Critical infrastructure, regulated access
Energy operates under access-control regulation with real penalties, and the evidence burden is specific: who has access to critical cyber assets, how was it authorized, and when was it last reviewed. Non-human identities are in scope and are the hardest part to evidence.
“Can we evidence access controls over critical cyber assets?”
How the risk takes shape.
Evidence is the deliverable
NERC CIP-004 and CIP-005 require demonstrable access management and electronic security perimeters. Audits ask for the list and its provenance — not an assurance that a process exists.
Monitoring identities span the perimeter
Condition monitoring, SCADA historians and analytics pipelines cross the boundary between operational and corporate environments by design, which makes their reach the thing to constrain.
Long asset lifetimes, short memories
Assets commissioned decades ago are integrated with modern cloud analytics. The identities doing the integrating were created by projects whose teams have since moved on.
What we look for first.
These are structural patterns this operating model tends to produce — not findings from any particular organization. They are where an assessment starts, because the architecture makes them likely.
Whether they are present in your estate is an empirical question. That is the point of looking.
- Historian and monitoring identities spanning operational and corporate scopes
- Vendor maintenance identities with standing access to asset management systems
- Analytics pipelines joining operational telemetry with customer usage data
- Legacy automation holding elevated roles with no current owner of record
Evidence, in your framework's language.
The reach set
Every identity that can reach your grid operations data, with the path each one takes — direct, inherited, nested, eligible or federated.
Control-mapped findings
Findings tied to the control families you evidence against — NERC CIP and NIST CSF — with the underlying facts attached.
One ranked decision
Not a backlog. The single highest-consequence move, with its projected outcome labeled as projected and its evidence trail intact.
Test these patterns against your own estate.
A scoped, read-only assessment on a subscription you choose. We answer the question above with your numbers, and tell you plainly where we could not determine something.
Free forever on a bounded estate · 30-day trial unlocks everything · No credit card
Read-only access · No agents · No log ingestion · Azure generally available