Operational technology that cannot be patched, sites reached by satellite, and safety systems that must never be touched by an attacker. Sophos sized for resource operators in Canada and the United States. Sophos Silver Partner. Offices in Markham, Ontario and Dallas, Texas. Quotes in CAD and USD, shipping to Canada and the United States. Three questions every mining owner asks. Tap a card to jump to the detail. Each row shows what can go wrong, which rule or standard expects you to control it, and the products that do. The tags under each risk show where Sophos or TrendAI name the same risk on their own industry pages or in their research. Encrypting the office side, the historian and fleet systems is enough to stop production. Exploited vulnerabilities started 49% of ransomware attacks on energy, oil and gas, and utilities, the closest sector Sophos reports. Source Rules and standards A flat network lets an attack on a laptop reach control systems. Rules and standards What fixes it Contractors bring their own laptops and remote-support tools onto site networks. Rules and standards Satellite and LTE links rule out heavy agents, so detection has to be local and light. Rules and standards What fixes it Orange links are Sophos, 1Password, N-able and Axcient products; blue links are TrendAI. A product supports the control; meeting a rule also takes your own policies and records. What breach and ransomware research says about this sector. Every figure links to its source. Verizon does not publish a mining snapshot; the manufacturing figure is the nearest industrial benchmark and the others are all-industry 2026 DBIR baselines. Sophos does not publish a mining report. The closest is its 2024 critical infrastructure report, covering 275 energy, oil and gas, and utilities organizations. These are 2024 figures, the newest Sophos has for this sector. Source: Sophos Mining has the highest Cyber Risk Index of any industry in TrendAI's 2026 Cyber Risk Report (42.5), entering the top of the rankings for the first time. TrendAI links it to fast OT digitization across scattered sites. TrendAI's Cyber Risk Index combines individual asset and risk-factor scores into one figure for an organization's overall security risk. Bars start at 35 so the gaps are visible. Source: TrendAI 2026 Cyber Risk Report The same four stages appear in nearly every breach. Each stage below shows what it looks like in this sector and the control that breaks the chain. The rules and expectations that shape a security purchase in this sector, in both countries. Status is as of September 2026; check the linked source before relying on a date. What the rules above ask you to do, in everyday words. Three dates and numbers to know first, then the requirements that come up again and again. NIST CSF 2.0 organizes a program into Govern, Identify, Protect, Detect, Respond and Recover the OT standard groups control systems into zones joined by tightly controlled conduits mines that supply designated energy or transportation operators may see their cyber requirements in contracts Machines, sensors and control systems sit on their own network with tightly limited connections to the office. Covered by: Sophos Firewall, Sophos Switch, Sophos NDR An up-to-date list of every device, including ones that cannot run security software. Covered by: Sophos NDR, Sophos Managed Risk A password alone is not enough. Staff, admins and anyone working remotely confirm each sign-in with a phone app or key. Covered by: Sophos ITDR finds who is missing it; 1Password; Sophos Workspace Protection Systems log sign-ins and changes, and the logs are kept long enough to investigate. Covered by: Sophos Next-Gen SIEM, Sophos XDR A written plan for a breach, people to carry it out, and notices sent to regulators and customers within the deadline. Covered by: Sophos MDR Plus responds 24/7 and documents the incident Copies of your data that an attacker cannot delete, and a restore you have actually tested. Covered by: N-able Cove, Axcient x360Recover and x360Cloud The tags show which rule or buyer asks for each item. Insurers, investors and large customers often ask for the same controls even where no law requires them. Each row is one job your security has to do, in plain words. Pick one product per row from the vendor you prefer: Sophos and TrendAI cover most rows; N-able Cove or Axcient cover backup; 1Password covers passwords. The last column shows the mining rule each row helps with. Decide who is responsible, which rules apply and