IDY
JPEN
CONTACT
CYBER RESILIENCE / INDEPENDENT 5G EDGE

Keep essentialtasks running.At the 5G edge.Keep essentialtasks running.At the 5G edge.

Run purpose-built applications on iR800B. Limit functions, separate the corporate LAN and plan for multi-node continuity. Combine independent 5G connectivity with processing at the edge.

Discuss your projectView the design
Two colleagues reviewing a laptop at night. Illustrative workplace photograph.
01 / THREE DESIGN CHOICES

Limit the task.Separate the path.Contain disruption.Limit the task.Separate the path.Contain disruption.

Start with tasks that can run independently, such as data collection or event notification. Combine processing on iR800B with 5G access to reduce dependence on office PCs and the corporate LAN.

EDGE / LIMIT

Fewer functions. Fewer entry points.

Limit the application, permissions and destinations to the task. Remove unnecessary software and exposed services to reduce potential entry points and maintenance scope.

5G / SEPARATE

An independent path for the site.

Connect the site to approved cloud destinations outside the corporate LAN. Where coverage and subscriptions permit, deploy or relocate without modifying the LAN or installing another fixed line.

NODES / CONTINUE

Plan task handover between nodes.

Design task handover to another node during failure or maintenance. Validate application and data continuity in addition to communications redundancy.

02 / ARCHITECTURE

Isolate the office.Keep essentialfield tasks separate.Isolate the office.Keep essentialfield tasks separate.

Identify application, network and identity dependencies to define what can run independently. This is a design example; choose a handover mechanism around downtime and data requirements.

CORPORATE NETWORK

Corporate systems

Office PCs and routine work
Corporate LAN and uplink
Internal servers and services

Isolate suspected devices and investigate their impact. The independent field system is designed to support its tasks while the corporate network is being restored.

INDEPENDENT 5G EDGE

Limited tasks on iR800B

Target equipment and sensors
iR800B A / B: business application

Collect, evaluate and record. Handover is designed per project.

5G / LTE → approved cloud

No connection to the corporate LAN. Restrict management access, permissions and destinations, then validate independent operation of the required task.

Link redundancy and task continuity.

Plan communications switchover with iR800B and iS201B, and task handover across multiple iR800B nodes. Implement and validate failure detection, switchover, state transfer and duplicate prevention to design continuity across both communications and processing.

03 / ESSENTIAL EDGE TASKS

Turn an essential taskinto a focusededge application.Turn an essential taskinto a focusededge application.

Select processing with clear inputs, outputs and destinations, then design a focused application around it. Define the field task and organize its collection, notification and integration functions into an edge workflow.

COLLECT / RECORD

Keep collecting equipment data.

Collect and format equipment readings and events at the edge, then send required records to an approved cloud destination. Separate this limited task from office PCs and the corporate LAN.

DETECT / NOTIFY

Keep reporting changes in the field.

Run limited tasks such as threshold checks and event notifications locally. Filter data before sending it; design local buffering and retries where the workflow requires them.

RELAY / CONFIRM

Keep delivering essential information.

Start with tasks whose destinations and processing can be defined, such as status aggregation or a restricted API relay. Keep these separate from email browsing and arbitrary software execution on office PCs.

04 / THE IDY DESIGN APPROACH

How IDY designsfor essential work.How IDY designsfor essential work.

IDY believes essential tasks should use focused functionality, independent communications and deliberately separated processing. We propose combining edge processing on iR800B with 5G connectivity to reduce reliance on a single environment and limit the impact of disruption.

Elements of this approach align with principles in publications from NIST (the US National Institute of Standards and Technology) and criteria published by IPA (the Information-technology Promotion Agency, Japan). The table connects IDY’s choices with their references and the value to consider when selecting an architecture.

From IDY’s principles to design choices and reasons to choose them, supported by relevant public guidance.
IDY’s design principleDesigning with iR800B and 5GRelated public principlesWhy choose this approach
Limit functions. Reduce entry points.

Design a purpose-built application on iR800B. Select the required processing, permissions and destinations, and remove unnecessary software and exposed services.

NIST CM-7
Least Functionality.

IPA / JC-STAR S1.1-13
Disable unnecessary interfaces that present attack risks.

Move a defined task to a purpose-built environment. A focused edge application makes its attack surface and maintenance scope easier to manage.

Separate the site. Contain disruption.

Use independent 5G access from the site to approved destinations. Start with no connection to the corporate LAN and design destination, permission and management controls.

NIST SC-7
Boundary Protection: monitor and control communications at external and key internal interfaces.

