Security testing, incident response and industrial systems
Enterprise Cybersecurity
Penetration testing, security assessments and incident response for businesses. We also assess maritime, SCADA, water and utility systems.
Gather records before an engagement
Related preparation packages
Choose a guide to identify records, assign owners and prepare questions for your auditor, consultant, counsel or export-control specialist.
These are preparation aids. They do not replace an audit, assessment, legal opinion or specialist decision, and they do not authorize testing.
Read the overviews without a form. Downloads require your name and email; we email a seven-day access link. Organization and phone are optional.
Complete OT assessment planning set
Use the four sector packs, project workbook and shared source records to organize a proposed OT assessment.
File: ZIP: PDFs, XLSX workbook and CSV records.
NYDFS Part 500 preparation
Gather entity details, policy records, system evidence and questions for a Part 500 specialist.
File: ZIP: guide and editable CSV checklists.
New York private-information preparation
Map private information, safeguards, service providers and incident records for privacy and breach review.
File: ZIP: guide and editable CSV checklists.
CMMC and NIST SP 800-171 preparation
Organize contracts, information boundaries, system records and evidence requests for a defense cybersecurity specialist.
File: ZIP: guide and editable CSV checklists.
EAR and ITAR preparation
Gather product, technical-data, access and transaction facts for an export-control specialist to evaluate.
File: ZIP: guide and editable CSV checklists.
Security assessment and penetration-test preparation
Record proposed scope, owners, safety boundaries and permissions before audit, security assessment or physical or cyber testing.
File: Editable CSV preparation checklist.
Browse all preparation packages by subject.
Check each overview for source dates, scope limits and unresolved questions before using a download.
See All services
Find a cybersecurity service
Choose security testing, incident response or industrial cybersecurity.
Industrial cybersecurity and planning
Discuss your security needs
Identify the systems, owners, assessment objective and deadline. Discuss targets, exclusions, test identities, data handling and operating constraints before validation begins.
The services below cover business networks, applications and industrial systems. For industrial systems, include the engineering contacts who can explain the process and approve methods and timing.
Principal services
Security testing and industrial cybersecurity
The starting point may be a business network, an application, an industrial process or its supporting records. Agree on authorization and operational limits before testing begins.
Penetration testing
Test authorized network and application attack paths and validate the consequences of material weaknesses. Define targets, access, exclusions and stop conditions, then give the technical team evidence, remediation priorities and an agreed retest scope.
Scope a network or application testSCADA and OT assessments
Assess industrial access, segmentation, monitoring and recovery readiness around the process your team operates. Documentation review and passive observation establish context; engineering approves the methods and timing of active validation.
Plan an assessment around operationsCritical infrastructure
Connect operational security findings, incident readiness and supporting evidence across infrastructure environments. Scope the technical questions and reporting audience, then select the assessment, incident or audit-evidence work that fits.
Explore infrastructure security and evidence supportSource code security review
Trace application identity, authorization, data flows and trust decisions through the agreed source version. Combine manual review with SourceScan to assess candidate findings and explain their conditions, security consequences and remediation.
Discuss a codebase or release reviewScope and delivery
Reports, recommendations and retesting
A useful assessment explains what was examined, what the findings mean in your environment and what should happen next.
Security assessment or penetration test?
A vulnerability assessment identifies and prioritizes weaknesses across an agreed scope. Penetration testing investigates authorized paths and the conditions under which a weakness can have a security consequence. One does not automatically replace the other.
Discuss the business decision, system owners, test identities, available logs, data handling and permitted validation. For production and industrial systems, include operating constraints and conditions for stopping work.
Review vulnerability assessment scopeFindings, remediation and retesting
The reporting scope can include affected systems or code, observed evidence, preconditions, business or operating consequences, recommended changes and remaining limits. Leadership and engineering may need different levels of explanation from the same findings.
Agree which corrections will be retested and what establishes closure. References to a testing method or framework do not by themselves establish certification, regulatory compliance or an absence of vulnerabilities.
Prepare a penetration-testing scope requestSpecialist routes
Browse all cybersecurity services
Find services for networks and applications, industrial systems, AI and incident response.
Testing and assessment scope
Start with the decision you need to make. Exposure assessment, application testing and recurring validation serve different purposes.
