Critical infrastructure deserves critical engineering
Energy & Utilities
What the compliance landscape actually demands.
NERC CIP — Critical Infrastructure Protection — is the mandatory regulatory framework for bulk electric system operators, covering generation, transmission, and distribution facilities meeting the BES asset classification threshold. NERC CIP is not a single standard: it is a collection of 13 standards (CIP-002 through CIP-014) addressing different dimensions of critical infrastructure protection. CIP-002 requires identification and categorization of BES Cyber Systems. CIP-005 requires Electronic Security Perimeters — defined network boundaries segregating BES Cyber Systems from other networks, with specific requirements for interactive remote access that most OT-IT convergence architectures violate without intending to. CIP-007 requires system security management including patch management, port and service control, and malware prevention on BES Cyber Systems. CIP-013 requires supply chain security risk management. Violation fines reach $1 million per violation per day — and NERC's enforcement record shows that auditors are finding violations at utilities that believed they were compliant. TSA security directives for pipeline operators, issued following the Colonial Pipeline attack, impose analogous requirements under different regulatory authority. IEC 62443 provides the technical standard for industrial automation and control system security that underpins both NERC CIP and TSA directive compliance in OT environments.
NERC CIP compliance on paper and NERC CIP security in production are two entirely different states — and adversaries are exploiting the gap at a rate of 1,162 attacks on US utilities in 2023 alone.
1,162 cyberattacks on utilities in 2024 — 70% increase year over year. Grid vulnerability points growing by 60 per day. $174B in capital expenditure with 'patchy returns' on digital transformation. Utilities are spending massively and getting mediocre results from legacy vendors and Big 4 consultants.
Talk to an Engineer →
First call is a senior engineer — not a sales team. We understand your regulatory environment before we write a line of code.
Start a ConversationWhere Incumbents Fall Short
The US electric grid was attacked 1,162 times in 2023 — a 70% increase year over year, with vulnerability points growing by approximately 60 per day as grid edge devices proliferate. Most of these attacks targeted operational technology infrastructure running on unpatched systems, communicating over unencrypted protocols, and connected to corporate IT networks through inadequately controlled access points. NERC CIP compliance does not equal security: a utility can satisfy every NERC CIP control on paper while maintaining undetected persistent adversary access through attack vectors the NERC CIP standards don't address. The $174 billion capital expenditure cycle in US energy is creating new technology integration requirements at the grid edge — wind, solar, battery storage, EV charging infrastructure. FERC Order 2222 requires these distributed energy resources to participate in wholesale electricity markets, demanding new technology platforms for DER aggregation, dispatch, and settlement that must integrate with legacy SCADA systems and satisfy NERC CIP security requirements simultaneously. The OT-IT convergence that enables these capabilities creates compliance boundary questions that engineering teams with IT backgrounds routinely miss: is the newly connected system inside the Electronic Security Perimeter? Does it qualify as a BES Cyber Asset? What interactive remote access controls apply?
How We Approach Energy & Utilities
The Algorithm approaches energy and utilities engagements with NERC CIP compliance at the control layer — not the documentation layer — as the defining engineering requirement. BES Cyber System classification analysis begins at the architecture phase, with every connected component evaluated against the NERC CIP-002 categorization criteria before network topology decisions are finalized. Electronic Security Perimeter design follows CIP-005 requirements with documented interactive remote access controls that satisfy CIP-007 requirements — including the authentication, encryption, and session monitoring requirements that most legacy remote access implementations do not meet. OT-IT connectivity is designed with the Electronic Security Perimeter boundary explicitly defined, documented, and enforced rather than assumed. For utilities implementing DER aggregation under FERC Order 2222, the platform architecture addresses both the FERC market participation technical requirements and the NERC CIP security requirements for the control systems involved. IEC 62443 security levels are applied to OT system design, providing the defense-in-depth architecture that NERC CIP and TSA directives require but do not fully specify. Anomaly detection is implemented at the control system layer — not just at the IT network perimeter — because adversaries who have penetrated the OT environment are not visible to IT-layer monitoring tools.
What Success Looks Like
A successful engagement delivers SCADA security architecture that satisfies NERC CIP requirements at the control layer — with evidence packages organized for NERC audit, not just policy documentation. Electronic Security Perimeter boundaries are defensible. Interactive remote access controls satisfy CIP-007. Supply chain security risk management satisfies CIP-013. Anomaly detection identifies suspicious activity in OT environments before it becomes an operational event. For DER aggregation engagements, the platform participates in FERC Order 2222 wholesale markets with NERC CIP compliance maintained throughout the operational environment. The security team can demonstrate compliance with evidence from production systems rather than documentation exercises. The operations team trusts the infrastructure because it was designed for the OT environment — not adapted from an IT security framework.
Duration: 8 - 16 weeks
Output: Production system + audit documentation
A utility securing critical infrastructure typically engages at Tier II — NERC CIP native, production in months.
What We Deploy in Energy & Utilities
Energy & Utilities Compliance Assessment
A structured checklist for evaluating your AI and software vendor's readiness across the key regulatory frameworks in Energy. Free — no email required.
Download PDF →Ready When You Are
Working in Energy & Utilities?
We've deployed teams in this environment. First call is a senior engineer.