Independent technical practice
Critical Infrastructure & OT Security
Choose the technical assessment, control validation or forensic-readiness work your operations need. GDF connects supported findings to operating consequences, corrective actions and the evidence for the next decision.
Agree responsibilities before assessing the systems
The owner or responsible entity determines applicable obligations and approves system access, safety limits, test windows and production changes. GDF supplies the agreed observations, findings and retest evidence; any formal attestation, agency approval or specialized role requires its own confirmed authority.
Identify the applicable requirement, control and supporting record when requesting framework-related work. PCI, HIPAA, DFARS, SEC, DISA and FedRAMP have different purposes and requirements. Confirm the relevant qualifications and technical scope before commissioning that work.
Who we serve
- Utilities
- Water Authorities
- Energy
- Transportation
- Municipalities
- Electric Co-operatives
Scope
What we deliver
-
OT Assessment
Asset inventory, exposure analysis and prioritized remediation for operational technology.
-
SCADA Security Review
Protocol, remote-access and vendor-connection review of control systems.
-
Network Segmentation Review
Validation that IT and OT are actually separated, not nominally separated.
-
Incident Response Review
Testing the plan against a realistic scenario before an operator has to use it.
-
NERC CIP technical evidence support
Gap analysis and evidence packaging for audit readiness.
-
Executive Briefing
One session that gives the board a defensible view of operational cyber risk.
Nothing touches production without written agreement and an operations-approved window.
Methodology
How the engagement runs
-
Scope
Define the systems, sites and constraints. Nothing touches production without written agreement.
-
Assess
Passive discovery first; active testing only where it is safe and authorized.
-
Validate
Confirm findings with operators and engineers so nothing rests on assumption.
-
Report
Findings ranked by operational consequence, not by CVSS score alone.
-
Brief the board
A plain-language session on what the risk is, what it would cost, and what to do first.
What counsel receives
A file another examiner could pick up.
The record separates observed configuration, validated exposure and operational consequence without treating a live plant as a laboratory.
Safety and availability constraints remain part of the finding, not a footnote added after testing.
- Scope letter and stated assumptionsWhat was asked, what was examined, what was out of scope, and the assumptions the analysis rests on.
- Evidence handling recordAcquisition details, hash values, storage and transfer, and a chain-of-custody log for each item.
- Methodology statementTools, versions and procedures described so a second qualified examiner can repeat the work.
- Findings, separated from interpretationObserved facts first; expert opinion identified as opinion, with the basis for each conclusion.
- Limitations and unresolved questionsWhat the evidence cannot show, what was unavailable, and what further work would be required.
- Exhibits and supporting materialExtracted artifacts, timelines and schedules in a form that can be attached to a filing or a board pack.
- Operational constraints registerSafety, availability and process limits that shaped testing, and the risks accepted to keep the plant running.
Assessment outputs
An operational evidence record
A scoped engagement records the systems reviewed, access paths, observed conditions, limitations and corrective actions. Management receives the operating consequences; engineering receives restricted technical evidence and verification criteria.
Credentials & standards
- OT and ICS engagements for utilities and public authorities
- NERC CIP evidence-ready deliverables
- Passive-first assessment methodology
- Findings ranked by operational consequence
Field context
Assessment beyond the checklist
How security testing changes when physical processes and older control systems are involved.
Why control systems stay exposed
SCADA estates supervise pumps, valves, motors and PLCs across energy, water, power generation and processing. Much of that equipment was commissioned when security was not a design consideration, so the operating environment combines outdated platforms, physically accessible access points and bolt-on controls that do not integrate cleanly with what is already installed. Documented incidents at water utilities have turned on weak credentials and insider access rather than sophisticated capability.
Harden first, then test
Agree the assessment sequence with the operator according to the objective and safe operating constraints. A baseline test can precede remediation where authorized; a separate retest documents specified changes. Framework-related work supplies scoped technical gap and evidence support, not program certification, legal compliance or an agency authorization.
Both attack vectors, and the plant around them
Security is assessed against the insider path and the external path together, and against the organization as it actually exists, including its physical plant, personnel, networks and equipment, rather than against a control list. Assessment, planning, testing, validation and, where it becomes necessary, response and remediation are treated as one continuum instead of separate purchases.
Frequently asked
Common questions
Will testing disrupt operations?
Assessment begins with available records and approved passive methods. Any active validation requires written targets, methods, operating windows, stop conditions and recovery arrangements agreed with operations and engineering. Unsuitable methods are excluded; no assessment can eliminate every risk of disruption.
Do you work within NERC CIP evidence requirements?
Yes. Deliverables are structured so findings and remediation records can be used directly in audit evidence packages, rather than rewritten for the auditor afterwards.
Can you support an active incident?
Yes. The 24/7 hotline reaches an examiner, and retainer clients receive a priority response commitment with responders who already know the environment.
Talk with an examiner
Discuss your matter and next step
Tell us the systems, evidence and deadline. We can review relevant experience, potential conflicts and the scope before engagement.
Since 1992 · 24/7 dispatch · Court-tested experts
Talk with an examiner
Discuss the matter and the next step.
Tell us what happened and what you need to find out. Speak with a GDF expert about how we can help.
24/7 hotline: 1-800-868-8189
Choose the assessment path for your operating environment
Maritime facilities and terminal operators
Assessment scope, vendor access, plan-support evidence and recovery questions for shoreside operations.
Water and wastewater operators
Treatment dependencies, remote access, recovery and the evidence for the applicable program.
Utility and energy operations
IT/OT boundaries, technical audit support and forensic readiness under a defined scope.