what is allowed. List what you have and find the gaps before attackers do. Firewall, email and device protection, safe logins and remote access. Watch accounts, networks and logs for signs of an attack. Contain an attack fast, work out what happened, and tell the people who need to know. Backups you have tested, so you can restore instead of paying. The six steps are the functions of the NIST Cybersecurity Framework 2.0. TrendAI equivalents appear in the table below. Source A dash means that vendor does not sell a product for that row through Nuformat. A product supports the control; meeting a rule also takes your own policies and records. All 17 Sophos product lines Nuformat sells, what each one does in this sector, and the standard or framework control it supports. This is a high-level map: products supply the technical safeguards, and compliance still depends on your policies, people and evidence. Section and control numbers point to the requirement a product helps with. Your auditor or assessor decides whether the control is met. Nuformat maps a specific questionnaire or assessment to these products on request. Cyber insurance pays for the cost of an attack or a data breach. Before quoting, insurers check a short list of security controls; missing ones raise the premium, cut the limit, or end the conversation. Policies differ. Read the exclusions, waiting period and sublimits, especially for ransomware and social engineering fraud. The list follows Marsh's twelve key cyber controls. Source Where insurers dig deeper: Mines are asked how control systems are separated from the office network, how vendors reach equipment remotely, and how long a site can operate if IT is down. A head office, a mill and a remote camp, about 300 staff and 80 contractors, would typically run: Licenses are sold in 1, 2 or 3-year terms or month to month through Nuformat. Hardware is bought outright or as Hardware as a Service. Every quote states the currency. Send us your site list, user count and any questionnaire you have been given. A Nuformat specialist maps the products to it and returns a quote within two to three business days. Available in Canada and the USA. Sophos Silver Partner. The main ones on this page are listed by country. In Both: NIST Cybersecurity Framework 2.0 and CISA ICS guidance, Insurer and lender requirements. In Canada: Bill C-8, Critical Cyber Systems Protection Act, Provincial mine health and safety regulations. Many organizations also organize the work with the voluntary NIST Cybersecurity Framework 2.0 and its six functions: govern, identify, protect, detect, respond and recover. Check the linked sources for current status and dates. Sophos covers the firewall, endpoint, email, identity, network detection and 24/7 managed detection and response, and TrendAI Vision One offers an alternative for most of the same needs, except the firewall itself. Neither Sophos nor TrendAI sells backup or a password manager through Nuformat, so N-able Cove or Axcient handle backup and recovery, and 1Password Business handles passwords. The feature match table on this page lists each need with the product from each vendor. Yes. The Sophos NDR sensor watches the OT network passively and reports new devices, unusual protocols and lateral movement. The XGS firewall separates OT from IT so nothing reaches the equipment without a rule allowing it. Yes. The XGS firewall runs SD-WAN over satellite and LTE with failover, and Sophos agents are designed for intermittent connectivity. MDR telemetry is compact; Nuformat sizes the link budget with you. Put contractors on their own network zone with no route to OT, give them ZTNA access to the specific systems they need, and let MDR watch the traffic. No corporate agent has to go on their machines. Mining is not itself a designated sector. Mines that own power generation or rail assets, or that supply designated energy or transportation operators, should expect requirements to flow down through those relationships as regulations are phased in. Yes. Nuformat is a Sophos Silver Partner with offices in Ontario and Texas, quoting in CAD and USD, and ships to remote sites. It covers much of what insurers ask about: MFA visibility, EDR, email security, logging and 24/7 response through MDR. Backups come from N-able Cove or Axcient. Insurers decide coverage and price, so answer the application accurately; Nuformat can map your current controls to the questionnaire before you submit it.Cybersecurity for mines, mills and remote resource sites.
