Energy and utilities cybersecurity for SCADA and grid OT
For electric utilities, grid operators and the SCADA/OT vendors that supply them. North American bulk-electric operators must meet the mandatory NERC CIP reliability standards, and EU utilities face NIS2 and related cybersecurity rules; both expect an asset inventory and evidence of what is exposed on the control network. SoftWSP's OT Snapshot builds that inventory from a passive capture of control-room traffic, without connecting to live equipment.
Regulations and standards that apply
- NERC CIP — Critical Infrastructure Protection standards. Mandatory, FERC-enforceable reliability standards for the North American bulk electric system: asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), configuration and change management (CIP-010) and more, published by NERC and currently maintained as an active standard set.
- NIS2 Directive (EU). Sets cybersecurity risk-management and incident-reporting duties for the energy sector, among other essential and important entities, across EU member states.
- NIST SP 800-82 Rev. 3 — OT security. A vendor-neutral baseline for OT/ICS networks — network segmentation, asset inventory, monitoring and incident response — widely used as a practical complement to CIP or NIS2 obligations.
- CISA Cross-Sector Cybersecurity Performance Goals (CPGs). A prioritized baseline of cybersecurity practices across critical infrastructure sectors, including energy, intended as a starting point rather than a substitute for sector-specific rules.
Typical device and firmware risks
- Authentication bypasses in SCADA/HMI software, as found in a real 2026 advisory on a utility SCADA platform.
- Legacy RTUs and protection relays running outdated firmware with no vendor patch path.
- No current inventory of which field devices, firmware versions and protocols (such as IEC 60870-5-104, DNP3 or Modbus) are actually on the control network.
- Remote-access tools and engineering workstations with flat access into the control network, with no segmentation from corporate IT.
- Vulnerable third-party libraries (such as outdated XML or database parsers) bundled into control-room and substation software.
Which SoftWSP service fits
OT Snapshot analyses a passive recording from a mirror port on your control-room or substation network switch and returns a device inventory, the published vulnerabilities affecting those devices, and a map of remote access — evidence CIP, NIS2 or a CPG self-assessment can point to. If you build the SCADA, RTU or protection-relay firmware itself rather than operate the network it runs on, Device & Firmware Security is the better fit.
Related
Frequently asked questions
What are the NERC CIP standards?
The NERC CIP (Critical Infrastructure Protection) standards are mandatory, FERC-enforceable reliability standards for the North American bulk electric system, covering areas such as CIP-002 (asset categorization), CIP-005 (electronic security perimeters), CIP-007 (system security management) and CIP-010 (configuration and change management), published and maintained by NERC.
Do NERC CIP standards apply outside North America?
No. NERC CIP applies to the North American bulk electric system under FERC's jurisdiction. Utilities elsewhere typically follow their own national or regional rules — in the EU, the NIS2 Directive sets cybersecurity risk-management and incident-reporting duties for the energy sector among other essential and important entities.
What does NIST SP 800-82 add for utility OT networks?
NIST SP 800-82 Rev. 3 is a vendor-neutral OT security baseline covering network segmentation, asset inventory, monitoring and incident response, useful as a practical complement to CIP or NIS2 obligations rather than a replacement for them.
What are CISA's Cross-Sector Cybersecurity Performance Goals?
A baseline, prioritized set of cybersecurity practices CISA recommends across critical infrastructure sectors including energy, version 2.0 published December 2025, intended as a starting point rather than a substitute for sector-specific rules like NERC CIP.
Does an OT Snapshot connect to live grid or SCADA equipment?
No. It analyses a passive recording your own engineer takes from a mirror port on a control-network switch. Nothing is sent into the network and no SCADA system is tested directly.
Sources
- NERC: CIP Standards (Critical Infrastructure Protection) — current standard set (read 29 Oct 2026)
- European Commission: The NIS2 Directive (read 29 Oct 2026)
- NIST CSRC: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security — final publication page (read 29 Oct 2026)
- CISA: Cross-Sector Cybersecurity Performance Goals, Version 2.0 (full report, December 2025, read 29 Oct 2026)