Design field tasks to operate independently during corporate LAN isolation. Removing unnecessary internal paths gives separation a practical operational purpose.

Avoid dependence on a single path.

Prepare 5G access outside the existing LAN. Where needed, consider iS201B and distinct access paths, then test the workflow during switchover.

NIST CP-8
Alternate telecommunications services when primary communications are unavailable.

Prepare so a lost connection need not stop the task. Combine the deployment flexibility of 5G with the alternate paths the workflow needs.

Plan for another node to take over.

Across multiple iR800B nodes, implement and validate failure detection, task switchover, state consistency and duplicate prevention. Address shared vulnerabilities, power and access paths.

NIST SP 800-160 Vol.2 Rev.1
D.5.2.6: Maintain Redundancy, with consideration of shared resources and diversity.

Arrange for another node to take over tasks during failure or maintenance. Choose redundancy around the workflow, as well as its communications.

Maintain security beyond deployment.

Include vulnerability assessment, updates and records for the application, OS and libraries. Define a scope that can be maintained during operation.

NIST RA-5 / SI-2
Vulnerability monitoring, scanning and flaw remediation.

IPA / JC-STAR S1.1-13
Assessment of known vulnerabilities.

Choose an architecture whose functions and update scope are explicit. Consider maintainability alongside the initial specification.

From IDY’s principles to design choices and reasons to choose them, supported by relevant public guidance.

Limit functions. Reduce entry points.

Designing with iR800B and 5G

Design a purpose-built application on iR800B. Select the required processing, permissions and destinations, and remove unnecessary software and exposed services.

Related public principles

NIST CM-7
Least Functionality.

IPA / JC-STAR S1.1-13
Disable unnecessary interfaces that present attack risks.

Why choose this approach

Move a defined task to a purpose-built environment. A focused edge application makes its attack surface and maintenance scope easier to manage.

Separate the site. Contain disruption.

Designing with iR800B and 5G

Use independent 5G access from the site to approved destinations. Start with no connection to the corporate LAN and design destination, permission and management controls.

Related public principles

NIST SC-7
Boundary Protection: monitor and control communications at external and key internal interfaces.

Why choose this approach

Design field tasks to operate independently during corporate LAN isolation. Removing unnecessary internal paths gives separation a practical operational purpose.

Avoid dependence on a single path.

Designing with iR800B and 5G

Prepare 5G access outside the existing LAN. Where needed, consider iS201B and distinct access paths, then test the workflow during switchover.

Related public principles

NIST CP-8
Alternate telecommunications services when primary communications are unavailable.

Why choose this approach

Prepare so a lost connection need not stop the task. Combine the deployment flexibility of 5G with the alternate paths the workflow needs.

Plan for another node to take over.

Designing with iR800B and 5G

Across multiple iR800B nodes, implement and validate failure detection, task switchover, state consistency and duplicate prevention. Address shared vulnerabilities, power and access paths.

Related public principles

NIST SP 800-160 Vol.2 Rev.1
D.5.2.6: Maintain Redundancy, with consideration of shared resources and diversity.

Why choose this approach

Arrange for another node to take over tasks during failure or maintenance. Choose redundancy around the workflow, as well as its communications.

Maintain security beyond deployment.

Designing with iR800B and 5G

Include vulnerability assessment, updates and records for the application, OS and libraries. Define a scope that can be maintained during operation.

Related public principles

NIST RA-5 / SI-2
Vulnerability monitoring, scanning and flaw remediation.

IPA / JC-STAR S1.1-13
Assessment of known vulnerabilities.

Why choose this approach

Choose an architecture whose functions and update scope are explicit. Consider maintainability alongside the initial specification.

Design communications and processing around the task.

IDY’s proposition is to consider independent 5G access and purpose-built edge processing together, with iR800B at the center. Start with the task that must continue, then choose limited functionality, network separation, appropriate redundancy and maintenance.

Discuss your projectExplore iR800B
05 / COST & CONTINUITY

Budget forthe tasks youneed to preserve.Budget forthe tasks youneed to preserve.

Select essential tasks and compare the cost of independent access, application development and maintenance with their downtime impact. Define the workflow and continuity scope, then prioritize sites where the value is greatest.

IMPACT

Prioritize operational impact.

Identify the impact of missing records, unavailable alerts or lost site visibility. Define affected users and tolerable downtime before deciding which tasks to preserve.

LIFECYCLE COST

Include development and maintenance.

Include equipment, subscriptions, development, assessment, updates, storage, backups, power and handover rehearsals. For multiple nodes, plan recovery from weaknesses shared by every device.

