Energy & Utilities

Presidential Directive HSPD-7 for Critical Infrastructure Identification, Prioritization, and Protection broadened the definition of infrastructure in accordance with the Patriot Act, as the physical and virtual systems that are ‘ so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety.’

We take for granted the systems and networks that make up the infrastructure of society yet a disruption to just one of those systems can have dire consequences across other sectors affecting gas distribution, electrical power generation, shutting down computerized controls and communication networks which affect road traffic, air traffic affecting emergency services.

An entire region can become debilitated because some critical elements in the infrastructure become disabled through natural disaster.

The federal government has developed a standardized description of critical infrastructure, in order to facilitate monitoring and preparation for disabling events. The government requires private industry in each critical economic sector to:

• Assess its vulnerabilities to both physical or cyber attacks,
• Plan to eliminate significant vulnerabilities;
• Develop systems to identify and prevent attempted attacks;
• Alert, contain and rebuff attacks and then, with the assistance of the Federal Emergency Management Administration (FEMA), rebuild essential capabilities in the aftermath of an attack or attempted attack.

As a result, there is a tremendous emphasis on developing and testing disaster response and recovery plans in banking and finance, transportation, power, information and communications, and federal and municipal services. We are only as strong as our weakest link.

Power and Utility Companies have a plethora of directives impacting their business operations and particularly their IT governance, risk and compliance environment. Public organizations must comply with a number of additional regulations such as Sarbanes Oxley, Health Insurance Portability and Accountability Act (HIPAA0, and various state regulations. In addition, the US Federal Energy Regulatory Commission (FERC) approved (Jan 2008) the following eight mandatory critical infrastructures protection (CIP) reliability standards:

• Critical Cyber Asset Identification
• Security Management Controls
• Personnel and Training
• Electronic Security Perimeters
• Physical Security of Critical Cyber Assets
• Systems Security Management
• Incident Reporting and Response Planning
• Recovery Plans for Critical Cyber Assets

Sword & Shield Services for Private and Public Utilities

We offer proven, practical services that balance compliance requirements with an effective program to prevent security threats.