Control System Cyber Security
A distributed control system is not an IT system. It cannot be patched on Tuesday, it cannot be rebooted for an update, and the vendor's supported release may be years behind what the IT department considers current. The consequence is that plant control systems drift out of support and stay there.
We treat this as part of the maintenance scope, not as a project.
What we do
Keep assets at a supported release level. Vendor lifecycle tracking for the installed DCS, ESD and historian software, with an upgrade path planned against the plant's outage schedule rather than against a calendar.
Patch and release management. What can be applied online, what requires a shutdown, what the vendor has validated, and what has to wait. Recorded, so that the answer to "what version is running" does not depend on who is on shift.
Backup and recovery. A backup regime for every control system asset that allows a system to be restored quickly enough to keep the plant running after a failure. Tested by restoring, not by checking that the job completed.
Separation. Segregation between the control network and the business network, and control of the paths that necessarily cross it — engineering workstations, historian data flows, remote access for support.
Remote access. Where we provide remote support, the access path is part of what we secure, not an exception to it.
Telecontrol links are part of the plant
A remotely operated plant is operated over somebody else's network. The VPN tunnel provided by a telecom operator is, from the plant's point of view, a piece of the control system that nobody on site can inspect.
We treat the telecontrol subsystem as testable:
Redundancy proved by failure. Channels disconnected one at a time, then in combinations, with the unit running, checking that transfer is bumpless and that remote monitoring survives each case.
Command filtering at the edge. On the unattended hydro plant we operate remotely, the remote station may start and stop the unit, set load, load the daily schedule and select the control algorithm. Every other command is rejected in the communication controller at the plant end. A whitelist in the controller that terminates the link is worth more than a firewall rule somewhere upstream, because it survives a compromise of everything above it.
Behaviour on total loss. What the plant does when the link to the dispatching centre is gone entirely, and for how long it is allowed to continue without one.
Resistance to interference. Testing the telecontrol subsystem against deliberate attack is a specialist exercise and is normally outside the competence of the commissioning team, our own included. Where it is needed we say so and specify what has to be brought in, rather than leaving it out of the programme because nobody present can do it.
Unattended hydro plants and the telecontrol testing we apply on them are described under Remote Operation of Unattended Hydro Plants.
Regulator-facing security assessment
Classifying an operational technology system against a national critical infrastructure regime is paperwork with teeth: the categorisation decides what the operator has to do for the life of the plant, and it is submitted to a regulator who can disagree.
We have prepared that dossier for the control system of a hydro plant — system purpose and architecture, the networks it touches and how, the hardware and software inventory down to controller and operating system level, which protection mechanisms are in place, the attacker categories considered and why, the threats assessed as applicable, the types of computer incident the system could suffer, and the significance criteria with the reasoning behind each value.
The regime was not the EU one, but the exercise is the same one an operator faces under NIS2 and the same inventory an IEC 62443 assessment starts from. Having done it on an operating plant is the difference between describing the method and having defended the answers.
Products with digital elements
Regulation (EU) 2024/2847, the Cyber Resilience Act, obliges manufacturers of products with digital elements to report an actively exploited vulnerability within 24 hours of becoming aware of it, and to file a full notification within 72. From 11 September 2026, manufacturers of products with digital elements must report an actively exploited vulnerability within 24 hours of becoming aware of it and file a full notification within 72. Notifications are submitted through the CRA Single Reporting Platform, operational from the same date.
We built and operate that procedure for our own product line: reporting roles, the awareness timestamp that starts the clock, an incident register, CycloneDX SBOM generation in the build pipeline, monthly reconciliation against published vulnerability sources, and a coordinated disclosure policy. This is described in more detail under Compliance and Testing.