OT, ICS and SCADA Security, Incident Response and Forensics for Operators
Cybersecurity for the Systems That Cannot Go Down
Electric, water, energy and transportation systems cannot be taken offline to test, patch or examine, and the paths an intruder would use rarely appear on the drawings. Global Digital Forensics maps those paths passively first, validates segmentation and remote access inside the windows your engineers approve, and responds to incidents with containment planned alongside the engineers who run the process. Every finding is ranked by operating consequence and documented for the regulator and the board.
For utility operators, ISOs and industrial security teams
The Work We Do for Operators, Grouped by the Question
Start with the question your operation needs answered and open the service page behind it. Each one explains the scope, the evidence sources and the deliverables.
OT, ICS & SCADA assessments
Passive first asset discovery, segmentation validation and testing planned around safety and uptime.
Regulatory evidence
NERC CIP audit evidence organized around the requirements that actually apply to your assets.
Incident readiness & response
OT incident response and forensic reconstruction that preserves the evidence while the process is restored.
The initial consultation is free, and a senior specialist sets the scope with you on the first call.
Exposure
What Disrupts the Operation Rarely Appears on the Diagram
Operational technology was designed for availability and a long service life, not for authentication and patching. Controllers, historians and engineering workstations commonly run software generations behind the corporate estate, and the maintenance window in which anything can change is narrow and scheduled around load.
Segmentation is the recurring finding. Business networks, vendor remote access, shared credentials and dual homed jump hosts create paths between the IT estate and the control environment that appear on no drawing, and those paths are usually found during an assessment rather than during a design review.
Third parties compound both problems. Integrators, equipment vendors and managed service providers hold standing access to control environments, often through tooling the operator does not monitor, and an incident inside a supplier becomes an incident inside the plant without anyone crossing the fence line.
For independent audit work, evidence at the IT and OT boundary and response arrangements agreed in advance, explore utility OT assurance and forensic readiness.
Scoping
Questions the Engagement Must Answer Before Anyone Connects
- Which assets can be tested live, and which require passive or lab based methods?
- Where does the boundary between the IT network and the control environment actually sit?
- If a control system is compromised, what is the safe sequence for containment?
- What evidence would survive an outage, and what is lost when systems are restarted?
- What must be reported, to whom, and on what clock?
Services
How We Help Operators Keep the Process Running
-
Critical Infrastructure & OT Security
OT and ICS assessment, SCADA review, segmentation testing and response readiness for live environments, with methods approved by the engineers who run them.
-
Incident Response SLA
Responders who already hold your network information and contacts before the call is made, so the first hour is spent containing rather than orienting.
-
Executive Cyber Risk Advisory
Risk findings organized for a utility board, a commission or a municipal authority to review and act on.
-
Digital Forensics and Expert Witness Testimony
Forensic examination and testimony when an incident becomes a regulatory proceeding or a legal matter.
Context
The Regulatory Context an Operator Is Measured Against
- NERC CIP
- Bulk electric system operators carry mandatory reliability standards for asset identification, access control, monitoring and incident reporting, and the evidence of compliance has to be producible on request.
- TSA security directives
- Pipeline and rail operators are subject to federally directed cybersecurity requirements covering segmentation, access control, monitoring and incident response planning.
- State public utility commissions
- State regulators increasingly ask for demonstrated cyber program maturity and incident reporting as part of rate and reliability oversight.
- Water and wastewater oversight
- Federal and state authorities have pushed drinking water and wastewater systems toward formal cyber risk assessment and response planning, particularly where control systems can be reached remotely.
Applicability depends on sector, size and jurisdiction, so we scope each assessment against the regimes that actually bind your assets and map every finding to the requirement it affects.
Not certain whether a regime binds a particular asset? Ask a senior examiner to scope against the one that does before the assessment plan is written.
Related case study
A Business Systems Examination for a Regulatory Review
When a state regulator reviewed a regulated company, GDF examined the systems that ran the business and reconciled them with interviews and public records, the same systems and records work a utility regulatory review calls for.
Corporate Investigation
Match the Assessment to the Process That Must Keep Running
Start with the process that must keep operating and the decision its owner needs to make. A treatment plant, a substation and a terminal can share the same remote access technology while requiring different outage approvals, different engineering participants and different recovery evidence, and the assessment plan has to reflect that from the start.
