Independent technical practice
Security for systems that cannot go down
Reviewed and approved by Bob Knudsen. .
OT, ICS and SCADA work planned around service continuity, operating constraints and public safety.
For utility operators, ISOs and industrial security teams
The work we do for this sector
Grouped by matter type. Each link opens a service page with the scope, evidence sources, deliverables and limits.
OT, ICS & SCADA assessments
Passive-first asset discovery, segmentation validation and safety-conscious testing.
Regulatory evidence
NERC CIP audit evidence organized around the applicable requirements.
Incident readiness & response
OT incident response and forensic reconstruction with evidence preservation.
Exposure
What can disrupt the operation
Operational technology was designed for availability and long service life, not for authentication and patching. Controllers, historians and engineering workstations frequently run software generations behind the corporate estate, and the maintenance window in which anything can be changed is narrow and scheduled around load.
Segmentation is the recurring finding. Business networks, vendor remote access, shared credentials and dual-homed jump hosts create paths between IT and OT that are not on any diagram, and those paths are usually discovered during an assessment rather than during design review.
Third parties compound both. Integrators, equipment vendors and managed service providers hold standing access to control environments, often through tooling the operator does not monitor, and an incident inside a supplier becomes an incident inside the plant without anyone crossing the fence line.
For independent audit work, IT/OT boundary evidence and response arrangements, explore utility OT assurance and forensic readiness.
Scoping
Questions the engagement must answer
- Which assets can be tested live, and which require passive or lab-based methods?
- Where does the boundary between the IT network and the control environment actually sit?
- If a control system is compromised, what is the safe sequence for containment?
- What evidence would survive an outage, and what is lost when systems are restarted?
- What must be reported, to whom, and on what clock?
Services
How we help
-
Critical Infrastructure & OT Security
OT and ICS assessment, SCADA review, segmentation testing and response readiness for live environments.
-
Incident Response & Retainer Programs
Responders who already hold your network diagrams and escalation tree before the call is made.
-
Executive Cyber Risk Advisory
Risk findings organized for a utility board, commission or municipal authority to review.
-
Digital Forensics & Expert Witness
Forensic investigation and testimony where an incident becomes a regulatory or legal proceeding.
Context
Regulatory context
- NERC CIP
- Bulk electric system operators carry mandatory reliability standards for asset identification, access control, monitoring and incident reporting, and evidence of compliance has to be producible on request.
- TSA security directives
- Pipeline and rail operators are subject to federally directed cybersecurity requirements covering segmentation, access control, monitoring and incident response planning.
- State public utility commissions
- State regulators increasingly ask for demonstrated cyber program maturity and incident reporting as part of rate and reliability oversight.
- Water and wastewater oversight
- Federal and state authorities have pushed drinking-water and wastewater systems toward formal cyber risk assessment and response planning, particularly for remotely accessible control systems.
Applicability depends on sector, size and jurisdiction; we scope assessments against the regimes that actually bind you.
Related case study
Insurance Company Case
Corporate engagement combining device forensics with employee conduct review.
Corporate Investigation
Match the assessment to the operating dependency
Start with the process that must keep operating and the decision its owner needs to make. A treatment plant, substation and terminal can share remote-access technology while requiring different outage approvals, engineering participants and recovery evidence.
- For a port or terminal, identify cargo and access dependencies, vessel-facing interfaces and the facility operator responsible for approving tests.
- For water or wastewater, identify treatment dependencies, operator workstations, vendor access and which observations can be made without changing a process.
- For power or energy, identify the control boundary, electrical participants and permitted outage or restoration window before any validation.
- For an assurance or incident-readiness question, supply the exact obligation, control owner and retained evidence period so the gap register addresses that question.
An illustrative dependency row could connect a vendor access path to an operator workstation, the process it supports and the approved observation window. The assessment record would identify what was observed, supplied or inaccessible, then assign the next decision to the operator or qualified specialist. It does not authorize electrical or treatment changes.
Maritime terminal assessment · Water and wastewater treatment scope · Power and energy operating scope · Utility control evidence and readiness · Prepare the source and delivery records
Maritime facilities and terminal operators · Water and wastewater operators · Prepare for a Maritime Cybersecurity Assessment · Maritime Assessment Deliverables Preview · Power & Energy Cybersecurity Assessment Cybersecurity for power generation, electric networks, renewables and storage. Prepare the scope, operating constraints and available records. See the assessment outputs and how findings support corrective work. Agree assets, access, safety constraints and relevant requirements. See the reports, access findings and recovery recommendations.
Read related case material by the work it demonstrates
The linked corporate investigation illustrates a forensic investigation. It is not evidence that an OT assessment, process-safety review or electrical test was completed. For an industrial engagement, request the relevant examiner experience and an agreed example of the assessment record before work begins.
Talk with an examiner
Talk with the team that works your industry
Tell us the matter, sector and deadline. We can discuss relevant experience and the technical scope.
Since 1992 · 24/7 dispatch · Court-tested experts
Talk with an examiner
Discuss the matter and the next step.
Call to discuss timing, scope and the safest way to share information. Do not send evidence or credentials by email.
24/7 hotline: 1-800-868-8189