SCADA, maritime, water and utilities
Choose a specific industrial service when the scope centers on supervisory systems, incident evidence or audit support.
AI systems and security decisions
Review governance, architecture and technical behavior of AI systems. This work is distinct from using AI tools during a penetration test.
Incident response and preparation
An active event needs preservation and response coordination. Preparedness work defines useful records and responsibilities before an incident.
Additional service routes
Additional cybersecurity services
Find additional services for security architecture, connected systems, leadership and audit preparation.
Architecture, connected systems and industrial inventory
Choose a defined architecture or system review when the question concerns segmentation, assets, connected devices or a mainframe environment.
Leadership, diligence and audit evidence
These services support a defined business decision or technical evidence requirement. Applicability, scope and reporting responsibilities should be agreed for the organization involved.
People and supporting technology
Our experts and technology
Tools help identify candidates. Technical judgment establishes what a finding means in the application or operating environment under review.
Relevant technical experience
Joseph Caruso's biography describes his software, databases, business systems and incident-response experience. Robert Knudsen's biography covers computer forensics, cybersecurity and computer and network operations.
Review the published qualifications and discuss the team and technical scope for your engagement.
Meet the GDF teamSourceScan and source-level review
SourceScan is GDF-owned and developed and maintained with PNNX. It supports AI-assisted source analysis and findings and remediation tracking. The security review still needs the relevant source version, application context and validation of material findings.
For code ownership, copying or disputed software behavior, follow the separate expert-witness service.
Related forensic services
Preserve useful logs and records before remediation changes them. An investigation may require device, email or cloud analysis alongside response and security testing. The scope should distinguish observed access from possible access and record gaps.
Explore Digital Forensics & LitigationBefore you contact us
Describe the environment, assessment objective, operating constraints and deadline. Identify the people who authorize testing and the reports they need. Arrange secure sharing before sending credentials, source code or detailed architecture.
For work across locations, review our regional engagement information and discuss the assessment and coordination needs at each site.
For an active incident, call. A form submission does not create an engagement.
Choose the industrial cybersecurity engagement
Choose the service for your operation and the question you need answered. Each scope identifies operator authority, available evidence, access limits and the qualified engineering or safety roles required.
- Maritime: facility and terminal cyber assessment, access and recovery questions with maritime applicability reviewed for the actual operation.
- Water and wastewater: asset, remote-access and recovery review around treatment dependencies and the operator's approved access.
- Power and energy: access-path and recovery assessment around electricity operations, qualified electrical roles and outage constraints.
- Utility audit and incident readiness: a control-to-evidence record, gaps and readiness actions for the requirements and audit or incident-readiness question in scope.
A passive coverage record can list the supplied asset source, observed connection, owner, visibility gap and permitted validation. It is an illustrative output format, not a completed client assessment. Digital evidence work does not authorize process changes, replace engineering approval or itself establish regulatory compliance.
Maritime Cybersecurity · Water & Wastewater Cybersecurity · Power & Energy Cybersecurity · Utility Audit & Incident Readiness · Assessment preparation and deliverables guides
Prepare for a Maritime Cybersecurity Assessment · Maritime Assessment Deliverables Preview · Power & Energy Cybersecurity Assessment Cybersecurity for power generation, electric networks, renewables and storage. Prepare the scope, operating constraints and available records. See the assessment outputs and how findings support corrective work. Agree assets, access, safety constraints and relevant requirements. See the reports, access findings and recovery recommendations.
Agree the evidence behind a security finding
An assessment identifies coverage and weaknesses; a penetration test validates selected attack paths within written authorization. The agreed scope specifies targets, starting access, excluded providers, permitted actions and stop conditions.
- A finding record should identify the affected asset, access required, observation, evidence, consequence and suggested action.
- An illustrative authenticated portal finding can distinguish demonstrated access to another role's record from an untested wider consequence.
- Retesting records the corrected target and result against the original evidence. Assets not reachable or not retested remain visible.
- Monitoring, incident response, regulatory submission and implementation are separate commitments when they are outside the agreed assessment.
Discuss the proposed examiner's relevant experience and a suitable report sample during scoping.
Talk with an examiner
Discuss your matter and next step
Tell us the systems, evidence and deadline. We can review relevant experience, potential conflicts and the scope before engagement.
Since 1992 · 24/7 dispatch · Court-tested experts