The page in 30 seconds
See the top risks →
See what they ask for →
See the feature match →1. The problem: your top 4 risks, the rule behind each, and what fixes it
1Ransomware that halts a shift
2Office and plant on one network
3Contractors and vendor remote access
4Remote sites with thin links
The risk in numbers
If ransomware hits energy and utilities, the closest sector Sophos reports on
Ranked #1 of the 10 highest-risk industries
How an attack unfolds here, and where Sophos stops it
What you have to comply with
Where Rule or expectation What it asks for Both NIST Cybersecurity Framework 2.0 and CISA ICS guidance The reference frameworks lenders, insurers and joint-venture partners use to assess a mine's cyber program, including segmentation and monitoring of control systems. Source Canada Bill C-8, Critical Cyber Systems Protection Act Royal Assent June 15, 2026. Energy and transportation operators are designated sectors; mines that own power or rail assets, or supply designated operators, will see requirements flow down. Source Canada Provincial mine health and safety regulations Safety-critical control systems fall under provincial mining safety rules; cyber changes to them need the same change control as any other. Source Both Insurer and lender requirements Project finance and property insurance increasingly require OT segmentation, monitoring and an incident response plan. Source 2. The rules, in plain English
1Keep plant and control systems apart
2Know everything that is connected
3Lock every login with a second step
4Keep a record of who did what
5Have a plan, and report on time
6Back up, and prove you can restore
Feature match: what you need, and who covers it
How the pieces fit together
Set the rules
Know your weak spots
Keep attackers out
Spot what gets through
Stop it fast
Get back to work
What you need Sophos TrendAI Backup: N-able Cove or Axcient 1Password Helps meet
ProtectSophos Firewall (XGS) TrendAI Network Security (intrusion prevention, used alongside a firewall) – – IEC 62443 zones and conduits (FR5 restricted data flow); CSF PR.IR
ProtectSophos Endpoint
Sophos Endpoint for ServerTrendAI Endpoint Security – – IEC 62443 FR3 system integrity; CIS 10
ProtectSophos Email TrendAI Email and Collaboration Security – – CIS 9; CSF PR.PS
Detect and RespondSophos MDR TrendAI MDR – – IEC 62443 FR6; CSF RS.MA
Protect and DetectSophos ITDR TrendAI Identity Security – 1Password Business IEC 62443 FR1 identification and authentication; CIS 5 and 6; IEC 62443 FR1 identification and authentication
DetectSophos NDR TrendAI XDR for Networks (NDR) – – IEC 62443 FR6; CISA ICS guidance
ProtectSophos Workspace Protection (ZTNA) TrendAI ZTSA Private Access – – IEC 62443 FR2 use control; CIS 6
IdentifySophos Managed Risk TrendAI Cyber Risk Exposure Management – – CIS 7; CSF ID.RA
Protect and DetectSophos Next-Gen SIEM TrendAI Agentic SIEM – – IEC 62443 FR6; CIS 8
Protect and Recover– – N-able Cove for Microsoft 365
Axcient x360Cloud– CSF RC.RP; CIS 11
Protect and Recover– – N-able Cove for PCs, Macs and servers
Axcient x360Recover– IEC 62443 FR7; CSF RC.RP
Protect– – Axcient x360Sync – CIS 3; CSF PR.DS
Govern and ProtectSophos AI Defense TrendAI ZTSA AI Service Access – – NIST AI RMF; CIS 3
ProtectSophos Mobile TrendAI Mobile Security protects phones from malicious apps but does not manage, lock or wipe them. – – CIS 1 and 4 Every Sophos product line, mapped to mining (17 lines)
Sophos product line Use in mining Helps meet Sophos Firewall (XGS)Protect Separates the mine OT network from corporate IT; SD-WAN and 5G failover to remote sites. IEC 62443 zones and conduits (FR5 restricted data flow); CSF PR.IR Sophos Virtual FirewallProtect Protects ERP and fleet systems hosted in the cloud. CSF PR.PS; CIS 12 Webserver Protection add-onProtect Protects supplier and contractor portals. CIS 13; CSF PR.PS Sophos SwitchProtect Segmented switching for plant, camp and office networks. IEC 62443 FR5; CIS 12 Sophos AP6 wirelessProtect Camp and site Wi-Fi kept off operational networks. IEC 62443 FR5; CIS 12 Sophos EndpointProtect Protects engineering workstations and office PCs. IEC 62443 FR3 system integrity; CIS 10 Sophos Endpoint for ServerProtect Protects historian, SCADA servers and