A cyber-security device for providing secure communication of automation and control messages between first and second networks in a system operable in one or more system states, the cyber-security device comprising: a first network interface configured to accept messages destined for the second network , and to transmit qualified and validated messages to the first network from the second network ; a second network interface configured to accept messages destined for the first network , and to transmit qualified and validated messages to the second network from the first network ; a processor configured in an operational mode to qualify and validate messages from the first and second network interfaces on a byte-by-byte basis; and memory configured to store a rule-set comprising rules for qualifying and validating messages on a byte-by-byte basis, wherein at least one of the rules is a system state-dependent rule; wherein the processor is operable in the operational mode to: accept a message from the first network interface ; retrieve the rule-set from memory ; receive data including system state information; qualify the message from the first network interface , on a byte-by-byte basis, based on the rule-set and the system state information; only if the message is qualified, validate the message, on a byte-by-byte basis, based on the rule-set and the system state information; and transmit the message to the second network interface only if the message is validated and in compliance with the system state-dependent rule. a first network interface configured to accept messages destined for the second network , and to transmit qualified and validated messages to the first network from the second network ; a second network interface configured to accept messages destined for the first network , and to transmit qualified and validated messages to the second network from the first network ; a processor configured in an operational mode to qualify and validate messages from the first and second network interfaces on a byte-by-byte basis; and memory configured to store a rule-set comprising rules for qualifying and validating messages on a byte-by-byte basis, wherein at least one of the rules is a system state-dependent rule; wherein the processor is operable in the operational mode to: accept a message from the first network interface ; retrieve the rule-set from memory ; receive data including system state information; qualify the message from the first network interface , on a byte-by-byte basis, based on the rule-set and the system state information; only if the message is qualified, validate the message, on a byte-by-byte basis, based on the rule-set and the system state information; and transmit the message to the second network interface only if the message is validated and in compliance with the system state-dependent rule. accept a message from the first network interface ; retrieve the rule-set from memory ; receive data including system state information; qualify the message from the first network interface , on a byte-by-byte basis, based on the rule-set and the system state information; only if the message is qualified, validate the message, on a byte-by-byte basis, based on the rule-set and the system state information; and transmit the message to the second network interface only if the message is validated and in compliance with the system state-dependent rule. <EOS>