Energy and utility leaders should rank cyber risk by what it can do to the physical process, then work backward to the IT, third-party and remote-access paths that reach it. The question that matters is whether you can keep operating safely when those paths are compromised.
Two ways an attack reaches operations
The first is indirect. A compromise of business IT systems forces operators to stop the physical process, even though the control systems were not touched. In the Colonial Pipeline ransomware incident, the company halted pipeline operations as a precaution after its business systems were hit. Federal advisories on the DarkSide group describe the intrusion and the ransomware. The lesson is that billing, scheduling and shared services can be a single point of failure for operations.
The second is direct. In the attacks on Ukrainian electricity distribution, attackers gained remote access and operated control systems themselves. Later malware was built to speak industrial protocols directly. Few operators face an adversary of that capability, but the access route is a familiar one: remote connections and credentials.
A third pattern is quieter. US and allied agencies have reported that China state-sponsored actors known as Volt Typhoon maintained persistent access in critical infrastructure networks, including energy, using valid accounts and built-in tools rather than malware. Detection therefore depends on spotting unusual behavior, not known signatures. The agencies assessed the aim as the ability to disrupt, not immediate disruption.
Where exposure concentrates
| Exposure | Why it matters for operations | Decision to settle |
|---|---|---|
| IT and OT boundary | Shared directory services, remote access and flat network paths let an IT incident reach control networks. | Which services are allowed to cross the boundary, and who can cut the link in an incident. |
| OT asset visibility | Operators often cannot say exactly what is connected, at which sites, running what software. | A usable inventory, built from passive monitoring where active scanning could disturb equipment. |
| Vendor and integrator remote access | Equipment makers and maintenance contractors often hold standing connections into control environments. | Time-limited, monitored, approved access, with no permanent vendor tunnels. |
| Engineering workstations and project files | These hold the logic for controllers and can change process behavior. | Protected access, controlled change, and offline copies of known-good configurations. |
| Recovery of control systems | Restoring servers is not the same as restoring a safe process. | A minimum safe operating mode, and proof you can reach it. |
| Distributed and edge assets | Substations, metering, distributed energy resources and remote sites are numerous and thinly staffed. | Which edge assets carry real consequence, and a tailored control baseline for them. |
Priorities, in order
1. Control the IT and OT boundary. Remove shared dependencies that let a business-network compromise stop operations. Use IEC 62443 concepts of zones and conduits as the design reference.
2. Close standing third-party access. Replace permanent vendor connections with approved, time-limited, recorded sessions.
3. Build the asset picture. Start with the sites and processes where failure has the greatest consequence, and extend from there.
4. Prove you can operate degraded. Decide what a minimum safe operating mode is, whether manual operation is possible, and how long it can last. Then exercise it.
5. Be able to rebuild control systems. Keep offline, tested copies of controller logic, engineering workstation images and network configurations.
Cautions that are specific to OT
-
Active scanning and patching on live control systems can disrupt the process. NIST SP 800-82 supports measures chosen for the environment, such as passive monitoring and testing before deployment.
-
Security fixes follow outage windows and vendor qualification, not the IT patch cycle.
-
Safety instrumented systems are designed to be independent. Security changes must not weaken that independence.
-
A plan that depends on the corporate network being available is not a plan for a ransomware incident.
Regulatory and standards context
| Regime or standard | What it asks that affects priorities |
|---|---|
| NERC CIP (North America) | Mandatory cyber security standards for the bulk electric system, including asset categorization, access management, and incident response. |
| EU NIS2 Directive | Energy sector entities are within scope, with risk management measures, supply chain security and incident reporting. |
| TSA pipeline security directives (US) | Requirements for owners and operators of designated pipelines, including cyber incident reporting and network segmentation. |
| IEC 62443 | A reference series for industrial automation security, covering zones and conduits, and requirements for suppliers and integrators. |
| NIST SP 800-82 | Guidance on securing operational technology, including architecture and the differences from IT security. |
| GCC and other regions | Sector regulators and national authorities set their own requirements. Confirm which apply to each asset and jurisdiction. |
Indicators worth reporting
-
Number of paths between IT and OT, and how many have an owner and a justification.
-
Share of vendor remote access that is time-limited and recorded.
-
Share of critical sites with a current asset inventory.
-
Whether the minimum safe operating mode was exercised, and how long it held.
| **** |
|---|
Sources
-
Cybersecurity and Infrastructure Security Agency and FBI, DarkSide Ransomware: Best Practices for Preventing Business Disruption. cisa.gov cisa.gov
-
Cybersecurity and Infrastructure Security Agency and partners, PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. cisa.gov cisa.gov
-
Cybersecurity and Infrastructure Security Agency, Alert on cyber-attacks against Ukrainian critical infrastructure and related ICS-CERT analysis. cisa.gov
-
National Institute of Standards and Technology, Guide to Operational Technology (OT) Security, SP 800-82. nist.gov csrc.nist.gov
-
International Electrotechnical Commission, IEC 62443 series, Security for industrial automation and control systems. iec.ch syc-se.iec.ch
-
North American Electric Reliability Corporation, CIP Reliability Standards. nerc.com nerc.com
-
European Union, NIS2 Directive on measures for a high common level of cybersecurity. eur-lex.europa.eu eur-lex.europa.eu
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionManage Cyber Risk & ExposureKnow what attackers can reach and what it would cost.See how we work →Related service
Cyber Risk & Governance
Use this industry view to prioritize Energy and Utilities cyber-risk decisions.