file servers. IEC 62443 FR3; CIS 10 Sophos XDRDetect Investigation across IT systems at remote sites. IEC 62443 FR6 timely response; CSF DE.AE Sophos MDR and MDR PlusRespond 24/7 response for sites with no security staff on shift. IEC 62443 FR6; CSF RS.MA; Bill C-8 supplier requirements from designated operators Sophos ITDRDetect, Respond Finds shared and contractor accounts without MFA. IEC 62443 FR1 identification and authentication; CIS 5 and 6 Sophos NDRDetect Watches PLCs, SCADA and control networks without touching them. IEC 62443 FR6; CISA ICS guidance; CSF DE.CM Sophos EmailProtect Stops fake supplier invoices and executive impersonation. CIS 9; CSF PR.PS Sophos Next-Gen SIEMDetect Long-term logs for incident review and insurer evidence. IEC 62443 FR6; CIS 8 Sophos Managed RiskIdentify Finds internet-exposed remote access and OT gateways. CIS 7; CSF ID.RA Sophos Workspace Protection (ZTNA)Protect Vendor remote access to one system, with device checks. IEC 62443 FR2 use control; CIS 6 Sophos MobileProtect Manages rugged tablets and phones used on site. CIS 1 and 4 Sophos AI Defense Quote on requestGovern, Protect Policy for AI tools used on geological and operations data. NIST AI RMF; CIS 3 Cyber insurance: what it pays for and what insurers check
Your own costs
Claims against you
The 12 controls insurers look for
A worked example: a mine with a head office and two sites
Where What runs there Head office XGS 3100 with Xstream, Sophos Endpoint, MDR Plus Mill XGS 2300 with Xstream, IT and OT zones, NDR sensor on the OT segment Remote camp XGS 128 with Xstream over satellite, 5G failover where available Contractors Sophos ZTNA, per system, time-limited IT systems and historian Cove backup with a tested restore Get this sized and quoted for your organization
Frequently asked questions
Which cybersecurity rules and frameworks apply to mining?
Which products cover the main cybersecurity needs for mining?
Can Sophos protect control systems without installing anything on them?
Does Sophos work over satellite links?
How do we handle contractor laptops on site?
Does Bill C-8 apply to a mine?
Do you serve operators in both countries?
Will Sophos help us get or renew cyber insurance?
Industries · Mining and resources · Canada and USA
In plain terms: A mine's IT network is the easy part. The hard part is the operational side: crushers, conveyors, ventilation, fleet management and process control, running on equipment that was installed for a 20-year life. The defense keeps IT and OT apart, watches the OT side without touching it, and works over a slow link.
1The problem
2The rules
3The fix
IEC 62443 FR6 timely responseIEC 62443 FR7 resource availability
IEC 62443 FR5 restricted data flowCSF PR.IR
IEC 62443 FR2 use controlCIS 6 Access control
CSF PR.IR resilienceCIS 12 Network infrastructure
31%
of breaches began with an exploited vulnerability (all industries)
Verizon 2026 Data Breach Investigations Report
48%
of breaches involved ransomware (all industries)
Verizon 2026 Data Breach Investigations Report
48%
of breaches involved a third party (all industries)
Verizon 2026 Data Breach Investigations Report
61%
of manufacturing breaches involved ransomware, the closest DBIR industrial benchmark
Verizon 2026 DBIR
Most common way in49%Exploited vulnerabilitiesthe most common way in
What it costsover $2.5Mmedian ransom paid
And then$3Mmedian cost to recover in the energy and water sectors
1Entry
What happensContractor laptop or an exposed remote-support tool
What stops itXGS firewall with IPS; ZTNA for vendors; ITDR
2Foothold
What happensAn office PC or the historian server
What stops itSophos Endpoint on IT systems
3Spread
What happensToward the OT network
What stops itFirewall zones between IT and OT; NDR sensor on the OT segment sees any crossing
4Impact
What happensProduction halt, safety risk
What stops itMDR Plus responds 24/7; Cove restores IT systems; OT stays isolated
6functions
ZonesIEC 62443
C-8flow-down
IEC 62443NIST CSF
NIST CSFIEC 62443
IEC 62443Insurers
NIST CSF
NIST CSFBill C-8 contracts
NIST CSFInsurers
Not sure which of these you already cover?Send us what you run today. A Nuformat specialist marks each requirement as covered, partly covered or missing, at no charge.
