Power & Energy Cybersecurity Assessment

GDF works with the people responsible for cybersecurity, engineering and operations to review the agreed environment. The starting question might be whether a business-network incident could reach plant controls, whether a vendor's access can be revoked or whether records and backups would support recovery.

A project can focus on one connection, a plant change or a defined group of sites. Shared corporate services may be examined once, with site-specific records showing how each installation depends on them.

• Generation: plant control networks, engineering workstations, historian services and authorized remote support.
• Electric networks: selected substation, communications and control-center dependencies, with engineering authority and operational exclusions established first.
• Renewables and storage: site controllers, inverter-management interfaces, gateways, vendor services and fleet or aggregator connections included in the scope.
• Microgrids and district energy: the agreed generation, storage, building-control and supporting network connections.

These examples define questions to discuss at scoping. They are not a claim that every asset, protection system or specialist field service is included.

Review network records, account inventories, gateways, engineering access and relevant session evidence. Identify who approves a vendor connection, which systems it can reach, whether its use can be attributed and how access is removed.

Examine the services that cross a business-network and control-network boundary, including identity, communications, support and data collection. Compare intended restrictions with configuration records and specifically authorized validation. An architecture drawing alone does not show that a boundary holds.

Begin with interviews, existing diagrams, configuration records and approved passive evidence. Engineering and operations identify fragile systems, maintenance windows, stop-work contacts and recovery requirements.

Active testing requires explicit authorization for the system, technique, timing and operating conditions. A laboratory or representative asset may be the appropriate place to validate a concern. Excluded and untested areas remain visible in the report. Safeguards reduce risk; they do not guarantee that disruption is impossible.

The scope identifies any electrical, protection, process-control, OEM or integrator expertise the work needs. A general cybersecurity assessment does not authorize changes to plant logic, protection settings or live equipment.

Review the logs, time sources, account history and configuration records needed to understand a selected incident. Agree who can isolate a connection, preserve evidence and authorize further work while essential operating support is maintained.

Examine the backups, software versions, licenses, communications, vendor support and people needed to restore a selected function. A backup record is not a demonstration of successful restoration. A tabletop or representative restore exercise has its own approved scope and conditions.

• System and responsibility map: the facilities, operational dependencies, supporting services, vendors and authorized owners examined.
• Access and boundary findings: the observed condition, supporting records, affected operation and remaining uncertainty.
• Corrective-action register: responsible owners, agreed priorities and the evidence needed to assess a correction.
• Recovery and incident-readiness record: the selected dependencies, preservation responsibilities, exercise results and untested areas.
• Management and technical reports: decision-focused summaries and restricted detail for engineering and security teams.

Review the existing assessment and its open findings before ordering replacement work. Follow-up testing, engineering changes, independent audit and recurring reviews each have a defined scope.

NERC CIP work requires the responsible entity, registration, asset category, applicable requirement version and implementation dates to be established. Renewable generation and battery storage are not automatically outside the Bulk Electric System. A distribution or local energy asset is not automatically subject to the same requirements as a covered bulk-electric system.

DOE's distribution and distributed-energy cybersecurity baselines can inform technical reviews for those environments. They are guidance, not a universal federal compliance mandate. NIST's final Guide to Operational Technology Security addresses operating safety, reliability and performance alongside security.

For a defined NERC evidence assignment, see NERC CIP Audit Evidence Support. For New York utility IT audit and incident-readiness work, see Utility Cybersecurity Audit & Incident Readiness. Neither the general assessment nor a site visit automatically constitutes a formal regulatory audit or certification.

Official references checked October 7, 2026 (UTC): NERC CIP-015-2; NERC battery-storage and hybrid-resource guidance; DOE distribution and DER baselines.

Start with the facility type, general location, systems involved and the decision or timing the work must support. Identify the engineering, operations and security contacts who can authorize the assignment.

Keep network diagrams, credentials, detailed vulnerabilities and incident evidence out of the initial inquiry. Approved information exchange is arranged separately.

Discuss Power & Energy Cybersecurity