For a port or terminal, we identify the cargo and access dependencies, the vessel facing interfaces and the facility operator responsible for approving tests. For water or wastewater, we identify the treatment dependencies, the operator workstations, the vendor access paths and which observations can be made without changing a process.
For power or energy, we identify the control boundary, the electrical participants and the permitted outage or restoration window before any validation begins. For an assurance or incident readiness question, we ask for the exact obligation, the control owner and the retained evidence period, so the gap register answers that question rather than a generic one.
A dependency row in the assessment record connects a vendor access path to an operator workstation, the process it supports and the approved observation window. The record identifies what was observed, what was supplied and what was inaccessible, then assigns the next decision to the operator or the qualified specialist.
The service pages behind these engagements set out each scope in full: the maritime terminal assessment for ports and vessel facing interfaces, the water and wastewater treatment scope, the power and energy operating scope for generation, electric networks, renewables and storage, and utility control evidence and readiness for the assurance and incident readiness questions.
Operators who want to prepare before the first call can work from the source and delivery record guides, including how to prepare for a maritime cybersecurity assessment and the maritime assessment deliverables preview, how to prepare for a water and wastewater assessment and the water and wastewater deliverables that show how findings support corrective work, and how to prepare for a power and energy assessment alongside the power and energy deliverables with their reports, access findings and recovery recommendations.
Call (800) 868-8189 and tell us whether it is a terminal, a treatment plant or a substation; a senior examiner will name the approvals and participants the plan needs.
Aviation, Rail, Road and Surveillance Systems
The same passive first discipline covers transportation and security infrastructure. GDF performs a great deal of FAA and EASA airworthiness penetration testing across avionics, aircraft networks, in flight connectivity and ground systems for aviation cybersecurity and airworthiness penetration testing, and audits and tests large camera and video management estates through surveillance system security audits. Rail, maritime and road operators can start with railroad ATCS cybersecurity, vessel cybersecurity assessments or traffic control systems cybersecurity.
Ask on the first call for the relevant examiner experience and a sample of the assessment record for your kind of operation, and we will walk you through both at no charge.
Gather records before an engagement
Records an OT Assessment or Utility Audit Requests
Operators are asked for the same facts at the start of every assessment: system boundaries, who owns which asset, the dependencies that keep the process running and the records that show a control operates. The guides below help your team gather them, assign owners and write down the questions for the specialist who will review them.
Every guide is free to read online. A download asks for a work email and company, which you may skip, and the file starts immediately.
Discuss your assessment scope
Water and Wastewater OT Assessment Preparation
Gather system boundaries, ownership facts, operating dependencies and the records a water or wastewater assessment will draw on.
File: Fillable PDF planning pack.
Download the Wastewater Planning Guide (PDF)
Prepare the operating scope, responsible staff, evidence records and sector questions before an assessment discussion.Power and Energy OT Assessment Preparation
Organize facility facts, system scope, responsibilities and evidence for planning a power or energy assessment.
File: Fillable PDF planning pack.
Download the Power and Energy Planning Guide (PDF)
Prepare the operating scope, responsible staff, evidence records and sector questions before an assessment discussion.New York Utility Audit Preparation Package
Keep utility oversight, DFS applicability and private information questions separate while you gather the supporting records.
File: ZIP: PDF, XLSX workbook and CSV records.
New Jersey Utility OT Audit Preparation Package
Gather water, wastewater, electric or gas utility facts, evidence and owner decisions, with 18 tracked open questions to work through.
File: ZIP: PDF, XLSX workbook and CSV records.
Security Assessment and Penetration Testing Preparation
Record the proposed scope, the owners, the safety boundaries and the permissions before any audit, security assessment or physical or cyber testing begins.
File: Editable CSV preparation checklist.
Browse all preparation packages by subject.
When the drawings and the asset owners are in hand, describe the process that must keep running and a senior examiner will tell you which records the assessment will actually draw on.
Talk with an examiner
Talk With the Examiners Who Work Control System Matters
Tell us the operation, the process that must keep running and the deadline. A senior security lead will call or write back promptly to discuss the approvals, the testing depth and the timeline, and the first conversation is free.
Since 1992 · 24/7 response · Court tested experts
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .