Energy & Utilities
We find out whether your office and control networks, remote access and field devices are safe from attackers, under strict written scope. Control networks keep the lights on, and they were never designed to face the internet. We separate operations from the office, monitor what is there and keep the way in narrow and logged.
Electric, gas and water utilities run some of the most important networks there are. Their control systems were designed for reliability and for isolation that has slowly eroded as the business asked for data. Today a compromise in the office can be a short step from a substation or a pumping station, and the consequences are measured in service, not in files.
Our team applies IEC 62443 to utility networks: an inventory built passively, zones and conduits with target security levels, industrial firewalls that understand control protocols, one-way gateways where the risk calls for them, and remote access that is narrow, authenticated and recorded. We plan every change with operations, so safety and availability come first.
What we see in your industry
- Control systems last for decades and speak protocols with no built-in security. They cannot be patched on a typical schedule, so the network has to protect them.
- Operations need data in business systems, and security needs no path back. IEC 62443 zones and conduits, plus one-way gateways where the risk justifies them, give both.
- Remote access by vendors and engineers is the most common way in. It has to be time-limited, authenticated with multiple factors and recorded.
- Availability comes first. Anything we add must be passive until it is proven, and every change needs a rollback plan agreed with operations.
Inventory comes first. We listen on taps and SPAN ports to learn every device and conversation, because scanning fragile controllers is a risk of its own. The Purdue model gives the team a shared map.
Zones and conduits come second. Under IEC 62443-3-2 each zone has a target security level and a short list of permitted protocols, such as DNP3, IEC 60870-5-104, IEC 61850 and Modbus/TCP, so any other traffic stands out.
One-way flow comes third. A unidirectional gateway lets telemetry, alarms and logs leave the control zone while physically preventing anything from entering. Updates and vendor files come in through a scanned transfer station.
Access and recovery come last. Remote sessions pass through a hardened jump host with multi-factor authentication and session recording, and a rehearsed runbook can isolate a site by cutting one conduit. See our guidance on OT and ICS security for manufacturers and our ransomware readiness checklist.
Every industry's reference library and routine can run offline. Our Apocalypse IT Package is an on-premises continuity kit with a local reference library, document scanning, a private AI desk, chat and battery backup, offered to every customer.
Related work on our track record: a regional utility's IEC 62443 zones and data diode (illustrative) and a textile factory's production-floor automation.
OT and ICS Security for Manufacturers: A Practical Guide Based on NIST SP 800-82 Rev. 3 and CISA Guidance
Plant-floor systems were built for uptime and safety, not for the internet. NIST SP 800-82 Rev. 3 and CISA's 2025 joint guidance give manufacturers a clear order of work: get controllers off the internet, change default passwords, lock down remote access, separate IT from OT, and keep the ability to run by hand.
Work like yours
How we help
Managed IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreCybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreClayton Secure
One view of your entire cybersecurity program, in near real time.
Learn moreCyber Automation
Custom AI agents that do repetitive work around the clock, with human review where it matters.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWhy can't control systems just be patched like office computers?
They last for decades, speak protocols with no built-in security and often cannot take downtime. That is why the network has to protect them, through separation, narrow permitted flows and monitoring, rather than relying on a normal patch schedule.
What are IEC 62443 zones and conduits?
Zones group assets with similar security needs, and conduits are the controlled paths between zones. Each conduit allows only listed protocols. They let operations feed data to business systems without opening a general path into the control room.
What is a unidirectional gateway?
A hardware data diode that sends data one way only, usually optical transmit on the control side. It replicates historian data and alarms outward and physically cannot carry traffic back. We recommend it where the risk justifies the cost, not everywhere.
How do you secure vendor and engineer remote access?
Remote access is the most common way in, so it is time-limited, authenticated with multiple factors and recorded. Access runs through a hardened jump host in a DMZ rather than direct paths to control systems.
Will your monitoring disturb our operations?
We start passive, learning from taps or mirrored ports instead of scanning, and add nothing until it is proven. Availability comes first, and every change needs a rollback plan agreed with operations.
Do you design for ransomware that starts on the corporate network?
Yes. The aim is that ransomware on the corporate side has no network path into operations, and that isolating a site is a rehearsed, short procedure. We recommend a tabletop exercise to test it.