FIT TO THE TASK

Use 5G capacity and deployment flexibility.

Consider 5G for image and video workloads or independent access at relocatable and temporary sites. Compare LTE for smaller workloads, separated wired networks and tethering for short-term communications.

06 / FROM DESIGN TO VALIDATION

Define a task.Test disruption.Prepare operations.Define a task.Test disruption.Prepare operations.

Design scope, separation, handover and updates together. Implement the field application, test its workflow through link and node failures, and prepare it for operation.

01 / DEFINE

Define a limited essential task.

Define inputs, processing, outputs, traffic, retention and tolerable downtime. Confirm the iR800B execution environment, resource demands and available interfaces before agreeing the implementation scope.

02 / RESTRICT

Restrict functions and destinations.

Remove unnecessary software, services and ports; restrict permissions, destinations and management access. Include the OS and libraries in vulnerability assessment and update procedures.

03 / TAKE OVER

Design the handover.

For multiple nodes, design failure detection, switchover, state transfer and duplicate prevention. Check shared power or carrier failures and dependencies on identity services.

04 / VERIFY

Test the task during isolation.

Test LAN isolation, link loss, node failure and restart. Check missing or duplicate records and recovered state. Validate update and recovery procedures, including vulnerabilities shared by every node.

Illustrative photograph of a team reviewing plans in a meeting room at night

Design the task and its connectivity together.

IDY helps define the task, inputs, outputs, traffic, installation and downtime impact, then proposes products and communications architecture. We work with your technical team to specify application implementation, resources and handover, and agree how development and operations will proceed.

07 / PRODUCT OPTIONS

Start with the edge.Choose theconnections it needs.Start with the edge.Choose theconnections it needs.

Build around iR800B for application processing and iS201B for communications redundancy. Select iR730B or iR721B according to site connectivity requirements, and combine the processing and access the workflow needs.

iR800B5G EDGE GATEWAY

iR800B
10GbE 5G Edge Gateway

10GbE, edge processing, multi-link resilience and WISE CONNECT® expansion in one platform.

View product specifications →iS201B5G USB MODEM

iS201B
5G USB Modem

Add an independent 5G path to existing systems for higher bandwidth and two-active-link resilience.

View product specifications →iR730BINDUSTRIAL 5G EDGE GATEWAY

iR730B
Industrial 5G Edge Gateway

Release 16, 5G/LTE, industrial I/O and WISE CONNECT® expansion in a compact platform.

View product specifications →iR721BGIGABIT LTE EDGE GATEWAY

iR721B
Gigabit LTE Edge Gateway

Up to 600Mbps with 3CA and 2x2 MIMO, industrial I/O and edge processing.

View product specifications →
08 / PRACTICAL QUESTIONS

Start with the task.Make thedesign concrete.Start with the task.Make thedesign concrete.

Which task moves to the edge? What does 5G add? How will handover work? Turn practical questions into explicit design decisions.

Which tasks are a good starting point?

Start with tasks with defined inputs and destinations: collecting and formatting equipment data, threshold checks, notifications or restricted API relays. Define runtime, workload and stored data, then implement and validate the application for the site.

How does limiting functionality reduce exposure?

Removing unused software and externally callable services reduces potential entry points and maintenance scope, consistent with principles in NIST CM-7 and IPA JC-STAR S1.1-13. Manage functions and permissions, and maintain assessment and updates for the OS, libraries and application.

What does 5G add to this architecture?

Where coverage permits, 5G makes it practical to place independent paths at individual sites without using the corporate LAN or installing a new fixed line. Consider its capacity for image or video workloads, and its flexibility for relocation or temporary sites. Validate throughput and latency against coverage and subscription conditions; compare LTE for smaller workloads.

How do multiple nodes support continuity?

Design failure detection, task switchover, state consistency and duplicate prevention, then test handover against the downtime target. Verify communications and application switchover, and prepare recovery procedures for shared vulnerabilities, power and identity failures.

How does deployment proceed?

Begin by choosing the task that must continue and defining its inputs, processing, outputs and destinations. Select equipment and access, implement the application, test LAN isolation and link or node failure, then assign owners and update and recovery procedures.

CISA #StopRansomware Guide : reference guidance on segmentation and out-of-band communications during isolation.

NEXT / DEFINE YOUR ESSENTIAL TASK

Choose one essential task.Design for its continuity.Choose oneessential task.Design forits continuity.

Tell us which field task must continue and which connections should be separate from the corporate LAN. Explore an iR800B edge application, independent 5G access and the redundancy your workflow needs.

Discuss your projectExplore iR800B