Electric co-ops and municipal utilities
The cyber side of your substations and SCADA, handled.
Your board, your insurance carrier, and, if you are registered, NERC all ask about cybersecurity. We do the assessment, the fixes, and the paperwork. Most of it is remote, and we don't touch a running relay or controller.
Who is asking
NERC, if you are registered
Low-impact sites fall under CIP-003: access controls, incident response, transient devices, and vendor remote access.
Who is asking
Your insurance carrier
The renewal questionnaire asks about remote access, a second login step, and whether the operations network is separate.
Who is asking
Your board or council
Wants to know where the utility stands, on one page.
What we do
Assessment, plan, fixes, and the paperwork.
| Assessment | Substations, SCADA, the metering head-end, and every remote path into them, including vendors. |
| CIP-003 plan and evidence | For registered entities with low-impact sites. Written to what your Regional Entity audits. |
| Fixes | Remote access locked down, a second login step, the operations network separated, vendor access with an off switch. |
| Incident response plan | Who calls whom, and what gets reported, sized for a utility your size. |
| Ongoing coverage | Monitoring, a quarterly review, and documentation kept current for the next audit or renewal. |
The Department of Energy runs a cybersecurity grant and technical assistance program for rural and municipal utilities. We tell you what it can pay for before you budget.
Cities that run water and power
One engagement covers both utilities: the water plant, the substations, and the shared network between them. One report to the council.
How the work is done
Remote by default. Your staff or your local IT provider are the hands on site. Our engineers do the analysis, and a senior engineer reviews every report before it goes out. We don't run active scans against live operations systems.
What we won't do
Protection engineering or relay settings, physical security, or filings with your Regional Entity. You file. We get it ready.
What it costs
A set price, quoted before you sign.
Priced by the number of substations and SCADA sites. One call to count them, and you get a fixed number. No hourly billing and no change orders.
Who you get
Twenty-five years inside plants, at a set price.
A method run on more than 500 live plants, written down so it comes out the same every time, whoever runs it. A senior control-system engineer signs off on your report before it leaves the building.
25+ yrs
inside live plant control systems
500+
plant-safe assessments and penetration tests worldwide
4,500+
people trained on plant cybersecurity
A founding contributor and editor of ISA/IEC 62443 and the early NERC CIP standards.