability databases (NVD/ICS-CERT) to prepare the threat scenarios for ZCR5.
Tabs
Equipment inventory · CVE analysis · Suggested scenarios.
Equipment inventory
Toolbar: search, Import CSV / Nmap XML, Analyze all CVEs. Table: Name, Type, Vendor/Manufacturer, Model, Firmware/Version, Location, CVE column (loading status or "N CVE" badge coloured by maximum score, per-row "Analyze" button).
CVE analysis
Filter by severity (All levels, Critical ≥9, High ≥7, Medium ≥4, Low). One block per equipment with a table: CVE ID (NVD link), CVSS score, CWE, Canonical vulnerability, Description, Publication date.
Suggested scenarios
Selectable table (checkbox): Equipment, CVE, Score, Canonical vulnerability, Description, Status (Injected / Pending). Inject into ZCR5.2 (N) button.
✦ AI "Suggest CVEs" button
If AI is enabled, this button generates 3 to 6 real or typical CVEs for a given equipment (vendor/model), merged with those already found.
NVD rate limit
The analysis sequences requests (about 700 ms apart) to respect the public NVD API limit (5 requests / 30 s without an API key). A full analysis of a large inventory can therefore take several minutes.