Govern
Sophos AI Defense
Identify
Sophos Managed Risk
Protect
Sophos FirewallSophos EndpointSophos Endpoint for ServerSophos EmailSophos ITDR1Password BusinessSophos Workspace ProtectionAxcient x360SyncSophos Mobile
Detect
Sophos NDRSophos ITDRSophos Next-Gen SIEM
Respond
Sophos MDR
Recover
N-able Cove M365Axcient x360CloudN-able CoveAxcient x360Recover
Block attacks at your internet connectionChecks traffic coming in and going out and blocks attacks. A firewall also keeps parts of the network apart; TrendAI Network Security is intrusion prevention that works alongside a firewall.
Stop ransomware and malware on computers and serversProtection on each laptop, PC and server that blocks malicious software and stops files being encrypted.
Stop phishing and fake-invoice emailsChecks email before it reaches staff and blocks phishing links, malware and impersonation.
Experts watching for attacks around the clockA security team monitors your systems 24/7 and acts on attacks, including nights and weekends.
Protect logins and passwordsSpots stolen or risky accounts and missing multi-factor authentication, and gives every person a unique, strong password.
Watch devices that cannot run security softwareWatches network traffic to spot attacks on cameras, scanners, medical or plant equipment and other devices with no protection of their own.
Safe remote access for staff and vendorsLets people reach only the applications they need from home or on the road, instead of the whole network.
Find and fix weak spots before attackers doFinds exposed systems and missing patches, and ranks what to fix first.
Keep logs as proof for auditors and insurersCollects and keeps security records, so you can show what happened and when.
Back up Microsoft 365 or Google WorkspaceKeeps a separate copy of email and cloud files, so a deleted mailbox or an attack does not mean lost data.
Back up servers and PCs, and restore fastBacks up whole machines so you can restore files or entire systems after ransomware or a hardware failure.
Share files with clients and partners securelyControlled file sharing with permissions, instead of email attachments or personal cloud drives.
Control the AI tools staff useShows which AI tools people use and keeps sensitive data out of the ones you have not approved.
Manage, lock and wipe phones and tabletsKeeps company phones and tablets set up securely, and locks or wipes them if they are lost.
Want this priced for your sites?Pick a column or mix them. Tell us your sites, users and servers, and we quote Sophos and TrendAI side by side in CAD or USD within two to three business days.
1
MFA for remote and privileged (admin) accessSophos ITDR shows gaps; 1Password; Workspace Protection
2
Email filtering and web securitySophos Email; Sophos Firewall web filtering
3
Secured, encrypted and tested backupsN-able Cove; Axcient x360Recover and x360Cloud
4
Privileged access managementSophos ITDR flags admin accounts; 1Password vaults admin credentials
5
Endpoint detection and response (EDR)Sophos Endpoint with XDR, or MDR
6
Patch and vulnerability managementSophos Managed Risk; TrendAI CREM
7
Incident response planSophos MDR Plus includes incident response
8
Security awareness training and phishing testsA staff training program; Sophos Email cuts the volume
9
Remote desktop (RDP) lockdown and hardeningSophos Firewall; Workspace Protection replaces exposed RDP
10
Logging and monitoringSophos Next-Gen SIEM; MDR
11
Replace or protect end-of-life systemsFirewall segmentation; Sophos NDR watches what cannot be patched
12
Supply chain and vendor riskWorkspace Protection limits vendor access; ITDR removes stale accounts
Answer the application accurately. In 2022 an Illinois manufacturer's application said it required MFA for email and remote network access. After a ransomware attack, the insurer said MFA was only on the firewall and asked a court to cancel the policy. On August 26, 2022 the court entered judgment rescinding the policy, with the company's agreement, leaving it without coverage. Source
Renewing or applying for cyber insurance?We map your current setup to the twelve controls before you fill in the application, so the answers are accurate and the gaps are known.
Sources